I strongly believe in a matrix where the potential impact to the business /
department is reflected against the likelihood of it occurring. This way
the significance is not only financial but all of the key measures that you
mentioned in your e-mail.
For example:
Likelihood H * 2 | 1
* |
*----------
* 4 | 3
* |
L ************
H
Significance
Items classified as a 1 (High likelihood and high significance) being
classified as a critical issue which requires immediate (re)action from
Management.
Items classified as a 2 (High likelihood but low significance) being
classified as an issue of a lesser critical nature (requiring monitoring
controls and process improvement).
Items classified as a 3 (Low likelihood but high significance) being
classified as an issue of a lesser critical nature (requiring monitoring
controls to ensure that the controls stay in place and that the issue does
not change a to a more prominent quadrant).
Items classified as a 4 (Low likelihood and low significance) being
classified as an issue of a least critical nature. For example housekeeping
related.
Perhaps a good exercise would be to rate the issues as per the above matrix
(reviewing no controls) and then comparing it to the above matrix
considering all the controls).
Then the Board perhaps can discuss issues that are in the quadrant 1,
instead of only legal, financial, etc. matters. If these matters that they
were discussing previously were of significance then they will be discussing
them now as well.
Please do not hesitate to contact me if you have any questions or queries.
Regards,
Corn� van Rooyen
Internal Auditor
International Healthcare Distributors (Pty) Ltd.
Office: +27(0)11 458 2402
Fax: +27(0)11 458 2680
Mobile: +27(0)83 303 3258
E-mail: [EMAIL PROTECTED]
-----Original Message-----
From: Clayton, Daniel L. [mailto:Daniel.Clayton@;dhha.org]
Sent: 30 October 2002 11:13 PM
To: [EMAIL PROTECTED]
Subject: Looking for Definition of "Critical Issue"
Anyone who can help,
Our Board recently challenged our classification of what is a
"critical issue." They believe their roll is strictly related
to dealing with "material impacts of a financial or legal
nature." To me their approach is too related to external audit.
I disagree with their definition. When a significant internal
control is missing it can also be classified as "Critical"
without quantifying a financial or legal impact.
For example, if metrics governing employee performance in a
critical billing follow-up function give employees incentives
to defer or delay issue resolution, result in perpetual
errors, inefficiencies, and an unquantifyed financial impact,
we find that to be a "critical issue." However under our
current process our Board defines that issue as a medium risk
and a need for process improvement. The only difference I see
is that we have not taken the time to quantify specific
financial losses due to the scope of the review.
Many things lead to financial and legal exposure:
* Weak governance
* Missing controls
* Poor training
* inefficient processes
* understaffed areas
If anyone can share how they define a "critical issue" that
should be addressed by the Board, I would be very interested in
your definition.
Thanks for any help.
Dan Clayton
303 436-8821
Internal Auditor, CPA
Office of Integrity
DHHA
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
To unsubscribe from this list send an email to
[EMAIL PROTECTED] and include the message unsubscribe
auditprograms-l and your name.
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
To unsubscribe from this list send an email to [EMAIL PROTECTED] and include
the message unsubscribe auditprograms-l and your name.
