However, some control is usually better than no control at all, and where there is control weakness, there also may be room for improvement. To maximize control effectiveness, companies may consider:

Establishing a dedicated, centralized corporate function for risk management, which may bring an objective or neutral “second pair of eyes” and fresh perspective to controls established on a by-department basis;
Linking individual performance measures and compensation to the success of controls assigned;
Striving to make controls mostly “preventive” and not “detective,” dedicating more resources to front-end controls like staff training and education, and investing in IT systems that will help make day-to-day compliance with policies and procedures much easier;
Designing procedures and workflows so that they cannot be easily circumvented, which may mean more automation, management, or audit review; and
Ensuring that department-specific controls are being reviewed routinely, match what is actually done in practice, and are updated as necessary to reflect the changing risk environment. In addition to internal audit's responsibilities for control assurance, regular departmental self-assessments should be conducted by managers and staff owning significant risks.

In corralling risk with robust system controls, companies gain comfort that they are complying with applicable laws and regulations, and that published financial statements are accurate and reliable. They have a better understanding of where their resources can be used efficiently, and minimize the occurrence of “surprise” claims, losses, or workflow disruptions. In the end, companies seek assurance that their strategic objectives are being achieved. Effective controls help win the ultimate purse.

Special Reports /

ERM Rodeo: Roping Risk with Effective Controls

Related Stories

Recommended For You