Start Your Process Flowchart With Risks. The Controls Will Follow.

Back to Topics

When you build a process flowchart for an internal control assessment, such as an OMB Circular A-123 assessment, start by understanding what could go wrong, not by identifying the controls.

Controls exist to address risks. If you start by documenting controls without first identifying the risks, you may capture everything the business already does while overlooking the risks nobody addressed.

Most teams approach this the other way around. They interview the business, draw the process, and mark where they believe the controls exist.

It is like packing for a trip before you know where you are going. The suitcase fills up, but you cannot tell whether you packed what you actually need.

The Green Book establishes the relationship between risks and controls. Principle 7 requires management to identify, analyze, and respond to risks related to achieving defined objectives. Principle 10 addresses the design of control activities to achieve objectives and respond to risks.

Your assessment methodology should follow that logic: understand the process, identify the risks, and then determine which controls address them.

I have used this approach on financial statement audits that included opinions on internal control and on A-123 assessments.

Step 1: Document the Business Process

Start with the fundamentals. Read the policies and procedures, interview the people who perform the work, and walk through the process from beginning to end.

Then draw the process as it actually operates.

Consider timekeeping.

An employee enters time. A supervisor reviews and approves the timesheet. The approved information moves through the appropriate timekeeping and payroll processes, and the payroll provider pays the employee.

At this stage, focus on understanding the activities, decisions, handoffs, and systems involved.

Do not start marking controls yet.

The objective is to establish a clear picture of how the transaction moves through the organization before evaluating what could go wrong.

Step 2: Identify What Could Go Wrong

Now walk through the flowchart step by step and ask a simple question:

What could go wrong here?

Two perspectives can help identify risks:

For example, in the timekeeping process:

• An employee could record hours not worked. (Validity)
• Approved hours could fail to reach payroll. (Completeness)
• Payroll could apply an incorrect pay rate. (Accuracy)
• An approved timesheet could be changed without appropriate authorization. (Validity / Restricted Access)

Mark each identified risk directly on the flowchart.

Use a consistent symbol, such as a red triangle, and assign each risk a unique identifier.

The same symbol should appear in every flowchart so a reviewer can quickly identify where risks occur.

At this point, you are not determining whether a control exists. You are identifying where something could go wrong.

That distinction matters.

Step 3: Map Each Risk to a Control

Once the risks are identified, bring in the controls the business has established.

Match controls to risks, not risks to controls.

For each risk, identify the control activity designed to prevent or detect the issue.

A simple risk-control matrix can document the relationship.

The controls and key/non-key classifications shown are illustrative. Actual classifications require evaluation of the risk, control design, and assessment scope.

The matrix makes the relationship between risks and controls visible.

It also makes something else visible: where the relationship is missing.

Step 4: Read the Map

Once the risks and controls are mapped, the assessment begins to reveal three important conditions.

Risks With No Identified Control

Look at R5.

The risk is that an approved timesheet could be changed without appropriate authorization. No control has been identified to address it.

Does that mean the organization has a control deficiency?

Not necessarily.

The control may exist but was never documented. The system may prevent unauthorized changes, maintain an audit trail, or require reapproval after modifications.

Go back to the business and investigate.

If an appropriate control exists, document and evaluate it. If no control adequately addresses the risk, assess the potential deficiency in accordance with the applicable assessment methodology.

Either way, the risk-first approach has identified an area requiring attention before testing begins.

Risks With More Than One Control

Now consider R1.

Two controls address the risk of employees recording time they did not work.

Does that mean both controls must be tested?

Not necessarily.

Evaluate which controls are necessary to address the risk at the required level of precision.

A single key control may provide sufficient coverage when its design and operation adequately address the identified risk. In other situations, multiple controls may be necessary, particularly when they address different aspects of the risk or operate together.

The objective is not simply to select the fewest controls.

The objective is to identify and test the controls necessary to provide sufficient coverage of the assessed risks.

Other controls may remain documented as supporting or non-key activities, depending on the assessment's scope and methodology.

This approach helps focus testing resources without sacrificing risk coverage.

Controls With No Identified Risk

The reverse situation is equally important.

What happens when the business has a control that does not map to any identified risk?

Ask why.

The control may address an operational or compliance objective outside the scope of the current assessment. It may address a risk the team overlooked. Or it may be redundant.

Do not assume that an unmapped control is unnecessary.

Determine its purpose, evaluate its relevance, and decide whether it belongs within the assessment.

The goal is not to eliminate controls simply because they do not appear necessary.

The goal is to understand why each control exists and what risk or objective it supports.

Why This Matters for Agency Leadership

Risk-based process documentation does more than improve a flowchart.

It helps management determine whether internal controls address the risks that matter most.

A process can have numerous documented controls and still contain significant gaps. Conversely, an assessment can spend considerable time testing activities that provide little additional coverage of its objectives.

By mapping risks before evaluating controls, organizations can better identify coverage gaps, assess overlapping activities, and focus testing resources on the controls necessary to address significant risks.

For agency leadership, that provides a clearer understanding of where control coverage exists, where weaknesses may remain, and where additional attention is warranted.

Start With Last Year's Flowchart

A risk-first flowchart shows what could go wrong, where it could happen, and which controls are intended to address it.

It also provides a more defensible basis for selecting controls for testing.

You do not need to redesign your entire assessment methodology to begin.

This week, select one flowchart from last year's assessment.

Walk through the process, mark the risk points, and map each risk to its corresponding controls.

Then count the gaps and overlaps.

You may discover that the most important part of your flowchart is not the controls you documented, but the risks you almost missed.

The views expressed in this article are those of the author and do not necessarily reflect the views of any employer, client, agency, or organization. Examples referenced are intended to illustrate broader internal control design concepts.