Change Impact Downstream

While much has been discussed about the recent (it is actually technically over) recession in terms of long run unemployment, my work week reminded me about the impact on those still working.  Everyone is trying to do different things faster -- yet often with the same infrastructure.  While it’s tough to turn even a small business on a dime, the fact is there are plenty of people who are doing that just to keep solvent.  It’s really important though to consider the downstream impacts of these big changes on the how the company operates day-to-day.  In particular the effectiveness of internal controls can dissipate significantly when rapid change is the order of the day.

A small business facing economic duress is unlikely to think managing control risk is a top priority, but it actually is.  While the bottom line is crucial, knowing that you in fact have the correct bottom line is equally important.  Recent statistics from the Association of Certified Fraud Examiners show fraud in the workplace is uncovered by accident 25% of the time.  Compare that to the 12% of fraud discovered by external audits.  Needless to say, preventive controls are more important, as they can stop fraud before it occurs.  They also help prevent mistakes, which are also more likely to occur at a time when change is rapid and ongoing.

If it’s so important, how does one prioritize management of controls?  (It’s easier than you might think.)  Particularly in a changing environment there are a couple of items worth focusing on.  If your business doesn’t have a formal set of internal controls, make a list of the informal procedures that you believe are providing the appropriate checks and balances.  Then collect a group of folks you work with to dissect if any of those programs might be working differently (as in not working) under the new ways the business is operating.  If it involves cash, assets that can easily be transported or your regulatory responsibilities, this is a big priority.  You can make a hit list of items that are not on the short list, consider the risk to the business and then act accordingly.