CT magazine (October 2022)

Last month, I wrote about succession planning in the compliance department, an important concept we should always consider to avoid a big gap when the chief compliance officer, or anyone else playing a key role in compliance, steps down or retires. But another type of succession is an even more common problem for the compliance program.

Internal controls designed to prevent or detect compliance problems vary depending on people. We can’t automate every compliance-related control. There has always been, and I think always will be, an important place for human judgment in the processes we use to prevent and detect issues. Many review-and-approve steps and other essential procedures continue to require human involvement, and this involvement often benefits from the judgment that comes with experience.

In my past life as a consultant, auditor, and investigator, I can’t even begin to count the number of times a breakdown in internal controls could be attributed to a change in personnel. So often, the transition from experienced manager to newbie resulted in some loss of knowledge or other degradation of internal controls.

I raise this issue for two reasons. The first simply carries forward my message from last month. Every department should always be in the process of preparing the next in line for a promotion. Transitions can, of course, be made more efficiently with good training and well-documented policies and procedures. But the on-the-job aspect of preparing someone to assume a greater responsibility for internal controls should not be overlooked.

Compliance professionals may have limited influence in this regard since we rarely have the level of interactions necessary to assess the adequacy of succession planning in this manner.

And that leads me to my second point. When we see a transition from one person to another in a position significant to internal controls over compliance, we should consider that in connection with our risk assessment. In a worst-case scenario, transitions from one person to another—especially without proper preparation—can significantly increase the likelihood of control breakdowns resulting in compliance failures. The policies and procedures may not have changed, but when the people change, there could be a dramatic effect on the effectiveness of internal controls.

For what it’s worth, I’ve seen my share of transitions that resulted in improvements in internal controls, too!

[View source.]