Why Do You Do What You Do? – The Heart of Internal Control (Part 1)

In the course of my work as a risk manager, I get to ask a lot of questions from business/process owners to assist them in assessing and modifying their controls. One of the many questions I often ask is, “Why do you do what you do?”, and some of the responses I get often are “that is how we’ve been doing it since I joined the company” ,”that is what the SOP (Standard Operating Procedure) says,”. These kind of responses are clear indicators of poor risk and control culture.

An example of a typical conversation with a procurement officer responsible for selecting new vendors is shown below:
Me: Why do you collect Memorandum and Articles of Association (MEMART) and three year financial statements from vendors before you include them in your list of approved vendors
Procurement officer: We just collect the documents as stated in the SOP.
Me: Do you use the information to make decisions ?
Procurement Officer: No, we just collect and file them so that when auditors come around they will not raise it as finding if we do not follow the SOP.

The procurement officer is oblivious of the fact that he has to review the MEMART to determine if the objects of the company will allow the vendor legally provide the service to the company and that the financial statements will need to be analysed to determine the financial capacity of the vendor.

This example highlights the need for employees to know why they do what they do. Like the popular saying goes: “When the purpose of a thing is not known, abuse is inevitable”. Therefore, for employees to implement design and implement controls effectively they need to understand the WHY of the controls rather than just the HOW.
The WHYs of controls should be documented in Policies and the HOWs documented in Procedures. In the example above, the WHY should be documented as a policy requirement  such as :”In selecting vendors, an assessment of the legal and financial capacity of the vendor shall be conducted. This will assist in providing more clarity on why the information/documents are collected and further details on how this is carried out will be explained in the Procedures.

In conclusion, besides improving the design and implementation of controls, when people understand why they do what they do ,work becomes more meaningful and engaging resulting in a high performance culture.

Leave a Comment

Your email address will not be published. Required fields are marked *