How to map Internal Financial Controls: A Working Method

Map internal financial controls backwards. Start at the reported number, trace it to the process that decides it rather than the one that assembles it, name the assertion the number carries, find the control standing between the source data and the number, choose the population and write down what was left out, then test design and operation. Seven steps, MP1 to MP7, a teaching structure rather than a standard or anybody else's method.

The definition of an internal financial control, the claim a control assertion makes, and the Indian body holding the reporting duty that makes somebody sign for it are covered separately. The part nobody hands over is the actual order of work. Given a set of financial statements and an institution underneath them, how are the controls that matter found, and in what sequence? The ones found have to be the ones that could make a reported figure wrong.

Everything below runs on one invented institution, Vindhya Commercial Bank Limited, with a balance sheet of Rs 96,000 crore, 214 key controls across nine processes numbered PR1 to PR9, and a twelve month record in which one control failed.

In what order should internal financial controls be mapped?

Seven steps, and the order is not decoration. Each one produces the exact input the next one needs. Running them out of sequence produces a mapThe record of which controls stand between things that happen and numbers that get reported. that looks finished and is not. Read the seven now as a shape, then take them one at a time.

Notice what is missing from that ladder. There is no step that says survey the institution, no step that says gather the process documentation, and no step that starts anywhere except at a figure somebody has published. The method begins at the end of the pipeline and walks upstream, and every difficulty it avoids comes from that one choice.

Where does the map start, and why not at the process?

Almost everybody maps forwards. Mapping forwards feels like the sensible thing to do: an institution runs processes, some of those processes touch financial reporting, so list the processes, mark the ones that touch reporting, and map the controls inside them. The forwards map produces a document nobody will argue with, it can be built from an organisation chart in an afternoon, and it is wrong in a particular way that is very hard to see from inside it.

The mechanism is the same at any scale, so take the everyday version first. A household discovers that the electricity bill it paid was too high. Mapping forwards lists the things the household does that touch bills: opening post, checking the amount, paying. Mapping backwards starts at the number on the bill and asks what would have to be wrong for it to be wrong. Within one step the answer is the meter reading, and the household does not take the meter reading at all. The forwards question finds the people handling the number, and the backwards question finds whatever decides it.

Now the institution. A forwards question at Vindhya Commercial Bank arrives at process PR8, financial reporting and close. The bank's own internal financial controls assessment sits in exactly that process. A backwards question about one number in that bank lands somewhere else entirely.

MP1: list the reported numbers

Start with the statements themselves and write down the figures. At this bank that list opens with total assets of Rs 96,000 crore, net advances of Rs 57,600 crore, investments of Rs 26,400 crore, the provision held against non-performing advances of Rs 1,200 crore, and the standard asset provision of Rs 494.4 crore which sits inside other liabilities and provisions of Rs 3,120 crore, being 15.8 per cent of that line.

Now the ordering rule, and it is the first place people go wrong. Do not rank the list by size. Rank it by how far a wrong control could move it. A figure that is enormous and mechanically determined is a poor candidate, and a small figure that depends on a judgement made somewhere upstream is an excellent one. Total assets of Rs 96,000 crore is the sum of six lines that each tie exactly; there is very little a control failure can do to it that would not first show up somewhere more specific. A provision computed from marks on a secured book is the opposite kind of figure. The provision is small, and it is entirely at the mercy of an input arriving correctly.

MP2: trace it backwards, and expect two processes

One figure from MP1, followed back to where it comes from, produces two answers, and confusing them is the single most common defect in a control map. The first answer is where the number is assembledWhere a number is put together, which is the reporting and close process., meaning where somebody adds it up, journals it and puts it on a statement. The second is where the number is decidedWhere a number is actually determined, which is usually an operating process somewhere else., meaning where the input that determines its value is produced.

At Vindhya Commercial Bank the standard asset provision of Rs 494.4 crore is assembled in process PR8, financial reporting and close. The provision is decided in process PR3, collateral management and valuation. The value depends on how the secured book is marked, and the mark comes out of a valuation feed running inside PR3. Two processes, and only one of them was ever going to appear on a map drawn forwards from the reporting function.

MP3: name the assertion before looking for a control

At this point there is a number and two processes. The temptation is to go straight to the control register and pull out everything that touches either one. There is a step in between, and skipping it is why so many control maps are long and useless.

Write down the assertionThe claim a reported number carries, which is what gives a control something to be a control over. the number carries: the claim a reader of the statements is entitled to make on the strength of it. For the standard asset provision at this bank the claim is that the provision was computed on valuations that were current throughout the period. One sentence, and it does an enormous amount of work. A control with no assertion behind it has nothing to be a control over, and nothing it can be seen to fail against. Once the sentence exists, most of the candidate controls fall away on their own. A control that touches the number without protecting that particular claim is not the one being looked for.

MP4: find the control, and write an objective somebody can fail

The search now has a definite object: whatever stands between the source data and the number, protecting the sentence written in MP3. At this bank the collateral valuation control in process PR3 stands between the valuation feed and the mark on the secured book. Its objective, written the way an objective has to be written, is that no loan is marked on a stale valuation.

The objective has a particular shape. An objective is not a description of an activity but a statement of what must not happen, phrased so that a person holding a week of records could tell whether it held. An objective written as "collateral valuations are reviewed periodically" cannot be failed by anything. Nothing in it says when, by whom, or what counts as too late. An objective that cannot be failed is not an objective, it is a description, and a map full of descriptions cannot be tested.

One detail from this bank explains how a control with a good objective still went nowhere. The valuation feed had a definition, a source system, a named owner, a named steward, permitted values and a refresh frequency, and it had documented lineage through to the report line it fed. The feed had no statement of what happens when the value fails to arrive. So when the feed stopped arriving, nothing was defined to happen, and nothing did.

What does the map record for each control it finds?

Five parts, and they are fixed. Four of them are the ones everybody writes. The fifth is the one that goes missing, and it is the only one a reader cannot reconstruct from anything else in the file.

MP5: decide the key population, and write down the exclusions

The key populationThe controls chosen for the assessment, and the choice bounds every conclusion that follows. is the set of controls the assessment will actually cover. The key population has to be chosen before a single piece of evidence exists. The choice is uncomfortable and unavoidable, and it decides the reach of everything that comes after. Vindhya Commercial Bank has 214 key controls across its nine processes. Its own internal financial controls assessment covers process PR8. The narrower scope is a choice, it is defensible, and it has a consequence: process PR3, where the collateral valuation control lives, sits outside it.

Recording the exclusions is the part of the method that people skip. An exclusionA control or process deliberately left out, which has to be written down because nothing later recovers it. has to be written down at the moment it is made, in the scope memorandum, in words a reader will meet before they meet the conclusion. Nothing later in the work recovers an exclusion that was never recorded. The excluded thing was never going to be found, and an assessment listing only its inclusions reads exactly like an assessment that covered everything. The honesty problem sits at the centre of this step, and it is not solved by working harder.

MP6: hand the mapped control to the tests

Mapping ends where testing begins, so MP6 is a hand-over rather than a body of work. Each mapped control goes first to the design test and then to the operating test. The design test asks whether the activity would achieve the objective if it happened every time, and the operating test asks whether it did happen every time. The order is not interchangeable. A control that fails design does not need an operating test: nothing is left to test the operation of. Mapping stops at the hand-over. A walkthrough, the choice of a sample, what counts as evidence and what an exception means are all held by the method that follows this one.

MP7: record what could not be mapped, and consider it anyway

Two things happen in the last step, and the second one surprises people. First, what defeated the work gets written down: numbers whose source could not be established, controls with no owner to be found, feeds whose lineage stopped halfway. The record of what defeated the work is the honest edge of the map, and a map without one is claiming a completeness nobody has ever achieved.

Second, and this is the part that matters: a finding that sits outside the scope drawn still has to be considered for the conclusion. At this bank the collateral valuation control failed. The control did not operate for 11 working days, 340 loans were wrongly marked, and no monitoring control detected it. The failure sits in PR3, outside the assessment's scope. A scope decision bounds what was tested and it does not bound what is relevant, so a conclusion that ignores the failure because of where the scope line happened to fall is a conclusion about the scope rather than about the controls.

What do the seven steps produce when they run on one number?

The whole walk sits in one table, on one number, at one bank. The right-hand column answers a single repeated question: what did this step add that the previous step could not have given?

The map does not end in a verdict. The end product is a chain: a valuation feed, a mark on the secured book, a provision, a reported number, and one control standing in the middle of it inside a process the scope had excluded. The failed control affects the valuation of Rs 8,640 crore of secured advances, 15.0 per cent of net advances of Rs 57,600 crore and 9.0 per cent of total assets of Rs 96,000 crore. Both bases are stated. The same rupee figure means two very different things depending on which one is the divisor.

And here is the number the map does not produce. Nothing in these seven steps says what the provision should have been, and nothing in this bank's twelve month record supports a figure for it. The map says where to look. The map does not say what would have been found.

What decides whether a line is in scope, and what happens when size decides it?

Every assessment has to draw a line somewhere, and the most common way to draw it is on size: a materiality cutA line drawn to decide what is in scope, which is a judgement rather than a fixed figure. expressed as a share of the balance sheet, applied to the reported balances, with everything above it in scope and everything below it out. A size cut takes one line in a scope memorandum. Nobody argues with it. No cut looks more defensible.

Rank this bank's locked balances as shares of its Rs 96,000 crore of total assets and the ladder is exact. Net advances of Rs 57,600 crore is 60.0 per cent. Investments of Rs 26,400 crore is 27.5 per cent. The Rs 8,640 crore of secured advances the collateral control marks sits inside net advances rather than beside it, and is 9.0 per cent. Cash and balances with the Reserve Bank of India of Rs 4,800 crore is 5.0 per cent. Other assets of Rs 3,600 crore is 3.75 per cent. Balances with banks and money at call and short notice of Rs 2,400 crore is 2.5 per cent. Fixed assets of Rs 1,200 crore is 1.25 per cent. The provision held against non-performing advances of Rs 1,200 crore is also 1.25 per cent. And the standard asset provision of Rs 494.4 crore is 0.515 per cent.

Now walk a cut down that ladder and count what it lets in. Above 60.0 per cent, nothing is in scope at all. At 60.0 the count is 1, at 27.5 it is 2, at 9.0 it is 3, at 5.0 it is 4, at 3.75 it is 5 and at 2.5 it is 6. Then it goes to 8. Two of this bank's balances are both exactly 1.25 per cent of total assets, so they enter together and no cut anywhere on the ladder ever produces a count of seven. The ninth and last line to enter is the standard asset provision, at 0.515 per cent, and it is the only line the failed collateral valuation control actually moves.

What does this method not do?

Three honest limits, and stating them is part of the method rather than an apology for it.

The method cannot give the size of an error. Nothing in the seven steps produces a rupee figure, and this bank's twelve month record holds no misstatement figure at all. The map produces a location.

The method cannot rank two controls that feed the same number. If a provision depends on both a valuation and a classification, mapping puts both on the map and says nothing about which one carries more of the weight. The ordering, where it can be done at all, comes from testing and from judgement, not from the map.

And it produces no conclusion of its own. Mapping locates the control that stands between a source and a number, and whether that control worked belongs entirely to the testing method that follows this one. A finished map is not a finished assessment. A finished map makes an assessment possible to draw honestly, a smaller claim than a conclusion and a more useful one.

Who actually picks this map up, and what do they do with it?

Three readers, three different uses, and none of them is reading it for the same thing.

An independent director on the audit committee reads it for the fifth field. Rustom Batliwala, the head of internal audit at this bank, reports to that committee, and what a committee member cannot get from anywhere else in the pack is the boundary: how much of the institution the conclusion actually covers. Everything else in a control assessment can be re-derived from the testing. The exclusions are a record of a decision made before the evidence existed, and nothing recovers them. A committee member who reads only the inclusions has read a document that cannot tell them what it does not say.

The chief financial officer, Vivek Anantharaman, reads it as a list of the things that could make a figure he signs be wrong, ordered by how far they could move it. The ordering is different from the one a balance sheet gives him, and the whole value of the backwards method is that it produces exactly that ordering as a by-product rather than requiring a second exercise.

A credit analyst at another institution, looking at this bank as a counterparty rather than as an employer, reads it for one thing only: whether the map covers the processes where the institution actually takes risk, or only the process where it writes the numbers down. An assessment scoped onto the reporting process alone tells an outside reader that the reporting was assembled carefully and tells them nothing whatever about whether the inputs were right.

The mechanism does not change with scale, so take the household version again. A person checking whether the interest on a loan statement is right can audit their own arithmetic all day and never find the error. The error is in the rate that was applied upstream. The map that helps is the one that starts at the figure on the statement and walks back to whatever decided it.