In many companies compliance is treated as a calendar item: an audit approaches, preparation starts, documents are gathered, the process closes, and life resumes. The flaw in this approach is that an audit looks backwards. Once an audit is announced, the number of things you can retroactively correct is quite small. Internal control is therefore not a preparation activity but a system that runs continuously.
Control is a design question, not a question of distrust
The first thing that comes to mind with internal control is usually layers of approval and the number of signatures. A well-designed control system does not slow work down; it makes sure errors are caught where they are cheap. A payment error caught at approval costs almost nothing to correct; the same error surfacing three months later in reconciliation costs both money and reputation.
So the question to ask when designing controls is not how many signatures are required, but where in this process an error is cheapest to catch. The answer is usually not more approval but earlier checking.
An undocumented process is a process that does not exist
Many controls in a company genuinely work but live only in the heads of particular people. While those people are in post, the system looks sound. When one of them leaves, how the control operates, who checks what, and how exceptions are handled becomes territory nobody fully knows.
That is precisely what an auditor examines: not the existence of a control but whether it can be demonstrated to have been applied consistently. A control performed but not documented counts, for audit purposes, as not performed.
An audit measures not what you did, but what you can show you did.
What a continuously running compliance structure needs
- Processes and control points written down, current, and accessible
- Segregation of duties: approval, execution, and recording held by different people
- Exception handling defined in advance and recorded when it occurs
- Regular internal review, with findings tracked on a list that has an owner
- A route by which regulatory changes are monitored and reflected into processes
Compliance work carries a side benefit most companies do not expect: as processes become written, operations speed up. When it is clear who does what and when, waiting time drops. At SAFARI CONSULTING we approach internal control and audit readiness with that view, building compliance as a working structure rather than a burden.