Internal control starts with clear responsibilities

A procedure manual needs an operating process behind it. This note offers a practical way to discuss responsibilities and evidence, without certifying an organisation’s controls.

Map the process

For a fictional purchase, map the request, approval, order, receipt, invoice and payment. Record the performer, reviewer and evidence at each stage. Adapt controls to risk and organisational size.

Assign and monitor

Management establishes objectives and delegations. Process owners execute their assigned controls. Governance bodies oversee the system within their mandate. Internal audit, where present, provides a separate assessment. It does not replace management’s responsibility.

Make evidence useful

A control description should specify the documents compared, acceptance criteria, frequency, reviewer and retained record. Exceptions need an accountable decision and follow-up.

Mistakes to avoid

Claiming absolute protection, treating every signature as sufficient evidence, and confusing a designed control with an executed control. Human error, collusion and override may limit effectiveness.

Recommended actions

Select a priority process, name responsible people, define proportionate evidence, test execution and track remedial actions. Public bodies require a separate review of their status and applicable rules.