Do you agree with the following statement "A poorly designed control that is followed is still better than a well-designed control that's ignored."
How do u approach this question
You need to be a member of Global Risk Community to add comments!
Blog
About Us
The GlobalRisk Community is a thriving community of risk managers and associated service providers. Our purpose is to foster business, networking and educational explorations among members. Our goal is to be the worlds premier Risk forum and contribute to better understanding of the complex world of risk.
- Privacy policy
- Media kit
- Products
- E-Learning
Useful Links
Business Partners
For companies wanting to create a greater visibility for their products and services among their prospects in the Risk market: Send your business partnership request by filling in the form here!
Comments
I think that the instances where a control goes from development to integration in an SOP without optimization revisions are rare.
The resistance to optimization or lack of validation philosophy is the main reason well designed controls are implemented in its totality.
I think the idea that a well designed control that is ignored provides any value is based on the idea that management considers controls when making decisions. If a control has been ignored then it's ignored and of no value to decision makers. It might be valuable to a compliance person who can show it to a regulator and say "see this, we're in compliance". Beyond that an ignored control provides no value to the business and is a waste of money and resources.
Richard Ellis, PMP PRM
http//www.linkedin.com/in/richardellis86
Control and enforcement has to go together to give its desired result. How so ever the well designed control, it may be, poor enforcement will make it ineffective. People will ignore it. Rather people will quote for well designed control, not follow rules and do what they feel like. This is more damaging than poorly designed control coupled with enforcement. This will bring discipline in some areas and people will not take granted knowingly well that it may result in modifying control system
It depends especially for a developing country and at this time and age it would take some time for a "well designed control" to be followed.
No. It would cause the organization to respond in ways that do not lead to improvement, as a steering wheel that causes the vehicle to move in the direction opposite as what is intended. By properly designed I understand that while the control would measure and distinguish productive vs. unproductive activities and results, the implementation of the control is not accepted buy the people who must work with and use it. In that case, improving the implementation is the first problem to solve.
The answer is no. A poorly designed control that is followed is dangerous to the organisation and if a control is well designed, by definition it will be followed, as user acceptance/compliance is one of the key criteria for a well designed control. Therefore, there is no such thing as a well designed control that is not followed.
A poor design control is a "bad idea" and regardless of the improvement over time it will always be a “bad idea”.
Let's assume that a company gauges the progress of a project based on the $ amount spent on the said project. It does not matter how accurate or how fast the $ data reaches management, the risk of mischaracterization does not change much.
On the other side if proper design reviews are implemented and not followed with proper protocol, one can always improve and get better overtime. The issue here than becomes time and the competency of execution. These are elements management can “act on”.
In following a "bad control", people are executing what is asked and reflects lack of knowledge in the management structure. The poor execution of a "good control" reflects challenges in communication, training, and oversight etc, all elements of the day to day operational challenges of a company.
My two cents...
Another take on this is that if the control measure is good but it is not complied with there is no culture of risk awareness in the organization. If the control measure is bad but it is complied with then two possibilities arise
a) it is complied with because it is known to be bad but it suits personal objectives so risk awareness culture is probably bad, or
b) the bad control is complied with because it is not known to be bad and risk awareness culture is good
Of all of the above I would prefer the last-mentioned.
I have to choose I like a poor design better (and a positive attitude / business culture towards control). It is much easier to improve the design, than to improve human behaviour / mentality / attitude.
Couldn't agree more subject to the poor design being sufficient to avoid the losses the control should protect.
-
1
-
2
-
3
-
4
of 4 Next