Transcript
SPEAKER 1
90% of risk in any organisation are known risks. They're not new things. They're known risks. And at some point in the past, they will have been- the risk would have materialised, and something bad would have happened, and some control will have been developed in order to mitigate that risk.
So your internal control framework, at whatever level it is, whether it's high-level controls or operational controls- they're all there for a reason.
SPEAKER 2
So an internal control is just a repeatable action or activity, something that happens over and over again. So a great example of that, for me, would be when I- a long time ago now, when I was a student, I worked in a soap factory. And one of the things that the soap factory had to do was to make sure that there weren't any defective bits of soap.
They started off by employing some unfortunate lady or gentleman who had to physically look at each bar of soap and check that they were actually of the right size and colour. What they did to test whether that was working at one point is some ingenious person put a piece of coal on the production line to see whether the person would spot the piece of coal from the piece of soap. And they couldn't, because they'd been looking at that many bits of soap. They'd gone soap blind, if you like.
What they then did is they put in place something that was more robust to stop bits of coal getting mixed up with their soap. So for me, an internal control is something that takes a repeatable action to make sure you achieve your objective. So in my soap example, you're not getting pieces of coal in your shower in the morning. You're using pieces of soap.
SPEAKER 3
Internal controls are a vital part of risk management, and they ensure that our risk levels are accurately assessed and remain in control, ultimately. Action plans are all good and well for reducing the level of risk, but actually monitoring the level of risk is what controls are there for. If our controls fail, our risk level may increase beyond what we think is acceptable. And controls themselves are generally a repeatable action that you will continue to do maybe month by month. They could be automated, or they could be a human-type control.
SPEAKER 4
So internal controls are important because in essence, whatever you're trying to achieve is a journey. You're trying to get to the end goal, the finish line. And you'll travel a road to get there. Now, sometimes that road will be bumpy. Sometimes it will be smooth. Sometimes it will be wide. Sometimes it'll be twisty and turny.
But you've got to go across the road. You've got to get- that's how you get to the end result. And what internal controls are- internal controls are the signposts that say slow down here, bends ahead. The safety barriers are the side that stop you driving off.
Now, that's not to say that, in essence, you might drive right instead of left, you might drive too fast or too slow and do yourself an injury of some sort. But what they do do is they will get you there. The reality of it is no internal control is perfect. They have a wide remit they have to cover anyway. But if you follow those, you will get to the end result, which is the important thing.