Internal control • 6 min read

How to get started with internal control

All Blog Cases
|By topic

Where do you begin working on internal control when there aren’t any structures in place? How do you pick up the thread when the process has lost momentum or even come to a complete standstill? To help you and your organization get on the right track, we’ve put together some of our top tips to make sure the auditors rejoice every time they visit. 

Step 1

Develop a clear, simple process

Unfortunately, work on internal control is viewed by many organizations as difficult and as something that has to be done on top of regular work. But like many other things, it always comes down to processes and procedures.

Produce clear steering documents

Make sure that your steering documents are crystal clear and easy to understand. Avoid vague formulations and break down complicated processes to a granular level. 

Set clear expectations

Use an annual activity cycle! This is an excellent way to break down all activities to be carried out during the year and visualizing them for the whole operation. Clarity and simplicity create peace of mind. 

Be precise with your definitions

Create a glossary! This makes it easier for your whole organization to speak the same language and ensures that everyone knows what is meant by risks, reviews, measures, etc. 

Get an overview and greater transparency with a digital tool

Collecting all information in one place makes it easy for different areas of the organization to learn from each other! This also helps you avoid reinventing the wheel over and over again.

Integrate internal control with business planning

Make sure that everyone is working together! Integrating work on internal control is a smart way of making sure that it isn’t viewed as a parallel process and doesn’t end up getting sidelined by “real” work.


Step 2

Have a clear plan for your change process 

A change process requires a lot of energy. Having a clear plan and structure for where you want to go and how to get there is half the battle.

Develop a realistic vision

Create a clear and realistic vision: “Where should our internal control work be in 1, 3 and 5 years’ time?” If the whole operation has a shared set of objectives, it will be easier to bring everyone onboard.

Explain the reason for the change

If you’re unable to explain why internal control adds value, the organization won’t be able to either. Find your specific reason! 

Communicate, communicate and communicate with your employees

Employees are less likely to embrace change if it comes out of the blue. A good rule of thumb is to communicate at least twice as much as you think is enough. This is especially important before and in connection with new working practices. 

Delegate responsibility for the work

Make sure that at least one central person and one representative of each division serves as a knowledge leader with responsibility for driving the work forward. Nothing just happens on its own – especially internal control.


Step 3

View internal control as part of your systematic improvement process

A great deal of what you already do in the operation can be classified as internal control. As you no doubt already know, the aim is to base your work on the most significant risks and to find ways of managing them before they happen. This process involves creating an overview and being sure that the operation is well-organized, and then building on that.

Many companies and organizations make the mistake of focusing solely on the review itself – remember that the process of systematic improvement in the organization accounts for most of the work. Only once this has been done is there anything significant to review.

Step 4

Finally – be realistic with your ambitions 

If you’re not used to structured internal control work, remember that internal control is a marathon, not a sprint. Change takes time and ingrained working practices won’t change overnight. 

Begin with more modest expectations – e.g. that each organization has to analyze its risks and restrict itself to selecting the five most important risks. Plans can then be drawn up to deal with just these five risks – for example, through control and improvement measures. Raise expectations for the next year.

One final tip!
A small step forward is far better than a giant leap that is never actually attempted. 


We'd love to tell you more!