Who Knows What in Operating and Monitoring Internal Controls

The people who perform controls know where the workarounds are. Compliance testers know what the documentation claims. System administrators know how rules are really configured. Budget and program staff know where money is tight and which balances are stale. Trouble starts when each group assumes another already holds the missing piece.

The people performing the checks

Payables technicians, reconciliation accountants and payroll staff do the daily control work. They match invoices to orders and receiving reports. They hold payment requests that fail validation. They reconcile summary payroll figures against the ledger.

They also know things no control matrix records. A hold might get released by a supervisor when a prompt payment deadline is near. An approver might sign batches without opening the attachments during busy weeks. A reconciling item might sit in a suspense account because nobody can trace it, and it has been there long enough that people stop seeing it.

None of this is hidden on purpose. It is simply never asked about.

The compliance and testing team

This group owns the cycle memos and the control descriptions. It selects samples for internal control assessments and answers auditor requests for documentation. It remembers prior findings and the corrective action plans written to close them.

What it often lacks is current knowledge of how the work moved. A control gets tested as it was described at the last review. If a system upgrade changed the matching logic, or a team reorganised and a reviewer left, the test may still pass on paper. The sample happens to avoid the cases where the control now breaks.

The people who configure the systems

Funds control lives in configuration. Someone sets the control levels by organisation, program or project. Someone sets the tolerance between obligation and commitment amounts, and between expenditure and obligation amounts. Someone decides whether exceeding a limit blocks a transaction or only warns.

Administrators know when those settings change. A rule may get loosened to stop a flood of rejections at year end. A new accounting segment may get added without a funds check attached. These changes are usually logged in a ticket. They rarely reach the compliance team, so a control documented as preventive can quietly become detective, or vanish.

Budget and program staff

Budget officers know which accounts are close to their apportioned limits. Program managers and contracting officers know which undelivered orders will never be delivered and which obligations should be de-obligated.

Finance sees balances. It does not see intent. Without input from the program side, stale obligations sit on the books and receivables age without anyone deciding whether to pursue, adjust or refer them for collection.

Where the gaps cause real damage

Remediation is the most common failure point. A deficiency gets identified. The compliance team drafts a corrective action plan. Operations staff, who will have to carry it out, see it for the first time when it lands in their queue. The fix may add a review step that cannot be done in the time available, so it gets done in name only.

Reconciliation with the Treasury balance shows the same pattern. The reconciler often knows that recurring differences trace back to a single feeder system or a particular transaction code. They clear each month with an adjustment. The root cause never travels upstream, because the reconciler's job is to balance the account, and the feeder system owner never hears there is a problem.

Auditor requests expose the gap from the other side. Documentation gets assembled after the fact, by people who did not perform the control, from records that were never designed to evidence it. Findings follow, and the remediation cycle starts again with the same missing conversations.

Questions to ask the people who run the process

• When a payment fails validation, who can release the hold, and how often does that happen near a deadline?
• Which approvals get done from a summary screen without opening the supporting documents?
• What changed in the system settings recently, and who was told?
• Does an overspend against a funds control level stop the transaction or just flag it?
• Which reconciling items keep coming back, and where do they start?
• Which open obligations does the program office already know are dead?
• When the last corrective action plan was written, who from operations reviewed it before it was approved?
• If a control step were skipped today, how would anyone find out?
• What evidence is kept at the moment a control is performed, and what gets recreated later for auditors?

The answers usually differ from the cycle memo. Those differences are the real map of the process.

Before redesigning anything

Put the configuration owner and the control performer in the same room as the tester. Walk one real transaction through from commitment to payment. Ask each person what they would have expected to see at each point. Where their expectations disagree, the control is weaker than anyone believes, and that is where a change should begin.

APQC's Process Classification Framework® (PCF) is an open standard developed by APQC, a nonprofit that promotes benchmarking and best practices worldwide. To download the full PCF or to view definitions and measures, please visit www.apqc.org/pcf.