Structure of a good control

A control is any action taken by management, the Board or other parties to manage risk within then business and increase the likelihood that established objectives will be achieved.

There is one fundamental principle we should never lose sight of, controls are required if there is a risk that needs to be managed.

“There is no point having a control without a risk to manage”
 
Are your controls genuinely managing risk, or are they simply processes that have become part of the business?

Having a comprehensive Internal Control Framework is important, but simply having the right components in place isn’t enough, the nature and context of the control must also be understood.

What should we expect from a good control?

1. It responds to changing risks
Risks evolve, businesses change and the external environment moves on. Controls must be capable of responding to evolving risks and changes in the business environment in a timely manner.

2. It is proportionate
The cost of operating the control must be balanced against the benefits it provides and the level of risk it is designed to manage.

3. It highlights weaknesses
The system of control must include clear procedures for reporting any significant control failures and weaknesses identified to the appropriate levels of management in a timely manner, together with details of corrective actions being undertaken.

4. It considers both prevention and correction
Ideally, controls should work in pairs one set to prevent the risk materialising (preventative and so has an effect on reducing the likelihood rating of a risk) and the other set to reduce the impact should the risk mature (corrective and so has an effect on reducing the impact rating of a risk).

5. It reduces the likelihood of errors, but doesn’t promise perfection
No control can provide absolute assurance.  The control should help minimise the occurrence of errors and breakdowns, controls cannot provide absolute assurance that that they will not occur.  A good control system recognises that things can still go wrong and considers how failures will be identified and addressed.

6. It is embedded in the business
Controls should form part of everyday operations, rather than being an additional exercise that people only remember when an audit is approaching.

Good controls are about having the right controls, designed for the right risks, operating effectively and delivering genuine value, not just more controls.  This is the mark of a good Auditor/Risk Manager.

We would be interested to hear other risk professionals’ views.