Great job on the discussion. This is what I want to see every week. I think you raised all the salient points but let me summarize and share my views.
Q1: Business Process Experiences: You have experience with a lot of different processes across a large number of industries, markets and settings. A couple observations common to each example:
- Processes are almost always comprised of a number of steps – sometimes a lot of steps (depending on level of detail provided)
- The steps are usually executed by different people and usually different functions within an organization. It’s often the handoffs between people and organizations that cause problems and inefficiencies.
Q2: SOX Laws – are they sufficient reaction or overreaction? Great discussion. My view is that the laws & regulations have had an effect because there have been fewer major control failures like Enron, Worldcom, etc. in the past. The laws have sharpened the accountability of top level executives and management. However, organizations must spend lots of $$ and it’s a lot, lot of work to develop and maintain the control system and discipline necessary to execute them.
Q3: Define a control environment: Some great definitions – although I suspect internet search tools helped. Couple of my comments related to the discussions:
- The company culture and the tone set by senior management has a role in establishing a company’s control environment. I’ll share a personal story from my experience about this in class.
- The proper culture, tone and discipline necessary to support the control environment can’t just some from the top brass / executives. It has to flow through to front line managers to be truly effective. The challenge is how to maintain the alignment between senior management and front line managers.
- We’ll learn more about this topic (in some detail) later in this class and your final exercise.
Q4: Differences between a compliance-driven vs. a profitability driven controls: Both types of controls are important to the success of an organization. Compliance controls are basic requirements for a company (necessary to operate legally) while profit controls support the ultimate goals and level of ‘success’ for a company. Although the focus of compliance vs. profit controls is different, sometimes the same methods / means can be used to support both.
This coming week we will look more deeply at the Procure to Pay (P2P, PtP, Procurement process – I use the terms interchangeably) as well and the link between risks and financial assertions.