Thinking about the Overall Burden of Control and Compliance Measures

Thinking about the Overall Burden of Control and Compliance Measures

Beyond the appropriate design of individual systems, policies, procedures, etc., it is also essential to think about an organisation's overall burden of control and compliance measures. My experience moving from Finance to Human Resources and then becoming Chief Audit Executive at AstraZeneca helped me see why another policy or procedure would not solve every problem the Internal Audit team found. The ‘Lean Auditing’ approach that we implemented sought to improve governance, risk, and compliance (GRC) in the organisation in a ‘fit for purpose’, non‐bureaucratic manner wherever possible.13

Subsequently, my consulting work has entailed helping organisations overhaul their policies and procedures. The problem can be summed up by one of my clients telling me they had more than a hundred policies, hundreds of procedures and, in total, several thousand control activities to maintain and monitor.14

Others have identified similar challenges. John Bendermacher (Chief Audit Executive, Euroclear) observes:15

‘It's important to recognise the amount of regulation that might impact an organisation. This can be at national laws, international regulations and sector‐specific requirements. Think of these as a pile of “blankets” covering what you want to do. They all have a reason for being in existence. Still, collectively, they amount to a lot and can smother attempts to be more agile and adaptive to customer needs.

It's why those working in GRC, and audit have a responsibility to coordinate and, where possible, combine the key things that need to be done. But most of all, you need to work with business colleagues to link requirements to practical day‐to‐day tasks and not make them a “bolt‐on”.’

I think it can be helpful to consider how structures, systems, policies, procedures and other internal control (or GRC) requirements make up the ‘skeleton’ of an organisation:

1. If you have too many rules, procedures, and checks and balances, or they are too ‘burdensome’, you end up being weighed down by these requirements, often created by managers with no ‘skin in the game’. Nassim Nicholas Taleb observed: ‘People who are bred, selected and compensated to find complicated solutions do not have an incentive to implement simplified ones'.16
2. But suppose you have areas without appropriate rules, processes, procedures, checklists or protocols. In that case, you may get innovation and creativity, but you may also get weaknesses and problems (e.g. exposure to a cyberattack, fraud or manual activities where staff might forget what needs to be done).

Designing an overall framework of policies, procedures, and controls requires considering how they work together.17 As one manager explained, ‘We want to Simplify, Clarify and Strengthen management control requirements, so we don't have surprises on the ‘basics’, but beyond this, we want to allow for flexibility and innovation’.

Thus, a good design can't be created in a vacuum. There are many considerations to bear in mind, including how well it considers human factors and the workload burden involved. As Brian Reed puts it: ‘Everything is designed. Few things are designed well’.18

So, it's worth considering:

• If we look at structures, systems, policies, processes, infrastructure, etc., what designs have we become so accustomed to that we might have underestimated how they might cause problems?
• As things evolve in the future (e.g. ESG requirements, AI, etc.), do we have the tools and the language to articulate what it would mean for things to be ‘well designed’? Especially given the fact that things will evolve in ways we cannot yet imagine.
• To what extent do we need to reappraise the design of some of the RCA tools in use (especially those without a systems perspective) to see whether they are suitable for the problems of today?