What’s the use of putting time and effort into your Internal Control program if you have no idea whether or not it’s actually helping you? Your Internal Control program needs to pull its own weight, or else it has no true value. But how do we know if our Internal Control is effective?

This is where some simple standards come in to give you guideposts for developing and maintaining a highly effective Internal Control program.

The Reperformance Standard

The reperformance standard is commonly known to assurance and audit professionals, who use it to ensure test procedures can be re-performed in the event that results are challenged in litigation proceedings.

As an accountant, I come from an audit background. I swear by this standard in the conduct of audits. It is the standard adopted by the Big 4 accounting firms and also by professional accounting and audit bodies, the world’s de facto model for internal controls over financial reporting.

  • Reperformance Standard: The ability of the standalone document to enable a user to perform the related task or process again.

In my experience, namely in audit-based and compliance-based Internal Control program projects, it is a powerful standard. It is effective as a review tool, especially for determining the adequacy and completeness of the work. This is a powerful standard because there is no way of “hiding” any weaknesses in the Internal Control program. If I am reviewing the Internal Control program of a tester and there is no way of understanding how I could redo their work, locate the exact evidence they looked for, or retrace the steps they did, then the Internal Control program needs to be corrected.

The reperformance standard is, however, grossly underused.

The reperformance standard can have a much broader impact on the organization beyond audit and compliance.

When I work with companies beyond their accounting needs, I apply this concept to achieve powerful results in other areas such as:

  • Training Materials: Can the user perform his or her job using the Internal Control program? Is it easy for a new employee to get up to speed? The reperformance standard is highly effective in testing all training materials.
  • User Manuals: Does the user understand the application or system? Does the Internal Control program enable employees to use the system effectively?
  • Process Documentation: Can the user perform the process following the Internal Control program? Does it describe the process in enough detail?
  • Disaster Recovery Documentation: Does the user know what to do in the case of a disaster? Does the Internal Control program enable the user to carry out the steps successfully in the case of an emergency?
  • Safety Documentation: Can the user understand the process clearly enough to prevent an incident? Can the user reperform all safety procedures?
  • Marketing Documentation: Can the sales team deliver a consistent message to clients? Can the sales team find materials easily to execute on opportunities quickly?

The reperformance standard is the Dynamic Documentation standard for measuring your Internal Control program against. It is also a simple metric that does not require fancy consultants or a fancy system. Let’s take a look at this simple example.

How to get to the Calgary Airport (without the reperformance standard)

Getting to the airport involves going on Deerfoot, 96 Ave NE, Memorial and Airport Rd. The trip takes 21 minutes. The route involves a turn on Deerfoot after Memorial and then the route goes to96 Ave. You need to get on 5 ave SW first. It is important to note that Airport Tr merges into 96 AVE NE before you hit the airport.

Here is the reperformance standard (pulled right off Google Maps)

  1. Head east on 5 Ave SW toward 1 St SW (750 m)
  2. Continue straight onto 5 Ave SE N (400 m)
  3. Use the right 2 lanes to turn right onto Memorial Dr (2.4 km)
  4. Use the right lane to take the ramp onto Deerfoot Trail North (600M)
  5. Take exit 266 at 96 Ave NE/Airport Trail NE E (11.4 KM)
  6. Keep right at the fork, follow signs for Airport Tr/Airport and merge onto 96 Ave NE/Airport Trail NE E (1 KM)
  7. Turn Right onto Barlow Trail (800M)
  8. Turn right onto Airport Rd NE (650M)

The reperformance standard does not mean you need to record every little detail; it means you need enough detail only for the user to understand you. Too much detail has the opposite effect.

To allow your user to reperform the task successfully, the Internal Control program must communicate very clearly through both text and visual components. Effective Internal Control program has the right level of detail to enable the user to grasp the process, system or training immediately.

What if we look at the example above and then change the first couple to add too much detail:

  1. Head east on 5 Ave SW toward 1 St SW (750 m) where you will see the Suncor Energy Centre East Tower (formerly the Petro-Canada Centre). This is a 181,000 square metre (1,945,000 square foot) project composed of two granite and reflective glass-clad office towers of 32 floors and 52 floors. Planning for the complex began in the late-1970s following the creation of Petro-Canada
  2. Use the right 2 lanes to turn right onto Memorial Dr (2.4 km). Memorial Drive (formerly Sunnyside Boulevard) is a major road in Calgary, Alberta. Besides having an important role in city infrastructure, the tree lined sides of Memorial Drive serve as a living testament to the many soldiers who died during World War I and give it a parkway look on the western section. An active path system also runs along the south side of Memorial Drive, beside the banks of the Bow River. The Calgary Soldiers’ Memorial will form part of an extensive renovation to Memorial Drive, which will heighten the function of the road as a monument to the city’s military.

See how confusing this really is!

Clarity Standard

For certain documents in an Internal Control program, the documents are designed to inform rather than train or else to support testing. In many cases, the reperformance standard is not applicable.

Let me offer you another standard, the Clarity Standard.

  • The ability of the standalone document to clearly explain the intended use of the document to the intended audience.

Informational materials such as reporting can be tested using the clarity standard to ascertain understanding of the document rather than for reperformance.

Test your Internal Control program using the Clarity Standard by asking:

The clarity standard is something that we do naturally in our review process when we review a report or process with our Manager or co-worker. The point is however that we initiate the review to get this started.

Findability Standard

Your users will want to be able to find documents quickly with as little thinking as possible. The Findability Standard is similar to the reperformance in that it focuses on the standalone quality of the Internal Control program system and supporting documents. The Findability Standard is however focused on finding information or documents themselves (not the quality of individual documents) and is used to evaluate Internal Control program systems and set-up.

  • The ability to find a document or other piece of information using the standalone system, set-up, or process.

The master of the Findability Standard is Google. However, it has also spoiled us.

There is a phenomena called the “Google Effect” where most people believe information should be easy to find (like it is to “google”). Behind what on the surface appears to be simple search function, are thousands highly-paid programmers and software engineers, along with world-class technologies. Google is drawing from a massive amount of information too, which improves the data you get back. Achieving the Findability Standard is not as easy as googling!

Usability/Practicality Standard

Internal Control programs come with many standards, guidance and professional backgrounds. However, these programs should not be overly complex. An Internal Control program is like developing good “habits” for a company. This is like what we do in our personal lives like brushing our teeth, going to the gym, reading to our kids, etc.

That is why Risk Oversight uses a standard we call the Usability Standard.

  • Usability Standard: The ability of a process or control or aspect of the Internal Control program to be used effectively by Management. That is, to drive value and clarity and to be worth the cost-benefit of implementing the control.

Before implementing controls or practices as part of your Internal Control program, it is important to ask whether Management is adopting the practices because they want to adopt these habits. Management should stay away in most cases from taking-on controls that seem to “forced” by the auditors, some template, or academic guidance.

Test your Internal Control program using the Usability Standard by asking:

  • Does the control make sense for the business?
  • Is the control a good “habit” for the company?
  • Is the control fit for purpose?
  • Is there more efficient and effective way of achieving the same result?
  • Is the control cost effective?

What do you use to evaluate the effectiveness of your Internal Control program? We’d love to hear from you! Contact me at adrienne@riskoversight.ca for further discussion.