The Two Systems: Bridging the Gap Between Documented Controls and Operational Reality

The Dichotomy of Control Systems

Organizations frequently operate with two distinct control systems: a formal, documented system and an informal, operational one. The formal system, with its detailed policies and approval matrices, is what governance and audit typically review. However, the operational system, driven by the need for speed and adaptability, often involves overrides and informal decision-making that bypass the documented procedures. This isn't necessarily a compliance failure but rather an architectural adaptation to the pace of business. For internal audit, understanding this duality is crucial, as relying solely on the documented system can lead to a skewed perception of the control environment's actual effectiveness.

The Rationality of Overrides and the Evolution of Process

The article posits that overrides, rather than being exceptions, are rational adaptations. When formal processes are too slow or rigid for frequent, time-sensitive decisions, an informal operational process emerges to fill the gap. Over time, if these overrides become frequent enough, they effectively become the de facto process, even as the formal documentation continues to be completed. This means the documented process often becomes a mere transcript of a decision already made elsewhere, rather than the mechanism by which the decision was truly reached. Internal auditors need to consider the underlying reasons for frequent overrides, as they signal a mismatch between designed controls and operational needs.

Auditing Beyond Documentation: The Structural Problem

A significant structural problem in current audit methodology is its focus on testing documented controls against documented policies, without a robust mechanism to verify if the documented process is still the actual process. This approach, while ensuring compliance with written rules, fails to uncover the operational control system that truly governs decision-making. To address this, audit scopes should expand beyond simply asking "did the controls run?" to include "is the control system described in the documentation the control system that is actually being used?" This would necessitate comparing documentation with independent evidence like transaction timing, communication records, and the sequence of system entries versus approvals.

Implications for Governance and the Path Forward

The existence of these two systems means that boards relying solely on audit reports of the documented system may be operating with an outdated or incomplete understanding of their organization's control environment. The article suggests that completely closing the gap between the two systems might be unrealistic, as organizations inherently need flexibility. The key challenge for governance and internal audit is to gain visibility into the operational system – understanding which decisions are made there and how it functions. By acknowledging and actively investigating this operational reality, internal audit can provide more accurate and valuable insights, helping governance make informed decisions based on the true state of controls, rather than just their documented ideal.