Report on internal controls compliance: what each role knows and where the gaps hurt

Control owners know how controls actually operate. The compliance team knows which ones have failed testing. Auditors know where they will look next. Executives know what is about to change. Each group reports on the same controls, and trouble starts when one group's version reaches an audience the others never checked.

Control owners

The payables clerk, the budget analyst and the treasury operator perform the controls every day. They know which approvals happen in the system and which happen in an email that nobody files. They know when the three way match is overridden because a receiving report arrived late. They know which funds control limits get raised informally at month end so a payment can go out.

None of this appears in the cycle memo unless someone asks. Most people are not asked.

The internal controls team

This group owns the testing calendar and the deficiency log. It knows which controls failed last cycle, how each failure was classified, and which remediation is still open. It also holds the cycle memos and the sample documentation prepared for management's assessment.

What it often lacks is current knowledge of the process. Memos written after a system change may describe the old screens. Testers pull samples from reports that control owners stopped trusting long ago. When the team signs off a control as effective, it is vouching for a design that may no longer match practice.

External auditors

Auditors know their own risk assessment. They know which accounts they consider significant this year, what their sampling approach will be, and which findings from other clients have made them nervous about a particular area. They rarely share all of it in advance.

The organisation sees this only through the Prepared By Client list. A request for payment audit evidence or an overspending report signals where attention has shifted. Finance teams that read the list as a clerical task miss that signal entirely.

Treasury, legal and investor relations

These functions report outward. Treasury knows the covenant certificates owed to lenders and the representations made in them. Legal knows the exact wording regulators and exchanges expect, and the consequences of getting it wrong. Investor relations knows what has already been said to shareholders and debt holders.

They seldom see the deficiency log. A control weakness can sit in an internal report for weeks while a certificate to a bank states that controls are operating effectively. Nobody lied. The two documents simply never met.

Senior management

Executives know what is coming. A reorganisation, a new ERP module, an acquisition, a planned outsourcing of payables. Each of these will move control ownership or break existing controls.

Management receives the compliance report as a summary, usually green. It does not see the workarounds or the near misses. Plans get approved on the assumption that the current control environment is stable, when it may only look stable on paper.

Where the gaps bite

The sharpest problems appear at handoffs.

Audit findings generate adjustments, and those adjustments are documented by the controls team. Often they never reach the people who maintain funds control rules or payment approval routing. The same finding returns next year.

Third parties such as customers, grantors or credit agencies ask for assurance on narrow questions. Someone in sales or operations answers from memory, without checking the deficiency log. The answer contradicts what auditors were told.

Severity is described differently to each audience. Internal management hears "a timing issue." Auditors hear "a control gap under remediation." Regulators may hear nothing. When these accounts are compared later, the inconsistency becomes its own problem, sometimes larger than the original weakness.

Ownership also drifts. After a system change, a control can end up with no clear owner while still being reported as effective, because the report is built from last cycle's attestation.

Questions to ask the people who run it

Ask control owners:

• When does this control get skipped or done after the fact, and who decides that is acceptable?
• Which reports used as evidence do not match what is actually seen on screen?
• What changed in the work since the memo was last updated?

Ask the internal controls team:

• Which deficiencies are open, and who outside finance has been told about each one?
• How are samples selected, and does anyone in operations check that the population is complete?
• Where do audit adjustments go once they are recorded?

Ask treasury, legal and investor relations:

• Which external certificates or filings make statements about controls, and who drafts that language?
• Is anyone required to check the deficiency log before signing them?

Ask the external auditors, early and directly:

• Which areas worry them most this year, and why?
• What evidence did they find hardest to obtain last time?

Ask senior management:

• What planned changes will move people, systems or approvals over the coming period?
• Who is accountable for telling the controls team before those changes go live?

The answers rarely match the documentation. That mismatch is the real map of the process.

APQC's Process Classification Framework® (PCF) is an open standard developed by APQC, a nonprofit that promotes benchmarking and best practices worldwide. To download the full PCF or to view definitions and measures, please visit www.apqc.org/pcf.