Using control evidence to improve performance

Begin with the purpose of the control

A control should answer a clear question about an objective or a risk. An approval may prevent an unauthorised commitment. A reconciliation may identify incomplete information. If the purpose is unclear, adding a second signature can make a process slower without making the decision better.

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) describes internal control as having value beyond compliance and external financial reporting, including confidence in information. That broader perspective is useful when discussing operational performance. It does not mean every control is efficient, or that using a framework establishes compliance with a particular law.

Read the evidence behind the process

Follow a small number of transactions or decisions through the process. Identify who prepares the information, who challenges it, what exceptions are recorded and how unresolved matters are followed up. An approval timestamp alone may not show whether the reviewer had enough information to make a useful judgement.

Look at what happens when the normal route fails. Does the team know who can resolve the issue? Is the exception recorded? Is there a clear basis for closing it? Exceptions often reveal more about responsibilities in practice than the written procedure does.

Separate design from operation

A well-designed procedure and a consistently operating control are different things. Ask whether the design could address the risk, then whether it operates with the right information, at the right time and by an appropriate person. Discuss these questions separately when considering an improvement.

A reconciliation completed after a reporting decision may be accurate yet too late to inform that decision. Bringing the review forward could be more valuable than adding documentation afterwards. The adjustment depends on the objective, the risk and the team's practical constraints.

Turn observations into a useful conversation

Group repeated issues by their underlying cause. Missing information may point to an unclear hand-off. Delays may reflect competing responsibilities. A growing exception queue may mean closing an issue has not been distinguished from resolving its cause. Discuss the pattern rather than assigning a separate action to every symptom.

Agree an action, an owner and a way to judge whether the adjustment helped. Check both the risk objective and the effect on the people doing the work. An improvement that merely moves the delay elsewhere has not answered the original question.

Actions to consider

• Write down the control's objective and the risk it addresses.
• Trace normal transactions and exceptions using process evidence.
• Discuss design and operating evidence as separate questions.
• Agree an improvement and evidence that will show whether it helped.