Who Knows What in Internal Controls, and Where the Gaps Cause Trouble

Each role holds a different piece of the control picture. The audit committee knows what failure would cost. Process owners know where the work bends around the policy. Control owners know which checks they actually perform. Auditors know what was tested. Trouble starts where these pieces never meet.

The board and audit committee

Directors see risk from the top. They know which failures would end careers, draw regulators or damage trust. They set the tone through the code of ethics and approve how much risk the organisation will carry.

What they rarely see is the daily mechanics. They read summaries of control results. They do not watch a clerk override a warning in the ledger. So a committee can approve a tight risk tolerance without knowing that one team meets it only by working late and skipping a step nobody reports.

Finance leadership and the controller

The controller knows the design. Policies, approval limits and the general ledger structure all trace back to this office. Finance leadership also knows which audit findings are still open and which ones were promised to the committee as fixed.

The blind spot is drift. A policy written cleanly can be applied loosely in a regional office or a newly acquired unit. Finance often learns about that drift from an auditor, which is the worst way to learn it.

Process owners in the business

The people who run procurement, billing or payroll know where controls slow them down. They know which approvals arrive late, which vendor records are unreliable and which exceptions happen so often they have become normal.

They seldom know why a control exists. A matching step that looks like paperwork may be the only thing standing between a duplicate payment and the bank. When process owners cannot see the risk behind a check, they quietly redesign it.

People who perform the checks

Control owners are named in a matrix. The people doing the work are often someone else. A manager signs a reconciliation that an analyst prepared. The analyst knows what was really reviewed. The manager knows what was signed.

This gap matters most when staff leave. Tacit knowledge about how to read an exception report walks out with them, and the documented procedure does not capture it.

Budget and funds control staff

Where spending is limited by law or by appropriation, funds control staff hold knowledge others lack entirely. They understand how the control structure is segmented by organisation, programme and project. They know the tolerance set between commitments and obligations, and between obligations and actual spend.

Outside this group, those tolerances are invisible. A programme manager may not realise a contract modification will breach a limit until the system blocks it. Funds staff, for their part, often cannot tell whether a blocked transaction is a genuine overspend or a coding mistake upstream.

Internal audit and compliance review

Reviewers know what was sampled, what failed and what the cycle memos claim. They prepare the documentation that external auditors request and they track the adjustments that findings require.

Their view is periodic. They test a slice of activity and see the process as it stood on those days. A workaround that appeared last month may be absent from every memo on file.

Where the gaps cause trouble

The most common failure is a control that exists on paper and nowhere else. Finance believes it is running. The business believes someone else performs it. Audit tested it once, found it fine, and moved on.

A second failure comes from tolerances set at the top that nobody below can see. Directors approve a risk appetite. It never reaches the thresholds configured in the system, so the system enforces something else.

A third arises during change itself. A new system or a reorganisation removes a manual step that was secretly doing control work. No one flags it because no single role knew the step mattered.

Responsibility assignments also decay. Names in the control matrix go stale after promotions and departures. Until an auditor asks who reviewed a sample, nobody notices the role is empty.

Questions to ask the people who run it

• Which checks do you perform that are not written down anywhere?
• When a warning or block appears in the system, what usually happens next?
• Who actually prepares the work behind the sign-off you give?
• Which exceptions come up so often that the team treats them as routine?
• If you were away for a month, what would stop being done?
• Do you know the spending tolerances that apply to your area, and where would you look them up?
• What did the last audit finding in your area change about how the work is done today?
• Which approvals do you chase, and which do you assume will come?
• Is there a step you suspect is pointless? Who told you why it exists?

Ask these questions in the room where the work happens, with the people who do it. Answers given in a meeting with their manager present tend to match the procedure manual. Answers given at the desk tend to match reality.

APQC's Process Classification Framework® (PCF) is an open standard developed by APQC, a nonprofit that promotes benchmarking and best practices worldwide. To download the full PCF or to view definitions and measures, please visit www.apqc.org/pcf.