Policies, Procedures, Processes and Controls (PPPC): One System to Help Effectively Manage Risk in Today’s Challenging Environment
Doing business in China carries with it many risks and many rewards. With a growing economy, competitive productivity and a relatively low cost base, China continues to offer opportunities for domestic and overseas business owners and investors. These opportunities are subject to certain risks in the China market; Market Risk with competition, innovations, price being major factors; Human Risk related to items such as of theft and fraud, Economic Risk driven by potential government policy changes, market and global economics, investigations by outsiders, Management Risk related to incompetence, nepotism and influences, Business Risk surrounding internal controls, suppliers, and logistics, and Legal Risk, over items such as compliance with applicable regulatory and/or governmental rules and regulations, ownership, scope of business, asset ownership, and intellectual property rights.
While an internal control structure cannot entirely reduce the potential effect of each of these risks, a strong internal control system including sound policies, procedures, processes and controls (PPPC) is one way to help effectively mitigate many of these threats to an acceptable level of risk.
Doing an assessment of a company’s most significant risks is the first step in a PPPC risk management analysis. Then a focused examination can be performed to understand the current depth and breadth of their PPPC to determine if the PPPC are designed suitably to address the company’s risks. It’s important to review the current processes as functioning in order to assess and develop best practices in the PPPC system. It’s also important to evaluate the capability of the company resources. Initially, do you have the resources in house that are capable of assessing and managing risk? Once the risk assessment process is initiated, do the people performing the daily tasks possess a suitable skill set considering the complexity of tasks and risks involved?
There is a balance between understanding, identifying and addressing a company’s risks and the adequacy of its PPPC. Careful consideration needs to be made with respect to efficiency and as well as weighing the costs and benefits of suggested improvements to the PPPC system. Developing PPPCs can require significant time and effort. It is just as important to analyze the cost-benefit relationship as sometimes the benefits of additional policies, procedures and controls are outweighed by the cost of developing such PPPC, and organisations should thoroughly analyze and compare them. While it can be difficult to put a monetary value on certain benefits of controls as well as determining the true costs of PPPC, it is important to analyze those as well as the potential losses if those controls are not in place. These are considerations that should be addressed in the initial risk analysis the company undertakes
Lastly, to ensure maintenance of the PPPC system while operating, a company should develop periodic control review processes and establish clearly defined roles of responsibility and accountability.