Internal Controls: A Proactive Approach To Managing Risk

Introduction

It is a new year, and as it is required of every organisation, objectives are set. We at It is Well Enterprise^[1] have set our objectives and have decided that we want to increase our sales by 25% this year. We have decided which products and which channels are going to provide that growth. We have even budgeted our monthly sales figures, as well as the profit expected, as a result of this growth. This year, we are determined that we will execute our strategy flawlessly. The sales team has been engaged extensively in a one-week workshop which culminated in tight key performance indicators. We are ready to hit the ground running.

But……. What if things don’t go as planned? Is it even possible that such a well thought out plan could face challenges at implementation? Could something prevent us from achieving our objectives? The answer is yes. It is called RISK!

Internal Controls

COSO^[2] defines a risk as “the possibility that events will occur and affect the achievement of strategy and business objectives.” Simply put, a risk is any event that could prevent us from achieving our objectives. So how do we ensure that these risks do not materialise and stop us from achieving our objectives then? In come INTERNAL CONTROLS.

COSO defines an internal control as “a process, effected by an entity’s Board of Directors, management and other personnel designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance.” Simply put, an internal control is any process or activity that helps an organisation to prevent or mitigate its risks.

The Lapse

So, at It is Well Enterprise, the sales team is on the move, calling regular customers, and developing new leads. We have also placed advertisements on local TV and radio stations and expect that customers may contact us by phone, WhatsApp and via our website. Our website allows customers to make enquiries by leaving a message for us. We have a Facebook page as well where clients can send us messages via Messenger.

However, the phone is an automated switchboard which is attended to by the receptionist who is also busy attending to walk-in clients. In most cases, the client hangs up after holding on for about 5 minutes. The messages from WhatsApp go directly to our proprietor’s personal phone and he does not have the time to check all these messages since he has his plate full as CEO and proprietor of multiple businesses. The website is managed by the IT team who deals with content management, but the client engagement interface has not been assigned yet, so all the enquiries made by potential clients have gone unattended.

The Effect and suggested solutions

Will this situation stop It is Well Enterprise from achieving 25% increase in sales? Maybe not, if the sales team is able to achieve their target using the current business model. But look at it this way. The company had an objective for placing the advertisement (which by the way isn’t cheap); we must have had something in mind by putting out the WhatsApp number, the phone number, and the website address. So, in this case the risk is that we will not achieve our aim for placing that advertisement, resulting in financial loss and reputational damage as potential clients go away with a sub-optimal customer experience. Also consider the sheer number of potential clients that could have been brought in if adequate controls had been established to manage the digital channels.  Simple controls such as assigning the website and WhatsApp number to a person or team, assessing the workload of the receptionist, and possibly engaging another staff to manage the traffic, training staff on how to handle these calls, setting standards on turnaround times to give feedback to clients and monitoring, could have done us at It is Well Enterprise some good. But now we have no way of knowing because we did not anticipate any of these.

Conclusion

Internal controls are about practical everyday issues that confront organisations. The truth is that every business activity is associated with a risk – that event that prevents us from achieving the objective for that activity/process. So, as you go about your day this week, ask yourself:

1. What am I trying to achieve through this process or activity?
2. What could prevent me from achieving that aim?
3. What am I going to do to make sure that (2) does not happen?

As we anticipate our risks and adopt controls to stop them, we will avoid or minimise the pitfalls most businesses are exposed to. We can do it!

By Aya Sam Agbettor,  B. Com, Msc, CA (GH), FCCA, ACII  — Email: [email protected]

 

The writer is an experienced Accountant, Audit and Risk Management expert. She is currently the Head of Internal Audit at Sanlam General Insurance Ghana Limited.