Where operating and monitoring internal controls usually breaks

This process usually breaks where a control passes from one person to another, such as from preparer to reviewer or from a finding to the person who must fix it. Most failures are quiet. The control appears to run, yet the evidence is thin and nobody has checked whether the fix worked.

The review that signs without reviewing

A preparer builds a reconciliation or a journal. A reviewer signs it. On paper this is a clean segregation of duties. In practice, the reviewer often approves the summary page and never opens the support.

The signs are easy to spot once someone looks. Sign-offs land within moments of preparation. Reviewer comments are absent across many periods. The same reconciling item rolls forward unchanged, with the same explanation copied each time. When a reviewer cannot say what they checked, the control exists only as a signature.

Tolerances and holds that get waved through

Payment controls depend on matching. An invoice should agree with an order and with evidence that goods or services arrived. Spending should stay within the obligation and the funds available. Each check has a tolerance. Each failed check should hold the payment.

Workarounds grow here because holds delay vendors and vendors complain. A tolerance gets widened to clear a backlog and never goes back. Receipts get recorded only after the invoice turns up, purely to force a match. Holds get released by whoever is available, not whoever has authority. Funds control rules lag behind a reorganisation, so the overspending check fires against a segment nobody manages any more, and staff learn to override it.

Look for receipt entries dated right beside invoice entry. Look for tolerance settings changed with no approved request behind them. Check whether the same user both creates and releases holds. Budget overrides that cluster at particular accounts usually point to a rule that no longer fits the structure.

Reconciliations that balance only on paper

Cash against the bank or treasury records, subledgers against the general ledger, payroll summaries against what was actually paid, the asset register against the financial records: these are where errors surface first. They are also where errors get parked.

A difference nobody can explain goes to a suspense account or sits as an unreconciled line with a note promising follow-up. The reconciliation is marked complete because it was performed, not because it resolved anything. Warning signs include a suspense balance that keeps growing, reconciling items that age without action, and adjustments posted after draft statements are already in circulation. A receivables or asset balance that differs from its source system, with a standing explanation, is another tell.

Exceptions handled outside the system

Urgent payments, disputed invoices and debtor arrangements often move to email and spreadsheets. The approval happens, but it leaves no trail the control can test. Credit memos and receivable adjustments are frequent offenders, because they get negotiated in conversation and keyed later.

Manual payment activity rising without a business reason is one indicator. Approvals stored as attachments in a mailbox are another. Ask for the evidence behind a sampled exception. If finding it takes a hunt, the exception route has become the normal route.

Remediation that ends at the action plan

A deficiency is logged. An owner is named. A plan is written. Then the internal control team hands it to the process owner, and momentum drops at that handoff. Items get closed when a procedure is redrafted, long before the corrected control has operated and been retested.

Recurring audit findings are the clearest symptom. So is closure evidence that consists of a policy document with no operating samples. Target dates that keep moving, and root causes recorded simply as human error, suggest nobody has examined why the control failed.

Documentation that no longer matches the work

Cycle memos and process narratives describe how the control ran when someone last wrote them down. Systems change. Roles merge. The narrative stays put.

Auditor requests expose the gap. Requests for client-prepared support trigger a scramble. Samples show steps the memo never mentions, or skip steps it insists on. A memo that names a retired system or a role that no longer exists has drifted. Testers working from a document the operators have never read will test the wrong thing.

Questions to ask the people who run it

• When this control flags something, what usually happens next, and who decides?
• Which checks get overridden most often, and why does the override feel justified?
• What do you actually look at before you sign a review?
• Where do unexplained differences go when the reconciliation is due and they are not resolved?
• Which approvals happen by email or in conversation instead of in the system?
• Has any tolerance or funds control rule been changed to get work moving? Was it ever changed back?
• When a deficiency was last fixed, how did anyone confirm the fix worked?
• Does the written procedure describe what you do today? Where does it differ?
• What do you dread when auditors ask for evidence?

The answers to the last question tend to be the most honest. They show where people already know the control is weak.

APQC's Process Classification Framework® (PCF) is an open standard developed by APQC, a nonprofit that promotes benchmarking and best practices worldwide. To download the full PCF or to view definitions and measures, please visit www.apqc.org/pcf.