For proper implementation of the independent control function, it is important that the responsibilities lie where they belong. That can be quite a challenge. Certainly in smaller organizations, the controller often takes up all activities related to control.
3 lines of defense
In the ideal world, every organization works according to the 3 lines of defense model (control within the line, support of systems and procedures from control and the specific internal control). However, the practice is more unruly. For example, a controller often conducts first-line investigations, reports on this to the manager, is actively involved in procedural descriptions and also takes the risk management into account. He performs first, second and third line work. The argument then is, “I’m the only controller here, so I have to do it.”
As a controller, you should not organize the processes that you have to control yourself. An additional controller to better distribute the tasks is not necessarily the solution. The control activities in the first and partly in the second line can also be carried out by the departments themselves. More importantly, the department itself performs internal control. This gives employees and their manager a good feeling that the tasks are being carried out correctly and that the reports are correct. They feel “in control”.
How do you organize this way of working?
Be the first to discuss with internal employees what is meant by good internal control. Let them think about which risky activities are important for their department (the key controls).
Employees draw up control work programs for the various key controls themselves, which are discussed with their manager and the controller.
The controller discusses the results of these employees and the manager, and indicates the areas for improvement.
Audit work programs are a good basis for employees to periodically perform the audit work. When the relevant employees do not have the right knowledge and experience to work in this way, the controller can play a nice role by training and training them. This way of working strengthens internal control in the organization. The control function thus remains independent and entrusted with the performance of third-line activities. Everyone happy! <
Author: Teus van der Heiden is an expert in Control Housing Associations at Hofmeier
This article is published in cm: 2020, Ep. 4.