Complex, Excessive and Costly to Implement:  These are the words most often heard in the same sentence with words like Sarbanes-Oxley, HIPAA and other government regulations.  The pendulum has swung from too few controls towards too many controls in organizations rushing to meet various regulatory guidelines. So much so that companies, faced with the mounting cost of compliance, are choosing to ignore the regulations opting instead to pay the fines if discovered and imposed.  The courts are seeing the picture quite differently, though, and choosing to levy hefty fines once the infraction is uncovered.  Not being in the know can result in fines, lawsuits, and other negative outcomes.

This is all being driven by a lack of understanding of internal control requirements and a large dose of fear relating to regulatory compliance. Fact is: All controls put in by any group must be grounded in an understanding of the risks to the organization both within the operating unit, as well as holistically.

Internal controls are normally put in place to create reasonable assurance that goals of the organization are appropriately pursued within the constraints of company mandates, regulatory requirements, and so on. Underlying this is the basic premise that controls exist to manage risk. It’s important to remember that the primary goal is not to completely eliminate risk. Rather, the main thrust is to mitigate a given risk to an acceptable level in the most cost-effective, efficient and sustainable manner.  Instead, the overall cost must be considered relative to the amount of risk reduction achieved. Additionally, the total costs and benefits must be considered not just at the point of implementation, but over time as well.