• First Reference
  • About us
  • Contact us
  • Blog Signup 📨

First Reference Talks

Discussions on Human Resources, Employment Law, Payroll and Internal Controls

  • Home
  • About
  • Archives
  • Resources
You are here: Home / Business / Effective monitoring of internal controls is critical

By Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons) | 3 Minutes Read July 3, 2019

Effective monitoring of internal controls is critical

monitoring internal controls

If the most serious internal control violation is a failure to implement internal controls in the first place, the failure to monitor existing internal controls is a close contender. Identify where in the organization effective monitoring occurs and leverage those successes. Conversely, identify instances where monitoring is non-existent or ineffective and implement process improvements. The Internal Control – Integrated Framework, which is the internal control framework of choice, developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), includes monitoring of internal controls as one of the five essential and integrated components of effective internal controls.

Rochester Drug Cooperative (Rochester) is a recent case study on the breakdown of effective monitoring. For Rochester, the breakdown led to arrests of senior management officials.  

As an approved drug distributor, Rochester has a legal obligation to maintain effective internal controls over sales to dispensers, to prevent the diversion of controlled drugs to illegitimate uses. For instance, routine monitoring procedures should identify orders that are of an unusual size or frequency or deviate from a normal pattern, because these could be red flags for illegitimate uses. The Internal Control – Integrated Framework describes these routine monitoring procedures as ongoing evaluations.

Rochester implemented controls to address the above, but they were not operating effectively, and the monitoring process failed. Rochester reportedly ignored red flags that some of its customers were dispensing drugs improperly. The compliance function, which is part of the second line of defense against risk, appeared to have been working as designed. However, it was thwarted by operational managers or process owners (the first line of defense) who failed to take appropriate corrective action when notified that there were process deficiencies.

Senior management was complicit, and an additional monitoring process, the reporting and communication to the board, also appeared to have failed. Consequently, the unwillingness of the first line of defense to take appropriate corrective action was allowed to go unchecked. (Read more about the Institute of Internal Audit’s (IIA’s) Lines of Defense model in Finance and Accounting PolicyPro, Volume II, GV 1.08 – Relationship with Internal Auditors and about Rochester on the IIA’s website at ​Willful Subversion of Second Line of Defense Can Land You in Jail).

There are numerous strategies which organizations can use to monitor internal controls effectively, including the following:

  1. Testing by internal audit, which is an example of what the Internal Control – Integrated Framework defines as periodic or separate evaluations;
  2. Analysing and following up on exception reports. Anomalies or exceptions may be indicators of internal control failures; and
  3. Reconciling, reviewing and other supervisory activities, as part of normal ongoing operating procedures.

It is not enough to implement internal controls. They have to work. To determine if your internal controls work, you have to monitor them. When you receive the results from your monitoring processes, you have to do something about them. You have to review, investigate, and if necessary, take corrective action so that internal controls can operate effectively. Boards should ensure that senior management teams implement effective monitoring and report to the board about the same.  

Read more about strategies to help you monitor internal controls effectively, in Finance and Accounting PolicyPro (GV 6.04 – Internal Control Monitoring).

Finance and Accounting PolicyPro

Policies and procedures are essential to monitoring internal controls, but the work required to create and maintain them can seem daunting. Finance and Accounting PolicyPro, co-marketed by First Reference and Chartered Professional Accountants Canada (CPA Canada) contain sample policies, procedures and other documents, plus authoritative commentary in the area of finance and accounting, to save you time and effort in establishing and updating your internal controls and policies. Not a subscriber? Request a free 30–day trial of Finance and Accounting PolicyPro here.

  • About
  • Latest Posts
Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons)
Apolone Gentles is a CPA, CGA and Ontario lawyer and editor with over 20 years of business experience. Apolone is leveraging 20 years of business and accounting experience to build a commercial litigation practice with an emphasis on construction law. She has held senior leadership roles in non-profit organizations, leading finance, human resources, information technology and facilities teams. She has also held senior roles in audit and assurance services at a “Big Four” audit firm. Apolone has also lectured in Auditing, Economics and Business at post-secondary schools.
Latest posts by Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons) (see all)
  • Reminders for charities as 2023 draws to a close - December 6, 2023
  • Update acceptable use policies - November 1, 2023
  • Payroll fraud and … harassment and overwork? - October 4, 2023

Share this:

  • Tweet
  • Email
  • Print
  • More
  • Reddit
  • Share on Tumblr
  • Pocket
  • Mastodon

Article by Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons) / Business, Finance and Accounting / Committee of Sponsoring Organization of the Treadway Commission, COSO, Exception Reports, IIA, internal audit, Internal Control Monitoring, Internal Control Override, Internal Controls, Lines of Defense, Monitoring, Ongoing Evaluations, Process Deficiencies, Separate Evaluations

The Essential HR Policy Guide Banner

Get the Latest Posts in your Inbox for Free!

About Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons)

Apolone Gentles is a CPA, CGA and Ontario lawyer and editor with over 20 years of business experience. Apolone is leveraging 20 years of business and accounting experience to build a commercial litigation practice with an emphasis on construction law. She has held senior leadership roles in non-profit organizations, leading finance, human resources, information technology and facilities teams. She has also held senior roles in audit and assurance services at a “Big Four” audit firm. Apolone has also lectured in Auditing, Economics and Business at post-secondary schools.

About us

Established in 1995, First Reference is the leading publisher of up to date, practical and authoritative HR compliance and policy databases that are essential to ensure organizations meet their due diligence and duty of care requirements.

First Reference Talks

  • Home
  • About
  • Archives
  • Resources

Main Menu

  • About First Reference
  • Resources
  • Contact us
  • 1 800 750 8175

Stay Connected

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

We welcome your comments on our blog articles. However, we do not respond to specific legal questions in this space.
We do not provide any form of legal advice or legal opinion. Please consult a lawyer in your jurisdiction or try one of our products.


Copyright © 2009 - 2023 · First Reference Inc. · All Rights Reserved
Legal and Copyright Notices · Publisher's Disclaimer · Privacy Policy · Accessibility Policy

 

Loading Comments...