• First Reference
  • About us
  • Contact us
  • Free Coronavirus FAQ 🔬
  • Free Newsletter 📨
  • Get PolicyPro Free Trial 🎉

First Reference Talks

Discussions on Human Resources, Employment Law, Payroll and Internal Controls

  • Home
  • About
  • Archives
  • Resources
You are here: Home / Business / Effective monitoring of internal controls is critical

By Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons) | 3 Minutes Read July 3, 2019

Effective monitoring of internal controls is critical

monitoring internal controls

If the most serious internal control violation is a failure to implement internal controls in the first place, the failure to monitor existing internal controls is a close contender. Identify where in the organization effective monitoring occurs and leverage those successes. Conversely, identify instances where monitoring is non-existent or ineffective and implement process improvements. The Internal Control – Integrated Framework, which is the internal control framework of choice, developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), includes monitoring of internal controls as one of the five essential and integrated components of effective internal controls.

Rochester Drug Cooperative (Rochester) is a recent case study on the breakdown of effective monitoring. For Rochester, the breakdown led to arrests of senior management officials.  

As an approved drug distributor, Rochester has a legal obligation to maintain effective internal controls over sales to dispensers, to prevent the diversion of controlled drugs to illegitimate uses. For instance, routine monitoring procedures should identify orders that are of an unusual size or frequency or deviate from a normal pattern, because these could be red flags for illegitimate uses. The Internal Control – Integrated Framework describes these routine monitoring procedures as ongoing evaluations.

Rochester implemented controls to address the above, but they were not operating effectively, and the monitoring process failed. Rochester reportedly ignored red flags that some of its customers were dispensing drugs improperly. The compliance function, which is part of the second line of defense against risk, appeared to have been working as designed. However, it was thwarted by operational managers or process owners (the first line of defense) who failed to take appropriate corrective action when notified that there were process deficiencies.

Senior management was complicit, and an additional monitoring process, the reporting and communication to the board, also appeared to have failed. Consequently, the unwillingness of the first line of defense to take appropriate corrective action was allowed to go unchecked. (Read more about the Institute of Internal Audit’s (IIA’s) Lines of Defense model in Finance and Accounting PolicyPro, Volume II, GV 1.08 – Relationship with Internal Auditors and about Rochester on the IIA’s website at ​Willful Subversion of Second Line of Defense Can Land You in Jail).

There are numerous strategies which organizations can use to monitor internal controls effectively, including the following:

  1. Testing by internal audit, which is an example of what the Internal Control – Integrated Framework defines as periodic or separate evaluations;
  2. Analysing and following up on exception reports. Anomalies or exceptions may be indicators of internal control failures; and
  3. Reconciling, reviewing and other supervisory activities, as part of normal ongoing operating procedures.

It is not enough to implement internal controls. They have to work. To determine if your internal controls work, you have to monitor them. When you receive the results from your monitoring processes, you have to do something about them. You have to review, investigate, and if necessary, take corrective action so that internal controls can operate effectively. Boards should ensure that senior management teams implement effective monitoring and report to the board about the same.  

Read more about strategies to help you monitor internal controls effectively, in Finance and Accounting PolicyPro (GV 6.04 – Internal Control Monitoring).

Finance and Accounting PolicyPro

Policies and procedures are essential to monitoring internal controls, but the work required to create and maintain them can seem daunting. Finance and Accounting PolicyPro, co-marketed by First Reference and Chartered Professional Accountants Canada (CPA Canada) contain sample policies, procedures and other documents, plus authoritative commentary in the area of finance and accounting, to save you time and effort in establishing and updating your internal controls and policies. Not a subscriber? Request a free 30–day trial of Finance and Accounting PolicyPro here.

  • About
  • Latest Posts

Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons)

Apolone Gentles is a CPA, CGA and Ontario lawyer and editor with over 20 years of business experience. Apolone is leveraging 20 years of business and accounting experience to build a commercial litigation practice with an emphasis on construction law. She has held senior leadership roles in non-profit organizations, leading finance, human resources, information technology and facilities teams. She has also held senior roles in audit and assurance services at a “Big Four” audit firm. Apolone has also lectured in Auditing, Economics and Business at post-secondary schools.

Latest posts by Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons) (see all)

  • Miscommunications between HR and Payroll lead to $115,000 overpayment - January 6, 2021
  • 8 essential components of compliance risk management - December 2, 2020
  • Life-and-death spreadsheet errors - November 4, 2020

Article by Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons) / Business, Finance and Accounting / Committee of Sponsoring Organization of the Treadway Commission, COSO, Exception Reports, IIA, internal audit, Internal Control Monitoring, Internal Control Override, Internal Controls, Lines of Defense, Monitoring, Ongoing Evaluations, Process Deficiencies, Separate Evaluations

Share with a friend or colleague

Learn the 10 essential HR policies in the time of COVID-19

Get the Latest Posts in your Inbox for Free!

About Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons)

Apolone Gentles is a CPA, CGA and Ontario lawyer and editor with over 20 years of business experience. Apolone is leveraging 20 years of business and accounting experience to build a commercial litigation practice with an emphasis on construction law. She has held senior leadership roles in non-profit organizations, leading finance, human resources, information technology and facilities teams. She has also held senior roles in audit and assurance services at a “Big Four” audit firm. Apolone has also lectured in Auditing, Economics and Business at post-secondary schools.

Footer

About us

Established in 1995, First Reference Inc. (known as La Référence in Quebec) provides Canadian organizations of any size with practical and authoritative resources to help ensure compliance.

First Reference Talks

  • Home
  • About
  • Archives
  • Resources

Main Menu

  • About First Reference
  • Resources
  • Contact us
  • 1 800 750 8175

Stay Connected

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

We welcome your comments on our blog articles. However, we do not respond to specific legal questions in this space.
We do not provide any form of legal advice or legal opinion. Please consult a lawyer in your jurisdiction or try one of our products.


Copyright © 2009 - 2021 · First Reference Inc. · All Rights Reserved
Legal and Copyright Notices · Publisher's Disclaimer · Privacy Policy · Accessibility Policy