08/24/2026
A Written Procedure Doesn’t Automatically Mean You Have an Effective Control
When I evaluate an operation, one of the things I pay attention to is the difference between what the organization says should happen and what actually happens.
A procedure may be clearly documented.
Responsibilities may be assigned.
Required reviews may be identified.
Everything can look correct on paper.
But the real questions are:
- Is the procedure consistently followed?
- Is someone verifying that it is followed?
- Can the organization demonstrate that verification?
- And when something goes wrong, does the control detect it before it becomes a larger problem?
That distinction matters.
A procedure tells employees what should happen. An effective internal control provides reasonable assurance that it is happening.
This is why reviewing documentation alone rarely tells me everything I need to know about an operation.
I also want to understand how the process works in practice, where accountability exists, what evidence is retained, and how leadership knows the control is functioning as intended.
Through Secure Mail Consulting, LLC, this policy-to-practice evaluation is an important part of how I approach operational controls and readiness assessments.
A question I encourage leaders to ask:
Which of your critical procedures can you demonstrate are working—not simply show that they are written?
