Government contractor controls: Strategy for now and beyond

Responding to change enables continued compliance

Government contractors face a laundry list of regulatory requirements, constant scrutiny and audit pressures. As a result, maintaining and monitoring controls is critical to ensuring that established control frameworks are operating correctly and reflect the requirements of the organization’s current contracting environment. Maintaining internal controls is a process that evolves constantly throughout the organization’s lifetime. A government contractor’s work on controls doesn’t end with the implementation of a high-quality, integrated control framework. Continued compliance and operational effectiveness depend on the organization’s ability to monitor established controls and adapt and update those controls with its changing environment.

With decentralized monitoring, various stakeholders throughout an organization are responsible for monitoring controls in their own area. It’s more common in complex organizations with multiple segments, and it may require centralized verification by internal audit or corporate compliance. Putting control in the hands of multiple owners may lead to inconsistencies, so it’s important to design accountability at the control owner level into the monitoring program.

Automated or manual monitoring: It is also possible in many areas to set up automated control monitoring, such as dashboards with key performance indicators (KPIs) and alerts when anomalies occur. But to enable this, an organization needs the right digital data and automation capabilities, which can often be costly to design and implement.

Manual monitoring requires continuous time investments from stakeholders and their teams. However, manual monitoring can be more flexible as organizational needs change. 

Choosing the right path

It’s important to choose monitoring mechanisms and activities that are the best fit for a given organization’s culture, design and capabilities.

Government contractors can effectively monitor activities by:

• Using internal control matrices from the implementation roadmap and control design documentation to identify and develop required monitoring activities.
• Developing a deep technical understanding of control requirements in order to take a risk-based approach to establishing monitoring activities, tackling monitoring processes for riskier controls first and phasing in monitoring for less risky controls.
• Identifying internal control KPIs and creating KPI data capture methodologies. Assigning responsibilities for monitoring KPIs and datapoints is critical when decentralized approaches to monitoring are used.
• Making early and repeated efforts to engage and leverage internal knowledge and resources, including the control owners, participants and departments that are affected by the internal control.
• Engaging subject matter experts where necessary for verification, follow-up and interpretation of information.
• Treating monitoring as a long-term commitment that will improve over time.

For all controls, early detection of failures or anomalies is critical to managing risk. Early detection can ensure that a control failure does not spiral into a larger issue for the organization. As an example, if a bill is generated by mistake that would cost a customer (or the government) money, it will not cause much damage if it’s caught early and corrected. If it is discovered much later, investigations for false statements or false claims may require teams of lawyers and consultants to fix an unintentional failure.

“Something will go wrong,” Fultz said. “But ideally, you know about it real-time, and you deal with it from an operational standpoint and not through the regulatory investigative process.”

Promote scalability and sustainability

As organizations pursue excellence in control compliance, the best monitoring activities are scalable and sustainable, with a culture of accountability and stakeholder involvement delivering measurable results. A cadence for monitoring is developed with clearly defined processes, and results are retained over time.

In an ideal monitoring system, the owner is accountable to management or another authority, and stakeholders feel comfortable providing feedback — both positive and negative — about the process. It is important that organizations pursue cultures where employees feel unafraid of openly identifying errors and risks. A culture of trust and openness allows for real-time communication and course corrections.

An organization can scale its monitoring processes over time by taking a risk-based approach tailored to its circumstances and tolerance for risk. A scalable plan starts with a small, targeted approach to addressing riskier controls and then expands to cover less critical or lower-risky controls. This approach helps maintain compliance while limiting disruption to the broader organization. Resources allocated to monitoring activities should be continuously assessed and adjusted as monitoring processes scale and change.

To make monitoring activities sustainable, an organization should define roles, responsibilities, scopes and objectives, working with a predetermined cadence to make sure that monitoring is periodic and prioritized. A structure of accountability should be established, with ultimate responsibility resting with senior leadership.

“In some organizations,” Fultz said, “surprises are the standard in the control environment, but if everything is done right and controls are effective, surprises should be rare. Control owners should be readily identifiable to everyone and able to articulate their responsibilities clearly and in the context of the overall process.”

Meanwhile, compliance professionals should be able to quickly report on current-state control results. Accurate descriptions and documentation of all applicable controls and processes should be readily available for internal and external stakeholders, such as the U.S. government or financial auditors.

Keep the future in mind

The overarching key to successful monitoring is to start simple with the goal of more comprehensive future monitoring in mind. The long-term objectives are to implement data-driven controls that can easily be monitored, and add automation to monitoring through dashboards and system alerts.

Automation is not always the right choice in the short term because it often requires costly IT expertise and system reconfiguration. When automation is strategically established as a long-term goal, it can be planned into future IT projects to minimize disruption and costs. The ideal controls to automate in the near term are those that are unlikely to change and where data is readily available from current system outputs.

“Many organizations are having to adapt to more remote work where in-person meetings are limited and communication can be challenging at times,” Fultz said. “This means that automation of controls will be even more important as organizations grow and disperse across the country or the globe.”

Related resource

ARTICLE

Why integrating controls is key for government contractors -->

Contacts: