Financial Matters Dustin Verity

---

Benefits of internal controls can outweigh costs

Most of us are involved in organizations, whether it is a charitable organization or a family-owned business. However, are the internal controls of the organization strong?

We often think of internal control improvements as adding cost to an organization, or that the cost to implement them often outweighs the benefits they create. There are some control improvements, however, that could one day generate true economic returns.

Every control can be classified as either preventive or detective. That is, controls either prevent errors before they occur or they detect errors after they have occurred but in time to correct them before they do real damage. Both types are important, but, in general, preventive controls are preferred to detective controls, for two reasons.

First, detective controls only come into play after an error has occurred so their failure often means that the undetected errors could have a negative impact on the business.

Second, it is usually more cost effective to prevent errors than to detect and fix them after they occur. Therefore, we say that preventive controls generally have a higher "economic value" to an organization.

Just as all controls can be categorized as preventive or detective, they can also be categorized as manual or automated. And just as preventive controls are generally preferred over detective controls, automated controls are generally preferred over manual controls.

Automated controls are typically more reliable than manual controls because they are not subject to the same degree of human error. It is, of course, important to make sure they are set up correctly, but once in operation, automated controls are very reliable.

Manual controls operate through human intervention. They are the most flexible but also subject to human error.

Automated controls operate through and within information-technology systems. They function systematically and work with a high degree of consistency. They also tend to be more efficient than manual controls and can provide more valuable, timely and reliable information for decision-making purposes.

It should be noted that there are places where manual controls are critical, especially in complex or dynamic processes, or in places where judgment is required. But a good analysis of processes that utilize numerous manual controls can often uncover significant automation improvement opportunities.

Identifying areas where preventive controls and/or automated controls might be implemented is not a requirement as part of many local companies' internal control evaluation process. Yet the extra effort is likely to pay off in the long run. It simply requires a process for first inventorying existing controls based on their attributes (manual versus automated; preventive versus detective) and then looking at those attributes in the context of the control and business-process environment.