Can you imagine working for a company where employees frequently had to make exceptions to get things done? Or where deadlines were constantly being missed?
It takes great skill to run a business effectively. Too much or too little control can result in failure. However, finding the right balance is achievable if you know what to look for.
Controls are the guides and related principles that a company uses to strengthen its internal guidance system. A company’s policies around risk management set the tone for how its control environment is developed.
Non-existent or poorly conceived policies can create a headache for a CEO. For example, differing concepts of a control environment will cause difficulties between top executives and wastes valuable time when the CEO has to mediate. Clarity is very important in communicating the key elements of an internal control system.
Let’s take a look at some examples of environments that are askew in their controls.
Over-controlled vs. Under-controlled
A workplace that is over-controlled may see employees habitually bending the rules or requiring multiple signatures to approve an invoice. Poor attitudes and excuses may also reflect a lack of framework for the decision-making process. On another level, you might have an internal audit department that’s twice the size of the finance department—too large for a non-value added activity.
Signs of an under-controlled financial group include inadequate processes, disjointed systems and poorly trained employees. These deficiencies lead to untimely and inaccurate reporting, difficulty closing the books and high employee turnover. Indicators of an under-controlled operations group are regularly missed deadlines; being late for meetings and submitting proposals, and complicating simple tasks—all resulting in lost money and opportunity.
Achieving Middle Ground
Good controls aren’t meant to suffocate a business. The Committee of Sponsoring Organizations (COSO) of the Treadway Commission’s internal control has developed an international framework that will help you evaluate your control environment, determine deficiencies and make any necessary implementations.
- Control Environment
- Demonstrates commitment to integrity and ethical values
- Exercises oversight responsibility
- Establishes structure, authority and responsibility
- Demonstrates commitment to competence
- Enforces accountability
- Specifies suitable objectives
- Identifies and analyzes risk
- Assesses fraud risk
- Identifies and analyzes significant change
- Selects and develops control activities
- Selects and develops general controls over technology
- Deploys through policies and procedures
- Uses relevant information
- Communicates internally
- Communicates externally
- Conducts ongoing and/or separate evaluations
- Evaluates and communicates deficiencies
For a high level company to be controlled effectively, all five components and their principles must exist and operate as a cohesive package within its internal control system. It also incorporates monitoring and ongoing evaluations as your company makes changes.
A little control goes a long way. Establishing a healthy balance in all of these areas will give your company the necessary structure and space to reach its full potential.