Audit committees and the human side of operational risk
Ask whether important controls remain reliable under actual staffing and workload. A procedure can exist without enough capacity to perform it.
The performance question
Operational assurance can miss the conditions under which a control is applied. Repeated overtime, vacancies or rushed handovers may make the intended process difficult to follow. The committee should examine implementation through its remit without taking over routine management.
What the evidence supports
FRC Principle O and Provision 29 address risk management and control monitoring, including material operational controls. HSE describes excess workload as a contributor to slips, lapses and mistakes. This supports investigating human demands around a control rather than assuming documentation equals effectiveness.[1][2]
A practical approach
Select a material control and ask internal audit to examine actual use during normal and peak conditions. Include task demands, competence, cover, evidence quality and exception handling. Consult those who perform the control and recommend changes to management where capacity or information is insufficient.
How to review progress
Track whether agreed changes were made and retest the affected control at a proportionate interval. Distinguish an isolated error from a recurring design weakness. Do not generalise a sampled finding to every employee or attribute every control failure to stress.
Sources and references
- UK Corporate Governance Code 2024 Opens in a new tab
Financial Reporting Council
Application; Principles A, E, F, I, J and O; Provisions 2, 5, 6, 17, 28 and 29
- Human factors: Workload Opens in a new tab
Health and Safety Executive
Processing limits, task analysis, workload drift and staffing