Mind the Gap: Do Your Internal Controls Functions as Intended?
- Fikret Sebilcioğlu CFE, CPA, TRACE Anti-Bribery Specialist
- Managing Partner
- E-mail to Fikret
Monitoring process is one of the most critical elements of your internal control system which helps to understand, assess and reduce gaps between design and operating effectiveness of your internal control. Would you dare not to mind these gaps?
A gap is a space between two objects. “Mind the Gap” became a slogan of the London underground system, warning travelers to be aware of the space between the platform and train in the London underground system. The phrase urges people to take care, warns them to avoid injury or damage from a hazard. In this article, I want to draw an analogy between the meaning of this phrase and the often-ignored gap between design and operating effectiveness of the internal control system in companies.
It is true that a well-designed and well-functioning internal control system can help an entity achieve its performance and profitability targets. Boards, as head of the governance, are ultimately responsible for that system. Although boards can delegate the task of establishing, operating and monitoring the system to the management, they cannot delegate their responsibility.
Why These Gaps Occur?
Establishing and operating the system of internal control is crucial for reaching the company’s targets. These challenging tasks include designing and integrating controls into the company’s business processes based on the risk assessment by considering human and technology factors. But after these tasks, much more challenging one comes up to make the final touch: monitoring internal control systems.
The first point to consider when designing a control is whether this control is designed in a way that would prevent or detect an error or fraud. The subsequent question is whether this control functions effectively in preventing and detecting any errors or frauds. This second question points out the importance of effective monitoring activities.
Controls tend to deteriorate over time due to various reasons. The gaps between design and operating effectiveness of your internal controls may occur and gradually become wider if monitoring activities are not conducted timely and properly. You cannot get away from this fact by continuously changing strategy, people, technology and organization.
The symptoms of a gap are mainly recurring errors in information used in decision making, inaccurate financial reporting, increased ethics and compliance issues and fraud incidents. Boards who do not mind these symptoms and the gap in a timely manner may run the risk of the gap becoming too wide.
The most common reasons for those gaps can be summarized as follows:
• Effectiveness of controls are limited by human judgment. If a decision is unethical, illegal or made hastily, without taking every aspect into considerations, there is a risk that the controls are not go-ing to function as designed.
• Controls can break down as a result of misunderstandings or errors made due to fatigue, negligence or distraction.
• Controls are only as effective as the people who are responsible for its performance. Employees or managers who lack qualification and training necessary to fulfil their assigned functions could impair the quality of controls.
• Collusion and management override of controls can result in control failure.
• Limited resources (cost/benefit)
- excessive control is costly
- insufficient control creates risk for the company.
An example of a well designed control is journal entry recording and approval. If we set up the rule that one person prepares a journal entry and then someone independent must review and approve it, that is a good design. Whether the control activity (review and approval mechanism) operates as effectively as designed is a different question that leads us to the monitoring procedures.
How to Bridge the Gap
Monitoring procedures should be implemented to ensure that internal controls continue to operate effectively. Ineffective oversight of the company’s internal control by boards and management, namely not minding the gap, could have a devastating impact on the company’s performance and reputation.
It is an important function of the board to oversee the internal control systems covering financial reporting and the use of corporate assets and to guard against abusive related party transactions.
OECD Principles of Corporate Governance
In business today, boards and managements tend to focus on addressing known and actual control problems only when they emerge, without radically changing the design of the internal control system. Unfortunately, this approach does not touch the cause of those problems. Therefore, I recommend that companies design and implement monitoring activities to exclude gaps at all or reduce them to the minimum.
Let us get into the monitoring framework deeper. In accordance with the COSO’s Internal Control Integrated Framework, there are two fundamental principles of effective monitoring:
• Ongoing and/or separate evaluations enable management to determine whether the systems of internal control continue to function over time, and
• Internal control deficiencies are identified and communicated in a timely manner to those parties responsible for taking corrective action and to management and the board as appropriate.
Probably the most challenging task is to achieve effective monitoring as it requires deep understanding of all of the aspects of internal control system and the company business, independence and objectivity and adequate expertise. It is not possible to achieve it unless the following three elements are properly implemented:
- Enabling an environment where effective monitoring procedures can be implemented, including (a) a proper tone at the top; (b) an effective organizational structure that assigns monitoring roles to people with appropriate qualification, objectivity and authority; and (c) a proper internal control environment where ongoing monitoring and separate evaluations can be implemented;
- Designing and implementing monitoring procedures, which focus on the controls that address key risks; and
Assessing and reporting results, which includes evaluating the significance of identified deficiencies and reporting the monitoring results to the appropriate personnel and the board for timely action and followup.
Scope of Monitoring Procedures
Companies may conduct a wide variety of monitoring procedures, including but not limited to:
• Periodic evaluation and testing of controls via internal audit,
• Continuous monitoring programs built into information systems such as exception reports,
• Analysis of, and appropriate followup on, operating reports or metrics that might identify anomalies that indicate a control failure,
• Management reviews on controls, such as reconciliation reviews as a normal part of processing,
• Audit committee inquiries of internal and external auditors,
• Quality assurance reviews of the internal audit department,
• Self-assessments by boards and management regarding the tone they set in the organization and the effectiveness of their oversight functions.
Benefits of Effective Monitoring
When monitoring activities are designed and implemented appropriately, companies can benefit because they are more likely to:
• Identify and solve internal control problems in a timely manner,
• Produce more accurate and reliable information to be used in decision-making process,
• Prepare accurate and timely financial statements,
• Detect and prevent errors or fraud so that accurate financial statements can be prepared.
Last words
A comprehensive explanation how to design monitoring procedures and implement them is beyond the scope of this article. I just wanted to start a debate about the importance of building bridges and reducing the gap between design and operating effectiveness of your internal controls through implementing effective monitoring procedures. I hope that this article has offered you some promising pathways to progress.
Do not wait until the gaps scream for attention. The earlier you mind those gaps, the less painful the remedy and more productive the result.