What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities that violate the FCPA or some other law, such as Sarbanes-Oxley (SOX)? Cristina Revelo said she would start with basic questions like “How often would something be manually approved? How often are controls skipped, what is the level of approvals that you have, and what is your documentation? What are the reasons, and are you documenting how often a certain department requires those overrides?” While it could See more +

What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities that violate the FCPA or some other law, such as Sarbanes-Oxley (SOX)? Cristina Revelo said she would start with basic questions like “How often would something be manually approved? How often are controls skipped, what is the level of approvals that you have, and what is your documentation? What are the reasons, and are you documenting how often a certain department requires those overrides?” While it could indicate a company lacks a culture of compliance or everything is an emergency, it might mean something else. It might mean that your internal controls must be evaluated and recalibrated. In the FCPA Resource Guide and the Update to the Evaluation of Corporate Compliance Programs, the Department of Justice calls this continuous monitoring leading to continuous improvement. Joe Oringel, a co-founder of Visual Risk IQ, calls it continuous controls monitoring.

Three key takeaways:

1. An internal control override is not necessarily bad if proper procedure is followed.

2. Internal controls are not set in stone.

3. The key is to have a process for monitoring the controls, taking input literally from each line of defense. See less -