Policy and Procedure Makeover
This is a continuation of the article Why Do You Do What You Do? The Heart of Internal Control. I believe that the key to effectively managing what I call the “Known Known” risks (risks that we already know the cause and effect and the required controls [domain of best practice]) depends on how clearly policies and procedures are documented.
Understanding the following key terms is important in writing effective policies and procedures;
A lot of the time, policies and procedures are written by taking an undifferentiated mass of words and chunking them together without the clear distinctions highlighted above. In some instance you find it hard to tell a policy document from a procedure .
Using the same procurement example in Part 1, the image shows the distinction between a poorly written policy that does not explain why people should do what they do( controls) and one that provides clarity on what needs to be done and “why”.
The key highlights of the makeover are;
When listing policy requirements , use the correct verb form: must, is required or may . Avoid using verbs like will, should or can .These create ambiguity.
Clearly define responsibilities i.e. procurement officer rather than procurement.
Focus on explaining why the control requirement is important e.g. three quotes were obtained to determine the FMV
Do not go too much in the detail in policies e.g. requirements for CO2, CO7, e.t.c. rather focus on the what must be done and why. Hence, the focus on the CAC requirements as referenced from CAMA (regulatory compliance). Details should be communicated in Standard Operating Procedure (SOP) in a step wise format.
In conclusion, well written policies and procedures are the foundation of an effective internal control framework and they help achieve the following;
- Compliance with regulations
- Compliance with best practices
- Improvements in understanding of risks and controls
- Training of new employees
- Measurement of results, performance
- Convey the culture of the business