Internal Controls Design website by Matthew Leitch (tutor, researcher, author, & consultant)
New website, new perspective: www.WorkingInUncertainty.co.uk - Related articles - All articles - The author - Services

Diagram Graphic
Diagrams for controls work

by Matthew Leitch, 31 October 2003



Why diagrams matter
Common problems
Clarity
Usefulness
Consistency
Conclusion

Why diagrams matter

It's possible to evaluate or design internal controls without properly understanding how the underlying process and systems work, but it is not a reliable approach. You can use Internal Control Questions (ICQs) or just go with the issues interviewees raise with you, but the danger is that you will misjudge risk levels because the process and systems don't work the way you imagine or the ICQs assume. For example, it may be that getting data from a billing system to the nominal ledger is not the single step you imagine, but instead the data passes through two other databases and a spreadsheet before it hits the nominal ledger. Unless you know you can miss potential problems on that pathway.

Assuming you decide that a description of systems and processes is needed, there are ways to do it without diagrams, some of them excellent though they usually need skill to create and to read. However, most people prefer diagrams, so diagrams it is.

Common problems

Unfortunately, many diagrams turn out to be less useful than they should be. If you're running a project that involves several people or teams producing diagrams to support an evaluation of internal controls you may recognise some of these common issues:

The following sections suggest methods of minimising all these problems. (Incidentally, if you want to master the skill of drawing diagrams like this you should consider engaging me for some individual technical tutoring or teletutoring sessions. This is the quick and easy way to do it thoroughly.)

Clarity

Whatever style of diagram you choose there are certain simple guidelines that help improve clarity. Here are some common faults that make diagrams unclear, and recommendations for avoiding them.

To show the effect of improving clarity, here's a makeover. Click on "Before" and spend a few seconds trying to work out what is going on, then close it and click on "After". It should be much easier to see what is happening, so spend a few more moments thinking about what might be missing from this diagram. Creating diagrams that are clear enough to be reviewed for gaps and anomalies is vital.

Usefulness

The last thing you want is for people to spend weeks on diagrams and have nothing useful from them until all the work is finished. Fortunately, it is easy to break the work into incremental deliveries, allowing you to learn from what has been done and to stop the work once you decide there's not much to be gained from going further.

The first goal should be to produce pictures of the underlying task, free of the details of any controls that may be involved. For example, if the data on a paper document has to be input to a computer system that is what you show, ignoring details of how it gets sent around departments gathering authorising signatures before the input takes place.

Besides being much quicker to do there are two other reasons for doing this:

  1. It is much easier to understand what is happening if you look at the underlying task first. Often it is very simple.

  2. A key stage in controls work is to link risks with controls. The underlying task is the thing that has risks. The controls are what are added to try to make sure the underlying task goes correctly. Until you isolate the underlying task this analysis is not possible.

Next, make a list of the events that the process responds to (e.g. a new sale, receipt of cash, receipt of credit note) and start with the ones that diagramming will be most useful for. These will usually be the high volume events, but remember that there are also low volume reference data updates such as changes to sales tax rates that can be extremely important.

Another way to divide diagramming into incremental deliveries is to add layers of detail in stages. For most review work this is not necessary as detailed diagramming is not needed at all. However, for some design work you might want to do more detail and that can be done as a separate delivery once higher level pictures have been done and shared with others who can use them.

Diagrams should directly support later stages in your work. That may involve some careful thinking about the task and what you need from diagrams.

In "The easiest and best matrices for documenting internal controls" I explain one method of risk identification that is useful when your main interest is ensuring that information is processed reliably. In this technique the processing is sliced into steps, each one being (a) across a process, or (b) across a dataflow (including data capture and data output flows). For each step you then look for controls covering completeness, accuracy, validity, and any other control objective of interest. Obviously, a diagram in terms of processes and dataflows makes this easy.

It helps to ensure accuracy and usefulness if you try to base your diagrams in physical reality. Look for computer applications, databases, computers, paper forms, and reports. Find where data resides and where it moves and show those stages.

Consistency

Let's imagine you've laid down rules for clarity, rules for icon styles, the diagramming style, and what software to use. You've agreed with everyone that the first stage is to document the underlying task. What can go wrong? Usually it's interpretation and level of detail. Ask people for a "process description" and be amazed at how many interpretations of "process" there are.

Here are three ideas for consistency:

Conclusion

Looking back at the many diagrams I've seen over the last decade only a handful have been clear and useful. The vast majority have been seriously flawed in one way or another and that means effort was wasted. This is not necessary and the rules of clarity suggested above should help.

Many companies do not have diagrams on the grounds that it would be too much work, but using the ideas described above to control the level of detail should make it much more cost effective.

If you want to master the skills involved, or have others in your team master them, then you should consider engaging me for some individual technical tutoring or teletutoring sessions. This is a quick and effective approach to learning that helps you know you're doing things right.



Words © 2003 Matthew Leitch
New website, new perspective: www.WorkingInUncertainty.co.uk - Related articles - All articles - The author - Services

If you found any of these points relevant to you or your organisation please feel free to contact me to talk about them, pass links or extracts on to colleagues, or just let me know what you think. I can sometimes respond immediately, but usually respond within a few days. Contact details

Matthew Leitch - Author

About the author: Matthew Leitch is a tutor, researcher, author, and independent consultant who helps people to a better understanding and use of integral management of risk within core management activities, such as planning and design. He is also the author of the new website, www.WorkingInUncertainty.co.uk, and has written two breakthrough books. Intelligent internal control and risk management is a powerful and original approach including 60 controls that most organizations should use more. A pocket guide to risk mathematics: Key concepts every auditor should know is the first to provide a strong conceptual understanding of mathematics to auditors who are not mathematicians, without the need to wade through mathematical symbols. Matthew is a Chartered Accountant with a degree in psychology whose past career includes software development, marketing, auditing, accounting, and consulting. He spent 7 years as a controls specialist with PricewaterhouseCoopers, where he pioneered new methods for designing internal control systems for large scale business and financial processes, through projects for internationally known clients. Today he is well known as an expert in uncertainty and how to deal with it, and an increasingly sought after tutor (i.e. one-to-one teacher). more

Please share:            Share on Tumblr