Continual organisational improvement by integrating Internal Control into

the management cycle

Discussion Paper No. 2

Public Internal ControlAn EU approach

Ref. 2014-2

Public Internal Control Systemsin the European Union

1

Continual organisational improvement by integrating Internal Control into the management cycle

Developing an Internal Control system is an iterative process that involves improving performance and governance, rather than introducing a new, additional system. Internationally recognised or national standards and frameworks offer common points of reference regarding trends in modern management and provide a comprehensive, structured approach to Internal Control. In this paper, the integration of the management cycle and the Internal Control system is illustrated by Demings framework (plan, do, check, act), which emphasises the principle of continual improvement.

2

TABLE OF CONTENTS

1. INTRODUCTION....................................................................................................... 3

2. KEY ASPECTS OF INTERNAL CONTROL IMPROVEMENT ............................. 3

3. THE MANAGEMENT CYCLE ................................................................................. 4

4. RELATION/INTEGRATION OF THE INTERNAL CONTROL SYSTEM WITHIN THE PDCA MODEL................................................................................... 5

4.1. Phase 1: Plan...................................................................................................... 5

4.2. Phase 2: Do........................................................................................................ 6

4.3. Phase 3: Check .................................................................................................. 6

4.4. Phase 4: Act....................................................................................................... 7

5. CHALLENGES........................................................................................................... 9

3

1. INTRODUCTION

The aim of this paper is to provide short and practical guidance on how to integrate internal control into the management cycle. This concept has been taken as a starting point for further discussion on challenges and good practice examples in this area within the Member States.

Most Member States have put in place reforms to improve management in the public sector. Their initiatives were usually linked to the introduction and promotion of the Public Internal Control (PIC) system. They are focused on implementing basic principles, including an internal control model based on internationally-recognised frameworks and standards. In most cases, national internal control systems are directly or indirectly based on the COSO1/INTOSAI2.

Currently, an important consideration is how to improve the functioning of the internal control system in the most cost-effective way.

2. KEY ASPECTS OF INTERNAL CONTROL IMPROVEMENT

Public sector entities are set up to reach objectives and fulfil tasks described in the regulations, usually related to delivering service to citizens in certain area. An internal control system is designed to support the head of a public entity in managing operations, carried out to achieve the organisations objectives, in particular, in a cost-effective manner.

The internal control system should help to achieve the organisations objectives and to manage its activities in a more efficient way on each level of the entity. Developing an internal control system at entity level should not lead to extra administrative burdens. Existing structures should be assessed, and they should be integrated into control mechanisms according to identified needs. The challenge for heads of public entities is to find the best way to improve current systems, taking into account the cost of control measures.

The following points need to be considered:

Entities with a less developed internal control system should first focus on the basic preconditions for any internal control system, in particular, a sound internal control environment.

All entities have elements of an internal control system and most stages of the management cycle in place. Now these need to be structured, formalised and improved in accordance with identified needs and cost considerations.

The internal control system should not function separately from existing operations within the organisation. The internal control system should be integrated within the management cycle as well as on the operational level.

1 Internal Control Integrated Framework developed by the Committee of Sponsoring Organizations of

the Treadway Commission

2 International Organisation of Supreme Audit Institutions

4

Developing an internal control system is thus an iterative process that involves continually improving performance and governance, rather than introducing a new, extra system. Internationally-recognised or national standards and frameworks offer common points of reference within trends in modern management and provide a comprehensive, structured approach to internal control.

3. THE MANAGEMENT CYCLE

A public entitys scope and activities are determined and influenced by factors such as:

political strategic goals annual policy priorities resource limitations reporting obligations.

Whatever the organisation, the head of an entity typically manages available resources to meet stakeholders expectations in the most effective way. The head of an entity is also responsible for:

evaluating what was accomplished against what was planned, taking action to improve the situation, anticipating changes and possible new risks.

The integration of the management cycle and the internal control system is illustrated by Demings framework, featuring the principle of continuous improvement.

Figure 1: Integration of the internal control system within the management cycle based on the Deming cycle. Taken from the Practical Guide for the Development and Maintenance of an Internal Control System by the Belgian Public Federal Service for Budget and Management Control.

5

The Deming cycle consists of four phases:

Phase 1 Plan (establish baselines for the organisation, setting objectives and measurements);

Phase 2 Do (implement actions to achieve objectives);

Phase 3 Check (monitor, measure and document results);

Phase 4 Act (improve, evaluate, apply lessons learned, modify as necessary).

The PDCA model enhances the continuous and dynamic process of the management cycle focusing on continuous improvement during the execution of activities.

4. RELATION/INTEGRATION OF THE INTERNAL CONTROL SYSTEM WITHIN THE PDCA MODEL

Below is a description of how the main elements of an internal control system could be related to PDCA phases, pointing out important aspects that could be taken into account at each stage.

4.1. Phase 1: Plan

Management cycle:

Objectives are defined and turned into clear, measurable goals. Processes and projects are rolled out to achieve these objectives. Resources are defined and responsibilities are assigned.

In public services, tasks and strategic objectives do not change greatly over time, but annual objectives may change to meet current priorities or to deal with new challenges and stakeholder requirements. This may, for instance, involve finding ways to improve effectiveness and efficiency.

Internal control:

New processes are described and existing ones are updated if necessary. New measures are developed, based on a risk analysis, and existing measures are

refined.

Indicators (such as Key Performance Indicators) to follow the progress of projects and processes are chosen.

Resources allocated to processes and projects need to be taken into account and monitored at defined intervals.

Reporting content and frequency are set. Indicators for follow-up should be aligned to the reporting needs of the executive or the higher hierarchical level. New measures and indicators can be evaluated ex ante to ensure

6

their effectiveness. Responsibilities are reviewed to check that there is compliance with segregation of duties.

It should be borne in mind that objectives should be described in SMART concepts (Specific, Measurable, Achievable, Relevant and Time-bound). All of these requirements need to be fulfilled to achieve objectives. Objectives should be cascaded to all levels of the organisation.

4.2. Phase 2: Do

Management cycle:

The executing phase includes the normal working activities, or the chronological execution of the processes and the completion of the projects. The manner in which activities are performed during this phase is critical to the quality of the output and the amount of input. In other words: the execution determines the operations compliance, economy, efficiency and effectiveness.

Internal control:

To obtain a good result, a first condition is to follow the procedures and requirements during the execution of activities. To this purpose, clear guidance and support of the direct superiors and other management staff are necessary. Measures developed in the planning phase will be executed along with the activities. During the execution of the activities, information of the measurement system will also be gathered to be examined in the analysis phase.

Additionally, the organisation can record all incidents that occur. This process is not essential but can significantly contribute to identifying the risks and to improve measurements and realistic standards for performance and other indicators.

In some cases, the organisation or cultural factors are likely to interfere. Controls can be ignored or even deliberately circumvented by people, and management can override the internal control system. It is important that the control environment is supported, i.a. the employees are not blamed for risks reporting. Should the need arise, a program of change management is a simple technique used to apply transversal changes within the organisation.

4.3. Phase 3: Check

Management cycle:

The organisation will regularly examine:

progress in processes and projects whether objectives have been achieved use of resources other factors that may affect the smooth running of the organisation.

During this phase, there is careful examination of partially achieved objectives. This is part of monitoring by management and is one of the executives tasks.

7

Internal control:

In this phase, descriptions of the process and the preliminary risk assessment prepared during planning are collated with information gathered during the do phase. This provides a basis for a thorough cyclical analysis of the results and their related risks.

Information on performance shows whether there were events that made it more difficult to achieve the desired results, or whether there were factors that enabled good progress. New risks may arise during the management cycle as circumstances change. This is why it is important to review the risk cycle periodically.

To manage a risk, it is necessary to address its root cause. If the cause is one of the risk factors already taken into account, then existing measures should be corrected or extended. If the problem is new, a new measure to address it is needed.

The information compiled needs to be accurate, relevant and timely. If the description of results obtained is unrealistic or unclear, this poses a risk for the executive management, which will have to take decisions based on an unclear situation.

A management gap is not always the result of an operational incident. There may also be structural causes, such as:

lack of SMART objectives incomplete measurement system failure to follow procedures, etc.

In such cases, it may be appropriate to focus on improving the formulation of objectives, relevant Key Performance Indicators (KPI), staff accountability, etc. During the next planning phase, it may be appropriate to reformulate objectives, adjust the measurement system or carry out a project to inform staff about what is expected of them.

4.4. Phase 4: Act

Management cycle:

Based on the collected information, decisions are taken to overcome problems or to exploit opportunities. The manager will take actions to minimize the impact of unexpected events to bring things back on track to the desired goals and this as quickly as possible. Management will take into account the costs and benefits of the measures when taking decisions.

Internal control:

Appropriate control activities will be defined, based on information gathered during the check phase, in which the underlying causes of problems are identified. These activities will take into account efficiency and effectiveness and the impact on the rest of the organisation.

If management is willing to introduce new measures to address problems, this raises staff awareness and keeps them prepared to deal with difficulties. Implementing measures may simply involve small improvements or instructions, or may require significant

8

changes in activities. Objectives may even be redefined, or new objectives introduced, leading to a new cycle.

New measures may be tested and evaluated ex-ante. This may be useful in particular when the measures have an effect throughout the organisation. Some measures may yield good results in solving a problem, while having a negative impact elsewhere, thus creating new risks or reinforcing existing ones.

If a risk concerns the entire organisation or a substantial part of it, it should be dealt with at organisational level. This may mean taking relevant information into the next planning phase and defining a new project, or adjusting plans to redirect staff towards new goals.

And up to the next cycle:

During the next management cycle, results and risks will again be analysed to assess whether measures intended to bring about improvements were successful and projects implemented. It may also be useful to evaluate existing measures to check whether they are still relevant and efficient.

Public entities are under considerable pressure to work more efficiently and obtain higher levels of effectiveness. Objectives are defined by political choices. As a consequence, objectives will have to be reviewed or refined regularly, and this will lead to the start of a new management cycle. The timing of reviews may also be triggered by other factors, for instance, a new management plan, the appointment of a new manager, or budgetary restrictions.

The management cycle recurs naturally. Documenting its various stages is a challenge. A well-structured approach will yield reliable information, which supports solid decision-making and management and may ultimately improve the way in which an organisation functions.

If objectives are refined or reoriented, this may lead to new risks that require new measures to mitigate them. So, along with the management cycle, there will be an impact on internal control, this process being integrated into day-to-day activities. For each loop of the management cycle, proper monitoring and reporting should systematically be refined.

Tools and sources of information regarding Internal Control:

Internal control should lead to integration and better use of all information and tools available in an organisation, without creating parallel systems that may lead to duplication of work and waste resources.

National development plans, strategic plans, annual management plans, and operational programmes are useful sources containing information on objectives, activities, risks and deliverables. Moreover, information such as audit reports can draw attention to areas in which adjustments should be made.

There are many tools and frameworks offering basic principles and guidelines for different aspects of internal control (e.g. ISO 31000 for risk management and COSO ERM). A specialist application or software to gather data on risk identification can help to structure the risk process. The Balanced Score Card or other performance measurement tools can help to gather useful information on the progress of activities.

9

The combination of PDCA and an internal control system can help to reduce management gaps and enable an organisation to develop on the basis of feedback received on activities and results. A structured approach offers the prospect of better performance as the achievement of objectives is continually monitored, in conjunction with the use of resources.

5. CHALLENGES

(1) What are the different roles and responsibilities of the various actors in the PDCA cycle (senior management, management and operational level)?

(2) What factors could hamper the implementation of the PDCA/IC integration approach?

(3) What are the proper settings for such an approach to gain its full benefits?

1. INTRODUCTION2. KEY ASPECTS OF INTERNAL CONTROL IMPROVEMENT3. THE MANAGEMENT CYCLE4. RELATION/INTEGRATION OF THE INTERNAL CONTROL SYSTEM WITHIN THE PDCA MODEL4.1. Phase 1: Plan4.2. Phase 2: Do4.3. Phase 3: Check4.4. Phase 4: Act

5. CHALLENGES