Where internal controls compliance reporting breaks

Internal controls compliance reporting usually breaks where evidence changes hands. Control owners send testing results late or incomplete. Auditors request samples that nobody can retrieve. A single deficiency gets worded one way for management and another for regulators. Each break surfaces as last-minute rework before a reporting deadline.

Evidence handoffs from control owners

The controls team rarely performs the controls it reports on. Payables clerks, treasury analysts and budget officers do. Their proof of performance has to travel to whoever assembles the report, and that trip is where most trouble starts.

Owners treat the handoff as an interruption to their real job. They send a screenshot where a signed approval was needed, or a system extract with no date range. The reviewer bounces it back. The owner resends something slightly different. By the time the evidence is accepted, the reporting window has shrunk.

A telling sign is a tracker full of items marked "received" that later flip to "insufficient." Another is a reviewer who keeps a private folder of chasing emails. If the same owners appear on the late list every cycle, the problem is the request itself. It is not a matter of effort.

Auditor requests and sample pulls

External auditors work from a request list of items the organisation is expected to prepare itself. The list looks orderly. Fulfilling it is not.

Sample selections are the hard part. An auditor picks invoice payments, and the team must produce the matched invoice, order and receiving report for each, plus the approval trail. When the approval happened outside the system, in email or on paper, someone has to dig. Foreign payments add conversion records that sit with a different group.

Watch for requests closed with a note saying "provided separately." That usually means a person walked a document over, and nobody can reproduce it next year. Repeated follow-up questions from auditors on the same sample are another warning. So is a request list where the due dates keep moving.

Deficiencies told differently to each audience

A control failure found in testing has to be reported upward to internal management and outward to auditors. Depending on the organisation, it may also go to regulators, lenders, an exchange or other third parties. Each audience gets its own document, often drafted by a different person.

The drift is gradual. Management sees a candid description. The external version gets softened. A third-party certification repeats wording from an older report. When an auditor or regulator compares them, the inconsistency becomes a finding of its own.

The giveaway is a deficiency log with no single owner of the final wording. Ask to see the management version beside the external one. If the severity rating or the remediation date differs, the break is already happening.

Cycle memos that no longer match practice

Cycle memos describe how a process runs and where its controls sit. They are written once, updated reluctantly, and tested against.

Over time, a system upgrade moves an approval step, or a funds control check that once blocked overspending becomes a warning that users click past. The memo still says "system prevents." Testers test what the memo says, find something else, and log an exception that is really a documentation gap.

The pattern to look for is a cluster of exceptions in one process area that all trace back to the same description. Memos whose last revision predates a known system change deserve suspicion.

Workarounds that hide inside the reporting

Some fixes never get written down. A senior accountant reruns a report by hand because the scheduled version drops certain cost centres. A manager approves in bulk at period end to clear a queue. An adjustment from a prior audit finding gets booked manually every period because the root fix never shipped.

These keep the numbers right but make the control evidence fragile. If that one accountant is away, the report fails. Bulk approvals look like control performance but carry little review.

Look for spreadsheets that sit between the system and the final report. Recurring manual journals with the same description are a second clue. A third is any step that depends on one named person.

Questions to ask the people who run the process

What gets documented and what gets done often part ways. These questions tend to surface the difference.

• When an evidence request lands, what is the first thing done, and who gets asked?
• Which auditor requests are dreaded, and why?
• Where does an approval happen outside the system, and how is it proved afterwards?
• Who decides the final wording of a deficiency before it goes outside the organisation?
• Is there a spreadsheet or manual step that the report could not be produced without?
• Which part of the cycle memo would be described differently if it were rewritten today?
• What happens when a funds control check flags an overspend? Can it be overridden, and by whom?
• Which audit finding keeps coming back, and what is done each period to keep it from reappearing?
• If the person who assembles the report left tomorrow, what would stop working?

The answers matter less than the hesitation. A pause before answering usually marks the spot where the documented process and the real one have separated.

APQC's Process Classification Framework® (PCF) is an open standard developed by APQC, a nonprofit that promotes benchmarking and best practices worldwide. To download the full PCF or to view definitions and measures, please visit www.apqc.org/pcf.