Why Detective Controls Aren’t Enough
Posted on January 23rd, 2008 by Dana Hamerschlag »Permalink
I’d like to talk today about the need for many businesses to move beyond simple detective controls to more automated preventive controls – and what the move means for business efficiency and effectiveness.
I have a chart that I like to use to illustrate the typical controls implementation evolution that companies undergo. As it shows, most companies start out with many manual controls, where a person has to manually review a sample of records to ensure there were not problems or someone has to approve a process and sign-off. This is essentially self-reporting, and often the evidence of the control is either stuck in an email somewhere or a signed piece of paper that lives in a fileing cabinet and verifies that records have been reviewed.
One of the problems with the above approach is that reviewers are examining data after events have already happened, likely at a quarterly or year-end review. This time lag means that problems in the past can be identified, but not easily rectified before there are business consequences.
Implementing controls automation brings many benefits in the form of cost and time savings – but one of the benefits with the greatest impact comes from the ability of automated controls to be both detective and preventive.
Controls automation allows for both automated notification of controls issues like duplicate payments, as well as unauthorized changes to system settings that prevent transactions like duplicate payments from even being processed. With this type of implementation, errors are not only identified automatically, but often they’re prevented from happening in the first place. These sorts of automated preventive controls certainly save time and money managing controls and correcting problems , but there is an even more important benefit for the bottom line to the business itself. Mistakes that are avoided in the first place mean that customer satisfaction is higher, shipments and revenue recognition happens faster, cost of goods sold is lower, and working capital is lower…
What’s that old saying about an ounce of prevention being worth a pound of cure? It certainly holds here. Preventing troublesome issues from occurring in the first place is a great way for reducing risk – and for saving time and resources down the road to identify and rectify past mistakes.
Tags: Preventive Controls, Controls Automation, Continuous Controls Monitoring
- Dana Hamerschlag, Senior Director, Product Marketing