A control is any action taken by management, the Board or other parties to manage risk within then business and increase the likelihood that established objectives will be achieved.<\/p>\n\n\n\n
There is one fundamental principle we should never lose sight of, controls are required if there is a risk that needs to be managed.<\/p>\n\n\n\n
\u201cThere is no point having a control without a risk to manage\u201d<\/strong> Having a comprehensive Internal Control Framework is important, but simply having the right components in place isn’t enough, the nature and context of the control must also be understood.<\/p>\n\n\n\n What should we expect from a good control?<\/p>\n\n\n\n 1. It responds to changing risks<\/strong> 2. It is proportionate<\/strong> 3. It highlights weaknesses<\/strong> 4. It considers both prevention and correction<\/strong> 5. It reduces the likelihood of errors, but doesn’t promise perfection<\/strong> 6. It is embedded in the business<\/strong> Good controls are about having the right controls, designed for the right risks, operating effectively and delivering genuine value, not just more controls. This is the mark of a good Auditor\/Risk Manager.<\/p>\n\n\n\n We would be interested to hear other risk professionals’ views.<\/p>\n","protected":false},"excerpt":{"rendered":" A control is any action taken by management, the Board or other parties to manage…<\/p>\n","protected":false},"author":1,"featured_media":431,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35,19],"tags":[],"class_list":["post-430","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-feature","category-risk-opportunity"],"_links":{"self":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=430"}],"version-history":[{"count":1,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/430\/revisions"}],"predecessor-version":[{"id":432,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/430\/revisions\/432"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/media\/431"}],"wp:attachment":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
<\/strong>
Are your controls genuinely managing risk, or are they simply processes that have become part of the business?<\/strong><\/p>\n\n\n\n
Risks evolve, businesses change and the external environment moves on. Controls must be capable of responding to evolving risks and changes in the business environment in a timely manner.<\/p>\n\n\n\n
The cost of operating the control must be balanced against the benefits it provides and the level of risk it is designed to manage.<\/p>\n\n\n\n
The system of control must include clear procedures for reporting any significant control failures and weaknesses identified to the appropriate levels of management in a timely manner, together with details of corrective actions being undertaken.<\/p>\n\n\n\n
Ideally, controls should work in pairs one set to prevent the risk materialising (preventative and so has an effect on reducing the likelihood rating of a risk) and the other set to reduce the impact should the risk mature (corrective and so has an effect on reducing the impact rating of a risk).<\/p>\n\n\n\n
No control can provide absolute assurance. The control should help minimise the occurrence of errors and breakdowns, controls cannot provide absolute assurance that that they will not occur. A good control system recognises that things can still go wrong and considers how failures will be identified and addressed.<\/p>\n\n\n\n
Controls should form part of everyday operations, rather than being an additional exercise that people only remember when an audit is approaching.<\/p>\n\n\n\n