The Power of a Checklist for Internal Controls

by
Brenna O'Hara
November 2, 2015

A checklist is often seen as a user’s guide that creates robotic employees who mindlessly carry out tasks. Wrong. A checklist is not a sign of weakness nor does it indicate a lack of expertise. A checklist is designed to act as a reference in high-risk situations requiring controls because no one is perfect 100% of the time.

A high-risk situation can occur in any process, from maintaining critical aircraft equipment to generating accurate financial statements. Failure in each could lead to catastrophic consequences. A checklist of critical policies could prevent an aircraft from crashing or improperly reported income on financial statements.

When designed and implemented correctly, a checklist can reduce errors in the workplace that range from miniscule to disastrous. Companies wishing to take advantage of checklists should follow in the footsteps of the aviation industry—one of the first industries to fully utilize a checklist's power.

Carefully consider audience, content, and design when creating a checklist.

Consider the Audience

Designing an effective checklist requires a clear understanding of two things: end-to-end processes and all the people involved in those processes. Understanding the end-to-end process is easy. Information can be gathered through basic observation and interviews. However, creating a checklist without direct input from end users can cause missed steps and could end up being worse than ineffectual—it could actually create problems.

A pilot’s checklist that doesn't include coordination with air traffic control, flight attendants, and ground personnel would create chaos. The same is true of checklists that monitor high-risk business processes or a company's internal controls.

Communication throughout the processes is key to developing a checklist that everyone will use. End-user training should not be the first time employees hear about new procedures.

Define the Right Level of Detail

The level of detail can quickly ground a checklist before it takes off. A checklist that is too vague or too detailed will be misunderstood or overwhelming. A checklist should be precise and simple. The right level of detail ensures repeatable success.

There are two basic types of checklists. The first is called a do-confirm. Once a task is complete, the user references the checklist to confirm the steps were done as intended. In this scenario, the user is acting upon experience and the checklist is a simple reminder. For example, a supervisor may review a process to ensure proper segregation of duties occurred before a journal entry was posted in the system.

The second type of checklist, a read-do, is for rare or more critical events where steps may be unfamiliar and, if skipped, can be costly or harmful. Considering the criticality and familiarity of events will help organizations decide on the right type of checklist.

Personnel should be performing self-testing on a regular basis to support a robust internal controls environment. A COSO framework-based checklist can be used to ensure proper evaluation of internal controls.

Determine the Optimal Structure

The organization and structure of a checklist is critical. A good checklist will have 5-9 major points. If there are more than nine items, the list will seem too lengthy to use. If there are fewer than five points, the user may not have enough information.

The second key to mapping out a good checklist is locating and placing the pause points. This is the moment when users stop to reference the list, whether to confirm their recent actions or to see what steps are next. Deciding when and where to put the pause points is almost as critical as the content itself. If there are too many pause points, the checklist won't flow. If there are too few, the likelihood of missing steps will increase.

The aviation industry started a phenomenon by championing checklists in the workplace. Pilots use checklists daily because they work and help prevent potential disasters. The same can be said for internal control checklists, as a misstatement or audit note may have significant negative impacts on the business. In extreme situations, this could include depressing stock prices or overhauling current management.