Internal Controls

A Control Is Only Useful If It Works When It Is Needed

Most organizations can produce an internal-control manual.
That does not necessarily mean they have a strong control environment.
The real test comes when something goes wrong.
Was the issue detected? Was it visible to the right person? Was it corrected quickly? Did management

understand why it happened?
This is where the difference between a documented control and an effective control becomes clear.
Consider a simple bank reconciliation.
The reconciliation may be prepared every month, signed and filed.
But if differences remain unresolved for several months, the control exists administratively while failing economically.

The same applies to approvals.
A two-signature process may appear strong, but if senior staff routinely approve transactions after the fact or system access allows the process to be bypassed, the control does not provide the protection management assumes it does.

For this reason, control design should always start with the risk.
What exactly could go wrong?
Once that is clear, management can decide whether the control is proportionate and whether it will actually prevent or detect the issue.
Evidence also matters, but not for the sake of paperwork.
Good evidence makes accountability possible. It shows who performed the control, what was reviewed and what happened when an exception was identified.
Exceptions themselves are useful information.
An isolated failure may be an error.
A pattern usually tells management something more important about the process, system, capacity or behaviour behind it.

This is why internal controls should not be treated as a collection of procedures.
They are a management mechanism.
Their purpose is to give decision-makers reasonable confidence that significant risks are being managed and enough visibility to intervene when they are not.

The strongest control is not necessarily the most complicated one. It is the one that performs its purpose consistently and becomes visible when it fails.