What’s the use of putting time and effort into your Internal Control program if you have no idea whether or not it’s actually helping your organization? Your Internal Control program needs to pull its own weight, or else it has no true value. But how do you know if your Internal Control program is effective?
This is where some simple standards come into play. These standards are meant to guide your thinking and focus your efforts on the right areas.
The reperformance standard is commonly known to assurance and audit professionals, who use it to ensure test procedures can be re-performed if results are challenged in litigation proceedings.
As someone who comes from an audit background, I swear by this standard in the conduct of audits and Internal Control work. It is the standard adopted by professional accounting and audit bodies and is considered the world’s de facto standard for Internal Controls over Financial Reporting.
- Reperformance Standard: The ability of the standalone document to enable a user to perform the related task or process again.
The Reperformance Standard is a simple metric that does not require fancy consultants or a fancy system. While it is simple, it is also powerful. There is no way of “hiding” from the reperformance standard. If I am reviewing a tester’s work and there is no way of understanding how I could redo their work, locate the exact evidence they looked for, or retrace the steps they did, I know exactly when the work needs to be redone or corrected.
The reperformance standard is, however, grossly underused. The reperformance standard can have a much broader impact on your organization beyond audit and compliance. You can apply this concept to achieve powerful results in other areas such as:
- Training Materials: Can the user perform his or her job using the Internal Control program? Is it easy for a new employee to get up to speed? The reperformance standard is highly effective in testing all training materials.
- User Manuals: Does the user understand the application or system? Does the Internal Control program enable employees to use the system effectively?
- Process Documentation: Can the user perform the process following the Internal Control program? Does it describe the process in enough detail?
- Safety Documentation: Can the user understand the process clearly enough to prevent an incident? Can the user reperform all safety procedures?
- Marketing Documentation: Can the sales team deliver a consistent message to clients? Can the sales team find materials easily to execute on opportunities quickly?
For certain documents in an Internal Control program, the documents are designed to inform rather than capture than train or else support testing. In many cases, the reperformance standard is not applicable.
Let me offer you an alternative standard, the Clarity Standard.
- Clarity Standard: The ability of the standalone document to clearly explain the intended use of the document to the intended audience.
Informational materials such as reporting can be tested using the clarity standard to ascertain understanding of the document rather than for reperformance.
Test your key documents in your Internal Control program using the Clarity Standard by asking:
- Does the reader understand the document without someone explaining it?
- Are the key concepts “getting through” to the reader?
- Are the key concepts understood by the reader quickly?
- Is the document memorable to the reader?
The clarity standard is something that we do naturally in our review process when we review a report or process with our Manager or co-worker. The point is however that we initiate the review to get this started. Ask yourself these questions to make this standard really work.
Your users will want to be able to find documents quickly with as little thinking as possible. The Findability Standard is similar to the reperformance in that it focuses on the standalone quality of the Internal Control program system and supporting documents. The Findability Standard is however focused on finding information or documents themselves (not the quality of individual documents) and is used to evaluate Internal Control program systems and set-up.
- Findability Standard: The ability to find a document or other piece of information using the standalone system, set-up, or process.
The master of the Findability Standard is Google. But Google has also spoiled us (massively). There is a phenomena called the “Google Effect” where most people believe information should be easy to find (like it is to “google”). Behind what on the surface appears to be simple, clean search function, are thousands highly-paid programmers and software engineers, along with world-class technologies. Achieving the Findability Standard is not as easy as googling!
Internal Control programs come with many standards, guidance and professional backgrounds. However, these programs should not be overly complex. An Internal Control program is like developing good “habits” for a company. This is like what we do in our personal lives like brushing our teeth, going to the gym, reading to our kids, making our bed, etc.
That is why the Usability Standard is so powerful for helping you to stand back and apply some common sense or practicality to your work.
- Usability Standard: The ability of a process or control or aspect of the Internal Control program to be used effectively by Management. That is, to drive value and clarity and to be worth the cost-benefit of implementing the control.
Before implementing controls or practices as part of your Internal Control program, it is important to ask whether Management is adopting the practices because they want to adopt these habits. Management should stay away in most cases from taking-on controls that seem to “forced” by the auditors, some template, or academic guidance.
Test your Internal Control program using the Usability Standard by asking:
- Does the control make sense for the business?
- Is the control a good “habit” for the company?
- Is the control fit for purpose?
- Is there more efficient and effective way of achieving the same result?
- Is the control cost effective?
What do you use to evaluate the effectiveness of your Internal Control program? We’d love to hear from you! Contact me at firstname.lastname@example.org for further discussion.