Controls Best Practices

What is a control?

A control is something you follow as a company to mitigate potential risks. A control is a part of a process designed to accomplish a goal.

For example, a goal might be to train your employees in the matter of security because it is important to safeguard data.

A control might read: Every year, security training is provided to all employees by the security officer.

Why are controls important?

An organization is best set up for success when it has strong internal controls. Controls help define an organization’s objectives/goals to ensure that employees are aware of and focused on them. Controls help minimize risks and help protect an organization’s assets. This is because the organization implements the control to prevent risks and promote accountability.

Controls best practices

A company’s internal controls will look different for each organization. This is because each organization is unique in the way the day-to-day operation is performed. For example, an organization might use an automated tool to manage access to systems and tools, while another might use an excel sheet and manual requests form to manage access.

The uniqueness is what makes developing an internal control framework an activity that requires dedicated effort and focus.

To develop and maintain sound internal controls, it is important to gain an understanding of the day-to-day operations and the company’s goals and turn them into controls.

Understand the objective of the goal

‘What are we trying to accomplish?’ must be the first question to address when understanding the purpose of a goal. The goal and/or activity can be a variety of things, such as:

• Protecting, securing data
• Remediating a risk
• Have happy customers
• Increase revenue
• Hiring new employees
• Paying employees
• etc.

Once the activity is understood, the next step is to think about the responsible personnel.

Assign ownership

Who would be responsible for accomplishing this activity? That is the next question to address to ensure that there is an oversight to the success of this goal. Once this question has been answered, it is natural to ask, ‘how’ would this activity be achieved?

The ‘how’ will then translate to a series of steps to be taken to ensure the success of the activity. The control language is formulated based on a series of steps in an easy and succinct format. The format typically looks like this:

[XYZ] personnel is responsible for achieving [XYZ] goal and/or activity and does so by doing [XYZ] steps.

Test your control

Now that your control is established, how do you validate that the oversight on this activity is successful? You validate by checking on it! This is what we call ‘testing a control’ in compliance. The testing activities might include interviewing the responsible personnel and asking for proof of oversight.

And there you have it! Best practices for creating a control.