“Do More with Less”: 4 Ways Internal Control Programs Can Add Value in Lean Times

Hello Internal Control, SOX, CSOX Managers, Controllers – or anyone who runs internal controls in your organization!

Across the business landscape, I see organizations putting a huge focus on how they can do more with the people and resources they already have.?

Well, the good news is, it’s possible. With the right thinking and techniques, you can stretch your internal control budgets further while getting the same (if not more!) value out of your programs.?

In this video, I share four of my favorite ways to approach your internal control program, specifically in lean times.

1. Pay the “right” amount for the “right” talent.

Be smart about your people and staffing budget. As per the adage, “You get what you pay for,” I do not believe or recommend hiring “cheap” people.?

But you can be thoughtful and reasonable in assessing the resources you need and how to hire or contract them.

I am a big believer in paying well for people who can challenge and improve the design of your processes, systems, and controls and provide you with high-value recommendations that improve your organization overall. But you don’t need to spend $300 an hour to tick and tie invoices.

2. Treat internal controls like the 800-meter dash, not the ultra-marathon.?

A common resourcing mistake I see in internal control programs is hiring people full-time, all year, especially for smaller or mid-sized companies.

Think of internal control projects as more like the 800-meter dash and less like the ultra-marathon.

Bring in people when you need them and plan an intense “sprint” to get what you need done during a concentrated part of the year. Audit and internal control fatigue are real issues nowadays. Increasing regulatory demands, ESG, and then pressures to cut costs are only exacerbating the issue. You will burn out your stakeholders if you are bugging them all year.

3. Revisit the reperformance standard.

The reperformance standard is the de facto standard for internal control programs and the audit profession. If you are rusty on the definition, let’s revisit it:

REPERFORMANCE STANDARD means: A user can use a stand-alone document or system to perform the related task or process.?

“Reperformance” means your document has enough detail for your reviewer or user to understand what you did without asking for help. In practice, this means being able to retrace the underlying transactions reviewed, the work performed, the analysis and thinking that informed the work, and the conclusions drawn.

The standard doesn’t mean:

• 20-page walkthroughs
• Scans of every single supporting document
• Recording every detail with respect to the transaction

(And yes, I have seen these interpretations!)

Mis-understanding the essence of reperformance leads to time and resources going into the overkill zone.?

4. Tame your templates (or, avoid Template Hell).?

One of the biggest (and often hidden) time-sucks in internal control programs is unwieldy templates. Our firm has inherited testing templates from preexisting programs that are elaborate, even gorgeous.?

But documentation isn’t cheap. Watch out for overly cumbersome templates and allow flexibility where relevant.?

Team members shouldn’t need to fill out every field every time. Let your internal control team use their creativity, professional judgment, and common sense.

There you go, you have 4 ways that your internal control program can “do more with less.”

Check out my latest video on YouTube to learn more!

*************

If you are looking for any more information or resources on internal controls and GRC (governance, risk, and compliance) programs, check out our Risk Oversight resources page at: https://riskoversight.ca/blog/

If you have any questions or if there is any help you need with your internal control, internal audit, or risk management program, please don’t hesitate to reach out to me for help at [email protected] .