How to Assess Internal Controls: A Risk Framework

One of the primary responsibilities that governmental Chief Financial Officers (CFOs) are often tasked with is to ensure the adequacy of the government’s internal controls. But governmental operations are large, complex, and continually changing because of staff turnover, technology improvements, changing regulations, and new programs/services. 
​So how does a CFO know whether internal controls are adequate?

The best way to assess the adequacy of internal controls is to first identify the largest risks to the government. These are unfavorable things that, if they occurred, would have a huge negative impact on the government’s finances and/or ability to provide services. 

You can view this Generic Risk Framework which may help you begin the process of identifying your government’s primary risks (click this link to view and download the framework in editable Word format). The risk topics listed in the generic framework can be used to brainstorm risks specific to your government.

In tailoring the generic risk framework to your government, it is helpful to think about risks in the following categories:  

• Strategic risks: risks that failed business decisions may pose to the government.
• Operational risks: risks related to organizational inefficiency or ineffectiveness, including implementation of processes and response to external issues (e.g., weather problems, government regulations, political and environmental pressures).
• Financial risks: risks that relate to losing financial resources or incurring unacceptable liabilities.
• Information risks: risks related to the failure of information systems or the misuse of information.

Once your management identifies the major risks, specific groups of employee experts should be asked to validate that all risks have been identified. These groups can also help your management rank all risks based on their likelihood of occurrence and the potential damage they might cause.

Starting with the highest-ranked risks, management should determine whether controls that are already in place are adequate to lower the risk to an acceptable level. If they are not, appropriate action plans should be developed to further mitigate the risk to a more acceptable level.
​

The risks can be managed in various ways:

• Avoiding the risk
• Implementing effective internal controls
• Sharing the risk
• Accepting the risk (see our blog post Conducting a Risk Assessment for further discussion of the risk assessment and management process).

---

If you have more questions about the Generic Risk Framework or how to assess your government’s internal controls, feel free to reach out to Kevin directly:
​
Kevin Harper, CPA
[email protected]
(510) 593-503