Public Internal Control Systems

in the European Union

Continual organisational improvement
by integrating Internal Control into
the management cycle
Discussion Paper No. 2
Public Internal Control
An EU approach
Ref. 2014-2

Continual organisational improvement by integrating Internal Control into the

management cycle

Developing an Internal Control system is an iterative process that involves improving

performance and governance, rather than introducing a new, additional system.
Internationally recognised or national standards and frameworks offer common points of
reference regarding trends in modern management and provide a comprehensive,
structured approach to Internal Control. In this paper, the integration of the
management cycle and the Internal Control system is illustrated by Demings framework
(plan, do, check, act), which emphasises the principle of continual improvement.

TABLE OF CONTENTS
1.

INTRODUCTION....................................................................................................... 3

2.

KEY ASPECTS OF INTERNAL CONTROL IMPROVEMENT ............................. 3

3.

THE MANAGEMENT CYCLE ................................................................................. 4

4.

RELATION/INTEGRATION OF THE INTERNAL CONTROL SYSTEM

WITHIN THE PDCA MODEL................................................................................... 5
4.1. Phase 1: Plan...................................................................................................... 5
4.2. Phase 2: Do........................................................................................................ 6
4.3. Phase 3: Check .................................................................................................. 6
4.4. Phase 4: Act....................................................................................................... 7

5.

CHALLENGES........................................................................................................... 9

1.

INTRODUCTION

The aim of this paper is to provide short and practical guidance on how to integrate
internal control into the management cycle. This concept has been taken as a starting
point for further discussion on challenges and good practice examples in this area within
the Member States.
Most Member States have put in place reforms to improve management in the public
sector. Their initiatives were usually linked to the introduction and promotion of the
Public Internal Control (PIC) system. They are focused on implementing basic
principles, including an internal control model based on internationally-recognised
frameworks and standards. In most cases, national internal control systems are directly or
indirectly based on the COSO1/INTOSAI2.
Currently, an important consideration is how to improve the functioning of the internal
control system in the most cost-effective way.
2.

KEY ASPECTS OF INTERNAL CONTROL IMPROVEMENT

Public sector entities are set up to reach objectives and fulfil tasks described in the
regulations, usually related to delivering service to citizens in certain area. An internal
control system is designed to support the head of a public entity in managing operations,
carried out to achieve the organisations objectives, in particular, in a cost-effective
manner.
The internal control system should help to achieve the organisations objectives and to
manage its activities in a more efficient way on each level of the entity. Developing an
internal control system at entity level should not lead to extra administrative burdens.
Existing structures should be assessed, and they should be integrated into control
mechanisms according to identified needs. The challenge for heads of public entities is to
find the best way to improve current systems, taking into account the cost of control
measures.
The following points need to be considered:
Entities with a less developed internal control system should first focus on the
basic preconditions for any internal control system, in particular, a sound internal
control environment.
All entities have elements of an internal control system and most stages of the
management cycle in place. Now these need to be structured, formalised and
improved in accordance with identified needs and cost considerations.
The internal control system should not function separately from existing
operations within the organisation. The internal control system should be
integrated within the management cycle as well as on the operational level.
1

Internal Control Integrated Framework developed by the Committee of Sponsoring Organizations of

the Treadway Commission

International Organisation of Supreme Audit Institutions

3

Developing an internal control system is thus an iterative process that involves

continually improving performance and governance, rather than introducing a new, extra
system. Internationally-recognised or national standards and frameworks offer common
points of reference within trends in modern management and provide a comprehensive,
structured approach to internal control.
3.

THE MANAGEMENT CYCLE

A public entitys scope and activities are determined and influenced by factors such as:

political strategic goals

annual policy priorities

resource limitations

reporting obligations.

Whatever the organisation, the head of an entity typically manages available resources to
meet stakeholders expectations in the most effective way. The head of an entity is also
responsible for:

evaluating what was accomplished against what was planned,

taking action to improve the situation,

anticipating changes and possible new risks.

The integration of the management cycle and the internal control system is illustrated by
Demings framework, featuring the principle of continuous improvement.

Figure 1: Integration of the internal control system within the management cycle based on the Deming
cycle. Taken from the Practical Guide for the Development and Maintenance of an Internal Control System
by the Belgian Public Federal Service for Budget and Management Control.

The Deming cycle consists of four phases:

Phase 1

Plan (establish baselines for the organisation, setting objectives and

measurements);

Phase 2

Do (implement actions to achieve objectives);

Phase 3

Check (monitor, measure and document results);

Phase 4

Act (improve, evaluate, apply lessons learned, modify as necessary).

The PDCA model enhances the continuous and dynamic process of the management
cycle focusing on continuous improvement during the execution of activities.
4.

RELATION/INTEGRATION OF THE INTERNAL CONTROL SYSTEM WITHIN THE PDCA

MODEL

Below is a description of how the main elements of an internal control system could be
related to PDCA phases, pointing out important aspects that could be taken into account
at each stage.
4.1.

Phase 1: Plan

Management cycle:

Objectives are defined and turned into clear, measurable goals.

Processes and projects are rolled out to achieve these objectives.

Resources are defined and responsibilities are assigned.

In public services, tasks and strategic objectives do not change greatly over time, but
annual objectives may change to meet current priorities or to deal with new challenges
and stakeholder requirements. This may, for instance, involve finding ways to improve
effectiveness and efficiency.
Internal control:

New processes are described and existing ones are updated if necessary.

New measures are developed, based on a risk analysis, and existing measures are
refined.

Indicators (such as Key Performance Indicators) to follow the progress of projects

and processes are chosen.

Resources allocated to processes and projects need to be taken into account and
monitored at defined intervals.

Reporting content and frequency are set.

Indicators for follow-up should be aligned to the reporting needs of the executive or the
higher hierarchical level. New measures and indicators can be evaluated ex ante to ensure
5

their effectiveness. Responsibilities are reviewed to check that there is compliance with
segregation of duties.
It should be borne in mind that objectives should be described in SMART concepts
(Specific, Measurable, Achievable, Relevant and Time-bound). All of these requirements
need to be fulfilled to achieve objectives. Objectives should be cascaded to all levels of
the organisation.
4.2.

Phase 2: Do

Management cycle:
The executing phase includes the normal working activities, or the chronological
execution of the processes and the completion of the projects. The manner in which
activities are performed during this phase is critical to the quality of the output and the
amount of input. In other words: the execution determines the operations compliance,
economy, efficiency and effectiveness.
Internal control:
To obtain a good result, a first condition is to follow the procedures and requirements
during the execution of activities. To this purpose, clear guidance and support of the
direct superiors and other management staff are necessary. Measures developed in the
planning phase will be executed along with the activities. During the execution of the
activities, information of the measurement system will also be gathered to be examined
in the analysis phase.
Additionally, the organisation can record all incidents that occur. This process is not
essential but can significantly contribute to identifying the risks and to improve
measurements and realistic standards for performance and other indicators.
In some cases, the organisation or cultural factors are likely to interfere. Controls can be
ignored or even deliberately circumvented by people, and management can override the
internal control system. It is important that the control environment is supported, i.a. the
employees are not blamed for risks reporting. Should the need arise, a program of change
management is a simple technique used to apply transversal changes within the
organisation.
4.3.

Phase 3: Check

Management cycle:
The organisation will regularly examine:

progress in processes and projects

whether objectives have been achieved

use of resources

other factors that may affect the smooth running of the organisation.

During this phase, there is careful examination of partially achieved objectives. This is
part of monitoring by management and is one of the executives tasks.
6

Internal control:
In this phase, descriptions of the process and the preliminary risk assessment prepared
during planning are collated with information gathered during the do phase. This
provides a basis for a thorough cyclical analysis of the results and their related risks.
Information on performance shows whether there were events that made it more difficult
to achieve the desired results, or whether there were factors that enabled good progress.
New risks may arise during the management cycle as circumstances change. This is why
it is important to review the risk cycle periodically.
To manage a risk, it is necessary to address its root cause. If the cause is one of the risk
factors already taken into account, then existing measures should be corrected or
extended. If the problem is new, a new measure to address it is needed.
The information compiled needs to be accurate, relevant and timely. If the description of
results obtained is unrealistic or unclear, this poses a risk for the executive management,
which will have to take decisions based on an unclear situation.
A management gap is not always the result of an operational incident. There may also be
structural causes, such as:

lack of SMART objectives

incomplete measurement system

failure to follow procedures, etc.

In such cases, it may be appropriate to focus on improving the formulation of objectives,

relevant Key Performance Indicators (KPI), staff accountability, etc. During the next
planning phase, it may be appropriate to reformulate objectives, adjust the measurement
system or carry out a project to inform staff about what is expected of them.
4.4.

Phase 4: Act

Management cycle:
Based on the collected information, decisions are taken to overcome problems or to
exploit opportunities. The manager will take actions to minimize the impact of
unexpected events to bring things back on track to the desired goals and this as quickly as
possible. Management will take into account the costs and benefits of the measures when
taking decisions.
Internal control:
Appropriate control activities will be defined, based on information gathered during the
check phase, in which the underlying causes of problems are identified. These activities
will take into account efficiency and effectiveness and the impact on the rest of the
organisation.
If management is willing to introduce new measures to address problems, this raises staff
awareness and keeps them prepared to deal with difficulties. Implementing measures
may simply involve small improvements or instructions, or may require significant
7

changes in activities. Objectives may even be redefined, or new objectives introduced,

leading to a new cycle.
New measures may be tested and evaluated ex-ante. This may be useful in particular
when the measures have an effect throughout the organisation. Some measures may yield
good results in solving a problem, while having a negative impact elsewhere, thus
creating new risks or reinforcing existing ones.
If a risk concerns the entire organisation or a substantial part of it, it should be dealt with
at organisational level. This may mean taking relevant information into the next planning
phase and defining a new project, or adjusting plans to redirect staff towards new goals.
And up to the next cycle:
During the next management cycle, results and risks will again be analysed to assess
whether measures intended to bring about improvements were successful and projects
implemented. It may also be useful to evaluate existing measures to check whether they
are still relevant and efficient.
Public entities are under considerable pressure to work more efficiently and obtain higher
levels of effectiveness. Objectives are defined by political choices. As a consequence,
objectives will have to be reviewed or refined regularly, and this will lead to the start of a
new management cycle. The timing of reviews may also be triggered by other factors, for
instance, a new management plan, the appointment of a new manager, or budgetary
restrictions.
The management cycle recurs naturally. Documenting its various stages is a challenge. A
well-structured approach will yield reliable information, which supports solid decisionmaking and management and may ultimately improve the way in which an organisation
functions.
If objectives are refined or reoriented, this may lead to new risks that require new
measures to mitigate them. So, along with the management cycle, there will be an impact
on internal control, this process being integrated into day-to-day activities. For each loop
of the management cycle, proper monitoring and reporting should systematically be
refined.
Tools and sources of information regarding Internal Control:
Internal control should lead to integration and better use of all information and tools
available in an organisation, without creating parallel systems that may lead to
duplication of work and waste resources.
National development plans, strategic plans, annual management plans, and operational
programmes are useful sources containing information on objectives, activities, risks and
deliverables. Moreover, information such as audit reports can draw attention to areas in
which adjustments should be made.
There are many tools and frameworks offering basic principles and guidelines for
different aspects of internal control (e.g. ISO 31000 for risk management and COSO
ERM). A specialist application or software to gather data on risk identification can help
to structure the risk process. The Balanced Score Card or other performance
measurement tools can help to gather useful information on the progress of activities.
8

The combination of PDCA and an internal control system can help to reduce
management gaps and enable an organisation to develop on the basis of feedback
received on activities and results. A structured approach offers the prospect of better
performance as the achievement of objectives is continually monitored, in conjunction
with the use of resources.
5.

CHALLENGES

(1)

What are the different roles and responsibilities of the various actors in the PDCA
cycle (senior management, management and operational level)?

(2)

What factors could hamper the implementation of the PDCA/IC integration

approach?

(3)

What are the proper settings for such an approach to gain its full benefits?