Green dashboard, missed permit filing
GreenArc Energy has 900 employees and operates 14 regulated sites. Its compliance dashboard reports training hours, number of policies issued and total incidents; all three indicators have improved for six quarters and the board sees a one-page 'green' summary. Last month the environmental regulator issued a notice because a permit renewal was filed 11 days late. The compliance calendar was a spreadsheet maintained by one specialist who was on leave; no backup existed. Internal audit is outsourced and has covered only financial controls; there has been no audit of the CMS in two years. Management review is held once a year for 45 minutes, dominated by incident counts, and the prior review produced no recorded actions. The compliance officer reports to the COO, who also owns the operations that create the largest environmental risks. The board has asked why the dashboard did not predict the failure.
1. Critique GreenArc's monitoring, measurement and internal audit arrangements. What is missing, and why did the indicators fail to provide early warning?
Read the worked answer
The dashboard measures activity and outcomes, not control health. Training hours and policies issued are inputs, and total incidents can fall while near-misses and high-risk exposures rise. There are no indicators for compliance obligations, control effectiveness, regulatory change, third-party risk, corrective action or permit deadlines. The permit failure was predictable: a single-person spreadsheet with no backup is a control design weakness, and no monitoring tested the calendar's reliability. Internal audit covers only finance, so the CMS has no independent assurance. Management review is too short, lacks required inputs and produces no decisions, so it cannot drive improvement. The compliance officer's reporting line to the COO compromises objectivity for environmental risks. The board's green summary is therefore not decision-useful. Monitoring should cover compliance status, control performance, risk treatment, incidents and near-misses, regulatory developments, and assurance results.
2. Propose a balanced set of compliance indicators and data-quality controls. Include both leading and lagging measures and explain how each would be used.
Read the worked answer
Leading indicators: percentage of compliance obligations mapped to an owner and control; percentage of high-risk controls tested with acceptable results; permit and filing deadlines met; regulatory changes assessed within 10 working days; high-risk third-party reviews completed; corrective actions closed on time; near-miss reports per 100 employees; speak-up reports and time to triage. Lagging indicators: reportable breaches, fines, regulator findings, repeat findings, incident severity, and losses. Data-quality controls: a named owner and backup for each register; monthly reconciliation; evidence sampling; defined thresholds and escalation; dashboard definitions and source systems; and a data-quality review before board reporting. Each indicator should have a target, tolerance, owner, frequency and defined action if breached. The board summary should show red, amber and green status with trends and exceptions, not just a composite green.
3. How should management review and assurance reporting be redesigned so that the board receives credible information and corrective action actually happens?
Read the worked answer
Management review should be scheduled at least annually with a structured agenda: status of actions from previous reviews; changes in context and obligations; compliance risk assessment results; control and monitoring results; incidents, near-misses and investigations; audit findings; resource adequacy; interested-party concerns; and improvement opportunities. It must produce decisions on resources, risk treatment, objectives and improvement, with owners and dates. The compliance officer should have a reporting line or direct access to the audit committee or board risk committee, separate from the COO's operational accountability. Internal audit should be risk-based and cover the CMS, with an audit plan approved by the audit committee; outsourcing is acceptable if independence and competence are assured. The board should receive a balanced report with exceptions, assurance coverage and open actions. Corrective action should require root-cause analysis, not just a fix for the missed filing; in this case, the single point of failure and absence of backup should be addressed systemically.