The fact that internal controls have to be effective is something we learned from Sarbanes-Oxley. The first step is control design. The design, to alert management when exceptions occur, when done properly, will include preventive controls to preclude undesirable activities and detective controls. An appropriate design of preventive and detective controls is critical, but not sufficient. Control environments are dynamic. Changes in the business often result in workload shifts. When this happens, to make the work load more equitable, roles and assignments are informally swapped. The control design is often unintentionally compromised, sometimes with significant consequences, as informal process changes evolve.

An Accounts Payable Manager, for example, has the responsibility to review all vendor master file changes before payments to vendors are made. She may not have the time to review the master file changes and she may not be available when the payable checks are ready, if the Accounts Payable Manager is suddenly swamped with a new system implementation.

It is important to make sure that there are adequate mitigating controls throughout the entire process, when responsibilities are reassigned. Having trusted employees does not always protect against errors or fraud. The Accounts Payable Manager, in situations like this, might assign the vendor master file review to an employee who is responsible for processing checks but does not have system access to enter invoices. Since the responsibilities for invoice processing and vendor change review are segregated, on the surface, this appears to be a viable alternative. However, this informal role change has just compromised the control system.

This is only one example to illustrate how a quick fix may not be in the best interests of the company. Informal reassignments are common as new pressures develop. This is where Vonya Global's internal control consulting service can be utilized. Vonya Global Senior Manager, Janet Hintz, said: "When workloads shift, it is worth the time to review the internal control design in total". "When responsibilities are reassigned it is important to make sure that there are adequate mitigating controls throughout the entire process. Having trusted employees does not always protect against errors or fraud."