Having Internal Controls Isn’t Enough

Posted: June 27, 2017 - Assurance, Blog, Governance & Risk Advisory

In an effective system of internal controls, the COSO model sets forth five key components that function together to strengthen an organization’s ability to achieve its objectives and mission: the control environment, the risk assessment process, information and communication, control activities, and the monitoring of controls. These components are integrated and interdependent.

Creating such a comprehensive structure has a downside: when one component isn’t functioning at an optimal level, the organization is likely to feel the ripple of that deficiency in the other components. It is easy for an organization to let any of these components fall through the cracks, and the whole system can suffer to some degree as a result. After all, having a strong system of internal controls is no quick or easy feat; it requires time and effort to develop it, company resources, and competent personnel who are committed to maintaining that system.

In my experience, monitoring the internal control system seems to be the easiest one to let slip away. When we see the word monitor or evaluate, our mind can often trick us into thinking it isn’t required. We can say that we finally have our controls in place, and that’s good enough for now. This can’t be the case when it comes to internal control though. Monitoring our controls isn’t going the extra mile – it’s finishing the race we started.

Here are some of my key takeaways about the monitoring process that may be helpful to anyone considering how to make their internal control system more robust and impactful.

Even the best internal controls can be inadequate if they aren’t monitored

Impact doesn’t always match intent. A control can be sufficiently designed, and in that sense it will look great on paper. But this isn’t enough because it begs further questions. Is that perfect control implemented properly by individuals responsible for performing it? Are there changes in other processes (including external processes that impact our business) that may require the control to be tweaked? Is the control actually effective in achieving the results we want? We may not know the answers if we aren’t actively monitoring our controls. Doing so gives us the opportunity to consider these questions.

Proactive is always better than reactive

There may not always be a red flag in our day-to-day operations to let us know that something is going wrong in our processes. This is especially the case with fraud risk, which continues to be an escalated concern in the business world due to how costly handling these situations has become. Clear procedures for monitoring your controls will give your team a better opportunity to prevent, or at the very least identify, issues that can be damaging to your business. Committing resources up front to be proactive in your approach to risk governance will save your team some unnecessary headaches.

Effective monitoring can be a joint effort – consider an outside perspective

Don’t be afraid to seek trusted external assistance to assess your internal controls. It may seem counter-productive to bring an outside party who isn’t familiar with your processes into your business to assist in this process, but there’s actually a great benefit to it. The more we perform a process and familiarize ourselves with the details of it, the more we normalize it. Bringing in a fresh outside perspective can result in identifying deficiencies and areas of improvement in your processes that might have been missed because your team is just too close to it. These teams can also bring diverse insight to your business when you work with professionals that have a rich experience of working with various companies and seeing how processes can work effectively in multiple ways.

Having an effective internal control system strengthens the quality of information your team has at its disposal and the business will be in a more capable position to meet its strategic objectives. If you want to maximize the system’s value to your business, monitoring has to be treated as a critical step. If we can assist you in optimizing your internal control system in any capacity, please contact Vincent Arcari ([email protected]).

Vincent Arcari

Vincent is an Assurance Staff at CDH.