Policies, Procedures, and Internal Controls
Policies, Procedures, and Internal Controls
Policies state what the firm requires and why; procedures state how it is done, by whom, and when. Candidates must distinguish the two and understand the lifecycle: drafting, review, approval, communication, training, testing, and periodic refresh. A common trap is a policy that is technically compliant but not operationalized: no owner, no procedure, no evidence of execution.
Understand control types. Preventive controls stop an issue before it occurs (pre-approval, segregation of duties, screening); detective controls identify it afterward (reconciliation, monitoring, exception reports); corrective controls fix it (remediation, disciplinary action). Manual versus automated controls differ in reliability and testing approach. Questions often test segregation of duties, maker-checker arrangements, and four-eyes review.
Know the elements of a well-designed control: a clear objective, a named owner, defined frequency, documented evidence, escalation paths, and a link to the risk it mitigates. A frequent trap is confusing evidence of a control with the control itself.
Policy exceptions are a rich source of questions. Exceptions should be documented, time-bound, approved at the right level, and reported to governance forums. Unmanaged exceptions become de facto policy changes.
Worked example / rule of thumb: Before approving a new policy, verify it answers: who owns it, what risk it addresses, how compliance is evidenced, how exceptions are handled, and when it is next reviewed. Rule of thumb: if you cannot describe the evidence a control produces, it is not testable and likely not effective.
Expect questions on policy hierarchy, conflicts between policies and regulation (regulation prevails), and the need to update procedures when regulations change.