Business Operational Controls: 4 Ways to Go from ‘Quantity’ to ‘Quality’

Learn how to kickstart effective risk management by using key control indicators and avoiding resource-draining excessive operational controls.

Every organization has established thousands of business operational controls over the last decade. Yet, audit teams still uncover errors and regulators still impose fines, leading to the creation of more controls. This results in unmanageable inventories, duplicative controls consuming valuable resources, and controls failing to provide necessary risk mitigation. Also, there’s an overall lack of ownership and hands-on knowledge of each control’s functionality. It’s time to break that cycle; we know how.

Reducing redundant business controls involves an in-depth review of control relevance and applicability. Additionally, it requires consolidating duplicative controls, retiring outdated ones, and making necessary edits or implementing new controls for compliance. While these efforts demand focused resources and can take a lot of time to do it right, it’s not as daunting as you may think. You can effectively manage your controls landscape with a few key indicators. Uses these quick-hit actions to manage your controls and kickstart the process efficiently.

Detective Control Execution Can Give Insight into Business Operational Control Inventory Performance

Your organization likely has several detective controls within the full control inventory, and their results are tracked and reported at pre-defined intervals. These results give you insight into several aspects of the control inventory. Here are a few considerations.

Your organization likely has several detective controls within the full control inventory, and their results are tracked and reported at pre-defined intervals. These results give you insight into several aspects of the control inventory.

No Errors Identified Indicate a Red Herring: A period of zero errors might initially bring contentment, but a prolonged absence of errors raises questions about the control’s relevance. It could signal an outdated control, a process change, or incomplete sampling, which can create a false sense of security. If zero errors persist, a closer examination is necessary to identify the underlying reasons and make adjustments as needed.

Significant Number of Errors Identified Show a Broken Preventive Control: Repeated errors over several months indicate a need for change. Each detective control should have a corresponding preventive control to block errors. A reoccurring volume of errors identified by a detective control means that the preventive control failed and requires a review. This could entail modifying the existing preventative control or retiring the current one and creating a new, effective control.

Complaints Unveil Overlooked Control Gaps and Fuel Strategies for Effective Resolution

Complaints are the real-time voice of the customer, offering insights into aspects overlooked when designing the control inventory. Most controls are built around standard customer behavior and often overlook less-likely-to-occur scenarios. These unique deviations do happen and must be considered in control design. When a customer files a complaint, a root cause analysis is essential to identify if there was a control failure.

You can establish a successful root cause analysis with three fundamental elements:

• An effective intake process: Ensuring all complaints are tracked and categorized.
• Thorough root cause analysis: Identifying all reasons for a break in the process.
• Analysis against the current control inventory: Determining why existing controls couldn’t prevent the error.

Empowering Front-Line Agents Enhances Control Effectiveness Through Proactive Escalation

Agents on the front-line talk, email, and chat with customers daily. As a result, they witness firsthand the implementation of company-wide strategic initiatives and the resulting reception of those initiatives by customers. So, agents are the first to receive questions and detect problems, so they must have an easy method to escalate concerns, anomalies, and customer frustrations.

Each escalation requires further research to determine its validity and understand its impact on existing controls. If your organization lacks a program for agents to voice concerns from the customer, one should be established immediately. Then, you must define criteria for agent escalations but avoid limiting or discouraging agents from raising important issues.

Inter-Departmental Findings Break Down Silos and Strengthen Business Operational Controls

Sharing information across business units is seemingly simple in an organization. Yet too often, business units operate in silos and information isn’t readily or easily shared. Siloed units overlook that errors aren’t always isolated to a single process; they can impact customers across the organization. You can make sure vital information is shared among all departments by implementing the following activities:

• Implement a monthly or quarterly business review: Include representation from all business units focused on open issues.
• Require departmental attestation: During these reviews, ensure all departments confirm whether issues found/discussed are applicable to their department and if there is a multi-unit gap that needs to be addressed.
• Document minutes, including attendance: Documented minutes must be distributed to key stakeholders after each meeting for comprehensive follow-up and transparency throughout the organization.

Refining Control Inventories to Mitigate Operational and Regulatory Risk is Hard Work

Bridgeforce can help.

For more than 24 years, Bridgeforce has partnered with banks and credit unions to refine business operational controls through mapping exercises, control assessments and guided root cause analysis. We help our clients measure the effectiveness of each control to mitigate operational and regulatory risk.

Are you interested in Bridgeforce’s trusted guidance for better control cleanup? If so, contact us and we’re happy to discuss our battle-tested approach in greater detail. In the meantime, get started on refining your control inventory to help limit future errors with what we have shared above.