After more than 30 years working in the area of good governance and internal control, we see many organisations still struggling to realise the right level of internal control. Many are below the desired level to manage their risks sufficiently, while others are tired of implementing even more controls and see inefficiencies and the cost of control explode. All have one thing in common; they all are still unsure if good is good enough.
This article defines when good is good enough by focusing on the companies’ context. It distinguishes four clear levels of internal control and good governance a company may be in or should try to achieve. We also provide practical guidelines, considerations and models to realise your desired level of internal control and the role the main actors should play. In short, this article provides management and boards, internal control experts, risk managers, compliance officers, and internal auditors a toolbox to realise improvements in their individual functions, whilst having a solid holistic view on good governance enabling the right collaboration between functions.
