Internal controls that are systematically designed, implemented, and maintained by focused internal control specialists with great skill are a small minority of controls.
Most controls happened for other reasons. For example:
A software package had them built in.
•
After a costly or embarrassing incident or near miss people thought about how
•
to prevent its recurrence.
A manager was appointed who had had an embarrassing incident in a previous
•
role and wanted the controls he or she was used to.
An internal or external auditor recommended the control and it was put on a
•
list and followed up until done.
Table 3.2 Illustrative responses to uncertainty in a charity
Areas of uncertainty Ideas for improvement management
The risks around individual cases involving women.
Review the information collected about risk factors in each case. Experiment with a checklist of risk factors.
Funding. Uncertainty about income from one year to the next and also uncertainty about the cost of programmes under consideration.
New forecasting and commitment planning approach based on Adrian Pof ey’s book,1 which is excellent on this.
Effectiveness of programmes. The true impact of programmes is sometimes hard to measure or even judge, and the effects of proposed programmes are even more dif cult to predict.
We’ve tended to argue about what to do until we reach some kind of consensus but then commit to programmes as if we know what they will achieve. Time to look at how we can gather more information through trials and develop our programmes in an evolutionary way, dynamically adjusting priorities as we learn quickly.
The reactions of volunteers. We rely on volunteers and major changes to the way things are done can affect their willingness to continue supporting.
New programme of consultation with volunteers on various ideas for improving programmes and the way the charity is run.
1 Pof ey, A. (2002) Financial Stewardship of Charities. London: Directory of Social Change.
Some special event like a listing on a stock exchange triggered a one-off internal
•
controls upgrade programme – most likely focused on nancial reporting.
Controls tend to fall away again not because of deliberate optimization but because of events such as these:
The person responsible for carrying out a control retires, is transferred, resigns, or
•
is laid off.
Work pressure from other priorities leads to a control gradually being neglected
•
and then forgotten about altogether.
The way work is done changes so that the old control cannot be performed or
•
is no longer relevant.
Software is replaced with new software.
•
Table 3.3 Illustrative responses to uncertainty for a builder
Areas of uncertainty Ideas for improved management The health and safety of the team. Get the protective clothing I’ve been
meaning to buy for months. Discuss the risk factors of each job with the lads before starting, and give them reminders relevant to each job.
Unexpected problems on jobs, especially what we nd when we start digging and the results of using unfamiliar tools or materials.
Most of the warning signs are obvious so I’ll start checking through a list of potential problem areas and spend a bit more time on design and planning.
It would be worth discussing major uncertainties with customers because some will be prepared to pay for work unexpectedly required, particularly if they have been warned of the possibilities. I’ll look at equipment that might allow me to check what is underground or behind a wall before I give a quote.
Our schedule through the year, particularly the effects of cancellations, sickness, weather, and project problems.
Stop promising dates to customers so far in advance. Start giving indications of start dates where the customer can be exible. Update the customer closer to the start time. Look back over typical drift over the last few years so I can give customers a realistic range.
Whether customers will pay. Stage payments through the job. Can’t think why I’ve never asked for more than the cost of materials until now.
The uncertainty in the customer’s mind about what they want. They seem particularly vague on materials, but some customers nd everything dif cult to decide.
Increase my range of samples of materials so I can show people the real colour and texture. Offer a drawing service including 3D/perspective drawings of projects.
In many ways this evolution works well. Controls tend to grow where there is pain and fall away where there is little or no pain but plenty of pressure to do more important things.
However, there are some predictable weaknesses in natural evolution of control systems. These include the following:
Controls are rarely implemented in good time. Remediation is the norm. Often,
•
something has to go wrong before action is taken.
Controls to generate and make the most of future opportunities are not as
•
common as they should be because the link to the pain this causes is not obvious.
The strength of each type of control implemented initially depends on the
•
enthusiasm of the person who thought of it, not actual need. There are usually large gaps in some areas, especially when a business sets up an entirely new process and this is done by young people with limited practical experience of operating such processes (e.g. many business analysts employed by large IT companies).
Controls against rare but serious risks can fall away due to lack of pain even
•
though the risk is still there, as threatening as ever. It may be that the event has never happened to the organization so it feels rather theoretical to most people.
Routine errors are tolerated. People seem to accept low but persistent levels of
•
error and other losses as inevitable and acceptable, even when they are not.
Losses of revenue in telecoms are small as a percentage of total revenue and many are persistent problems that have been there since the beginning. By contrast, losses due to dramatic events tend to get more attention.
Controls sometimes live on long after their usefulness has ended because
•
people are not under enough pressure or are very dedicated to following laid down policies. Large inef ciencies can build up.
Controls designed as an integrated system rather than piecemeal can be more ef cient and effective. This is particularly so if special skill is applied and the focus is on value rather than just risk coverage.