We strike up conversations about all manner of topics with finance professionals across North America, but discussions about Continuous Controls Monitoring (CCM) can be difficult. In part it is challenging because not many of us have extensive experience with Internal Control. For example, on numerous occasions we've heard comments like “Yes, our internal controls are great; we have segregation of duties!”
With this in mind, and in consideration of the problems that a weak system of Internal Control causes, we thought we would explore some of the basics in this post.
Perhaps the simplest way is to use an analogy:
Imagine you are driving in your vehicle. Your objective? To safely get to the grocery store and back, taking the most efficient route possible.
On your route, there are risks - other vehicles, pedestrians, traffic lights - which threaten to slow you down or even derail you completely on your journey. But you're not powerless. Your car has a number of features that allow you to navigate these dangers - the mirrors, the steering wheel. the turn signals, etc. The skillful use of these features can greatly increase the likelihood of you getting to the grocery store.
More than just Segregation of Duties
Imagine you climbed into your vehicle and all you found was a brake pedal - no steering wheel, no turn signals, no headlights.... Would you start off on your trip? Most likely not - a single safety feature is not enough! You need a wide array of components working as an integrated system in order to have a safe and efficient trip.
Your organization's internal control system is the same. Segregation of duties is an important component (see Control Activities below) of the system. But it alone is not enough to protect your organization and ensure the attainment of your goals. What is needed is an entire framework of internal control.
There are a number of different frameworks but the most popular and the one recommended by the GFOA is COSO. Below, the COSO pyramid illustrates the components of a their framework:
Control environment
This is often referred to as “tone at the top” and represents the many elements of the internal environment that define how the entity will conduct its activities overall. These include “soft controls” such as shared values, high ethical standards and expectations, and openness. However, it also includes “hard controls” such as formal job descriptions and performance reviews, and enforced disciplinary practices for violations from expected behavior.
It is hard to over-estimate the importance of this component. In fact, in January of this year the GFOA published a best practice regarding the control environment we strongly encourage you to read.
Risk assessment
Risk is defined as an event that will impact the achievement of one or more objectives. Risk assessment involves the identification and assessment of likelihood and impact of relevant risks.
Control activities
Control activities are those actions carried out to mitigate risk in order to increase the likelihood that objectives will be achieved. Generally they break down into two categories: Preventative & Detective.
- Preventative:
- Authorization and approval: These activities provide the go-ahead to act on the entity’s behalf. A common example is purchase approval limits, whereby individuals can commit up to a specific amount of the organization’s funds to obtain goods and services.
- Physical controls: This includes activities that ensure the physical security of assets, such as pass cards to restrict building access to only authorized personnel.
- Detective:
- Verification: Verification assists in determining if a transaction is legitimate and based on valid information. For example, ensuring that purchases are made only from approved vendors.
- Reconciliations: The most common type of this control is bank account reconciliations. However, any activity that ensures two or more types of information agree can be defined as a reconciliation, such as a 3-way match between a purchase order, receiving documents and the invoice received from the vendor.
Here we see the role of segregation of duties. It is an example of one type of control activity (preventative). It involves separation of the responsibility for the various aspects of a transaction – initiation, custody, recording and reconciling. For example, separating the approval of a purchase (initiating), the ability to create a purchase order (custody), actually creating the purchase order (recording), and performing the 3-way match mentioned above (reconciling).
Information and communication
Communication is the glue that holds this system together. Information is obtained both from internal activities, such as transaction data, and external sources, such as regulatory requirements. Appropriately and effectively communicating information across and outside the entity is essential for the achievement of objectives.
Monitoring
How do you know the control activities you are counting on are present and functioning? This is the role of monitoring. Unfortunately it is all-too-frequently overlooked.
Your control monitoring system can either be based on manual effort from staff, or automatic checking from one of your computer systems. The other important aspect of your monitoring system is its frequency: periodic or continuous. Manual monitoring very rarely approaches continuous unless you have the resources for MANY dedicated internal auditors. It's much more likely that it will be periodic. Your automated monitoring protocols are more likely to be continuous, although the way you implement them will determine their frequency.
Monitoring tends to be one of the weakest elements in most organization's internal control structure for two reasons:
- Time-intensive: Let's say your organization processes 12,000 A/P disbursements per quarter and you are worried about duplicate payments. To ensure your control activities are working (monitoring), you need to find over 600 randomly sampled disbursements. Once you have this random sample, you now must find and review all the supporting documentation to ensure that there are no duplicates. For most organizations this is several weeks of work.
- Ongoing: You need to monitor all the time. The more infrequent the monitoring, the less confidence you have that your control activities can be relied on to mitigate risk. If you spend weeks of time looking for duplicate payments, how likely are you to tackle monitoring of duplicate payments every quarter? For most of us, we don't have the time available to dedicate to this rigorous of a protocol, despite how high-risk this area is.
Improve Your Framework of Internal Control
It should be clear now that breaking some high-risk tasks into a pieces and segregating them among different staff is just one small (but important) piece of an effective internal control system. But it's not nearly enough.
Developing a proper framework involves much more, and relies on a robust, continuous monitoring program in order to safely "drive" your organization to your objective.
Click the image below to learn more about how to ensure a more efficient, effective and organization.
