Verifying that controls operate.
WHY IT IS NECESSARY
Controls that are not checked stop being performed.
WHAT TO CHECK
Whether the control was actually carried out Whether it was carried out properly Whether exceptions were followed up
WHY THE THIRD POINT
Controls that identify exceptions and do nothing about them achieve nothing.
HOW TO CHECK
Select a sample and examine the evidence.
WHAT EVIDENCE LOOKS LIKE
Signatures and approvals Completed reconciliations Records of counts Investigation notes
WHAT TO ESTABLISH
That controls produce evidence of their performance.
WHY
A control with no record cannot be verified.
WHAT SAMPLE TO TAKE
Enough to be meaningful, across the period.
WHY ACROSS THE PERIOD
Controls performed at the start and abandoned are common.
WHAT TO DO ABOUT FAILURES FOUND
Establish whether it was isolated or systematic Address the cause Check whether losses occurred
WHY CHECK FOR LOSSES
A control that failed may have permitted something.
WHAT TO AVOID
Treating findings as blame.
WHY
It produces concealment and defensiveness.
WHAT TO ESTABLISH
That the purpose is improvement.
WHO SHOULD PERFORM CHECKS
Someone independent of the process.
WHAT TO DO IN A SMALL BUSINESS
The owner, personally, at intervals.
WHY PERSONALLY
Delegated oversight of the people you are overseeing does not work.
WHAT TO RECORD
What was checked, what was found, and what was done.
