How to Start an Internal Control Department for the First Time

A lot of companies are beginning to realize the importance of having a functional internal control department. This new development has given rise to instances where we have internal control managers being faced with the situation of setting up an internal control department from the scratch.

In today’s accounting blog post on how to start an internal control department for the first time, I will be providing a practical step-by-step approach that anyone who finds him or herself in a situation of building an internal control department can easily adopt for quick cost-effective results.

Just a brief comment on the difference between an Internal audit and Internal control. While the two terms are often used interchangeably in real world, it is pertinent to bring out the difference for the purpose giving context to the points discussed in this publication. I enjoin you to read the above linked article for fuller grasp of the differences between internal control and internal audit.

In a nutshell, while the internal control dwells more on ensuring that processes designed to protect an organizations asset are followed, internal audit evaluates a company’s risks vis-à-vis prevailing processes with the aim of advising management on the best way of containing risks.

It is also important to point out that the responsibility of instituting controls and making sure that they work seamlessly is primarily part of the functions of management.

Although the target audience for this article are those businesses that does not have an existing internal control department, organizations that already have an internal audit department would still benefit from this piece.

Ten (10) steps involved in starting an internal control department for the first time

Step (1): Gain insightful understanding of the unique needs of the business and its environment.

 It will be very counter productive to attempt starting an internal control department when you do not have all the necessary information relating to the organizations business sector.

I have seen very experienced internal auditors fail woefully simply because they naïvely thought that their experience in internal control would help them jumpstart a brand-new internal control department.

Step (2): Perform risk assessment on the business

It is best practice to base your assessment of the potential pitfalls that a business may fall into from risk-based approach. I have written extensively on DIY risk assessment that can easily be adopted for the purpose of assessing the internal control on an organization.

Step (3): Develop an appropriate risk dashboard

A major output from the risk assessment phase is the risk dashboard, also known as risk register. The control activities that the 5 elements of COSO talked about is best built from the contents of the risk dashboard. The risk dashboard should clearly identify the risks, the impacts of the risks, the likelihood of the risky event occurring and action words that when followed would mitigate against the risks.

Step (4): Discuss options with business owner

A key part of internal control risk management process is gaining understanding of the risk appetite of the business owners and managers. It would a complete waste of resources and efforts developing control activities for risks that the owners are willing to should the implication of not doing anything to mitigate a risk(s).

In my early years of working as an internal control person, I made a mistake of building what I as at then thought was a fantastic sets of internal control activities only for top stakeholder in the business to say ‘thanks but no thanks’.

You can imagine what events like this can do to someone’s feelings. But I picked myself up, brushed off and moved on. Don’t make same mistake, always pass your risk register through the board when you have access to them or top management if that is the highest level of access you can get.

Step (5): Evaluate needs gap

Once you are done with gaining the nod of the top management, the next thing to do is to evaluate the gaps that exists between the prevailing control and the expected controls. This is a very crucial stage that ensures that too much control redundancies are not created.

Step (6): Create awareness through communication

Your job as an internal control professional is not complete if no one in the company have any idea of what controls are in place. You need to make sure that the contents of the internal control policies are not kept secret. Make a fuzz out of it if you can ☹

Step (7): Requisition based on result of needs gas analysis

I cringe when I hear people say that internal control department does not have need for resources that all they have to do is count bean. The natural law of ‘plantation and harvest’ applies here. You make little to no investment in your internal control department, you get the equivalent of what you invested. Haven said that, bear in mind that the costs associated with properly equipping your internal control department is not that much.

Step (8): Recruit suitable staff

Except for really small businesses, the internal control function cannot be managed by a single individual. Recruiting and retaining staff is a fundamental pillar of any internal control department.

This also includes motivating staff in such a way that attrition rate is low – remember that great resignation is real. You may have a look at this stress management technique for internal auditors for some insights.

Step (9): Provide adequate training to staff

You cannot possibly run a well-functioning internal control department without having a clearly spelt out training schedule for your staff.

Step (10): Monitor and improve

No open system remains static for a long time. Therefore, you must constantly monitor your internal control departments output, activities and perceptions. This is to allow room for feedback and improvement. Notice that the contents of this article on how to start an internal control department for the first time is a summary of my day to day tasks as an experienced head of internal audit department. Do not hesitate con contact me if you need more information implementing and of the points discussed in this article that talks about the steps involved in setting up an internal audit department from scratch.