Good Management of Risk, Internal Control, and Everything Else: Getting Back to the Basics (2014)

When it comes to managing risk, internal control, and, frankly, everything else, it is time to get back to basics because it enables one general solution, not a series of specialized and often disconnected solutions. In this article, I want to offer a general solution because it makes good sense. When I was a management consultant in a public accounting and auditing firm, I viewed some of my audit partner counterparts as business leaders who specialized in auditing and others as auditing specialists who tried to be business leaders. Usually, first group was more successful. By analogy, a general solution provides a more successful approach to internal control and risk management, and that general solution means getting back to five basic principles: 1. Stress process management over functional management. 2. Use source information, which is integrated and not derived. 3. Set priorities based on externally focused competitive and strategic assessments. 4. Monitor all process outputs once processes are designed and operating. 5. Base risk management on uncertainty of outcomes and not on causes of risk. We will take a look at simple and proven basics that integrate internal control and risk management into business of organization. Principle #1: Stress Process Management The first basic principle has to do with process management vs. functional management. Here is why process management is way to go. Put simply, a functional focus can lead to silos, which in turn can lead to inefficiency and ineffectiveness. On other hand, process management integrates functions for managing risk and internal control. Companies usually organize themselves by functions because this approach focuses on skills and roles. Michael Porter, a strategy guru, outlines generic value chain as an integrated process having five primary activities or functions as well as four support activities or functions. (1) Porter credits McKinsey & Company as having developed business system concept that a firm is a series of functions. As Figure 1 illustrates, this framework enables integrating primary and support functions into one process. Primary Functions * Inbound logistics (material handling, warehousing, inventory control, vehicle scheduling, and returns to suppliers); * Operations (machining, packaging, assembly, equipment maintenance, testing, printing, and facility operations); * Outbound logistics (finished goods warehousing, material handling, delivery vehicle operation, order processing, and scheduling); * Marketing and sales (advertising, promotion, sales-force management, quoting prices, channel selection, channel relations, and pricing); and * Service (installation, repair, training, parts supply, and product adjustment). Support Functions * Procurement (vendor assessment and management, order placing and scheduling, and contract management); * Human resources management (recruiting, hiring, training, evaluating, compensation and benefits pro gram design, and management); * Technology development (research, development, and engineering); and * Firm infrastructure (general management, planning, finance, accounting, legal, information systems management, government affairs, shareholder affairs, and quality management). Each functional management team generally pays more attention to its own activities because it is responsible for them and less attention to how its activities affect activities of others. Some call this the silo mentality. Typically, each function recognizes that it receives information and material from, and delivers information and material to, other functions. But it is not always concerned with how those receipts and deliveries affect other functions. Consider set of processes that make up procure-goods-through-pay-vendor cycle. …