Cristina Revelo is the Deputy Director, Corporate Monitoring at Affiliated Monitors, Inc (AMI). Her academic background is in Master of Science and Bachelor of Science in Accountancy from the University of Illinois. Her professional background is in forensic accounting and internal controls. I visited with her about internal controls in practice inside a corporation.
Revelo said that internal controls are essentially any process that someone has to execute in order for the company to meet their objectives, whatever those objectives might be. In a corporate compliance department, the process procedure protocols you have in place that someone has to execute, can be an internal control. It could be an individual who inputs data into a system, or it could be automated or an individual who has to physically do something in order for you to meet your goal within your overall process.
We moved to a couple of terms which often cause confusion around internal controls. The first is compensating controls and the second is control override. Revelo explained that a compensating control is “essentially an alternative control. You set in place a manual control versus an automated. If your control system breaks down, you are compensating for your control in a different way.” However, she emphasized the key is that you are still following your normal process of executing your controls.
Next was control override. A control override is an override of a compliance internal control, a negative from an accounting perspective or even violation of the Foreign Corrupt Practices Act (FCPA). She explained that a control override should be the exception and not the rule for any corporate compliance or finance function. There must be a business reason and it must be documented, Revelo stated, “We definitely don’t advertise having to override controls, but we understand that there are emergency instances where you need to override a control that should be properly documented.”
However, what happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities which violate the FCPA or some other law such as Sarbanes-Oxley (SOX). Revelo said she would start out with some basic questions such as “How often would something be manually approved? How often are controls skipped, what are the level of approvals that you have and what is your document? What are the reasons, and are you documenting how often a certain department is requiring those overrides?” While it could indicate a company lacks a culture of compliance or everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. The Department of Justice (DOJ) calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous controls monitoring.
However, many compliance professionals, and particularly lawyers think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that once again many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program can and should be continually monitored and continually improved based upon the information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted.
We then turned to how to assess and then update or enhance your internal controls. Companies should also think about updating and reviewing their controls at least annually. In this manner, they can identify any violations of their internal controls. It also allows a deep dive into any specific areas of control failures. Another approach would be more robust through greater monitoring of your controls, for example, you could review them quarterly to allow you to spot any trends that are moving in the wrong direction. You can even start out by having your compliance function perform a self-review of its controls and  test exemplar transactions. This is not a full-blown audit but simply desktop testing to make sure controls were properly followed. Once again simply because there is a control override or excessive use of a compensating control does not mean something is illegal. It may mean that the control is not working as it was designed.
Revelo said it could be an instance of “too short of an approval time period and they need a little bit longer because depending on their industry or how business works. This also helps to both  identify frustrations from employees where there is a control, but every time I need to execute, it is impossible for me to do, or it’s impossible for me to comply with it a hundred percent. These are the reasons.” These quarterly reviews can then be collated into an annual report for review and assessment and the report can form the basis of an annual report to the Compliance Committee of the Board of Directors or even the full Board.
The key is to have a process for monitoring the controls, taking input, literally from each line of defense. If a control is overridden too often, you need to change it. If a control is ineffective, you can use that information to craft a new internal control. Internal controls are not static, but dynamic and, with proper oversight, you can set up internal controls and literally improve them with appropriate documentation. (Hint” Document, Document, and Document)
Revelo emphasized it is not simply identifying the issues “because that actually might look worse if you identify a lot of issues, but do not fix them. You are better off by remediating everything you are identifying.” From there you can conduct a root cause in that analysis as to why there was failure in a control or violation of a compliance procedure. Revelo concluded, “you need to really do that in depth and then remediate it.”
Interestingly, Revelo noted that a Board of Directors has a significant role to play with internal controls. It is because all compliance literally starts with the very top of an organization and this is true when it comes to internal controls. She said, “probably the most important aspect of establishing a really great foundation for great execution of internal controls is with the Board. It all starts with the Board; with the way they advise the company with their priorities of the year and objectives for the year.” The importance of a corporate compliance program should be communicated throughout their organization and highlight the company’s commitment to compliance.
When I talk about internal controls to lawyers, I still see about half of them roll their eyes up inside their heads. However, that is a huge improvement from 10 years ago when all the lawyers had the same reaction. By using some of the strategies Revelo recommends for continuous monitoring and continuous improvement of internal controls, you have not only robust internal controls but more importantly effective internal controls.