In every company, alongside automated controls enforced by the ERP system (approval workflows, system-enforced segregation, automated three-way matching), there exist manual controls that depend entirely on a human performing a specific action: reviewing a reconciliation, approving an exception, inspecting a delivery, verifying a calculation, signing a document.
Manual controls are necessary. Not every risk can be mitigated by system logic. Judgment-based reviews, exception handling, complex reconciliation and fraud detection require human intelligence that automated controls cannot provide.
But manual controls are also the company’s most significant control weakness, because their effectiveness depends on variables that the company cannot fully govern: the person’s competence, attention, availability, workload, motivation and integrity. An automated control either operates or it does not. A manual control operates along a spectrum from rigorous to perfunctory, and the control framework cannot distinguish between the two without evidence-based testing.
Why Manual Controls Fail
Override
A manual control can be overridden by the person performing it. An automated approval workflow rejects a transaction that exceeds the approval limit. A manual approval process depends on the approver choosing to reject it. The human approver can rationalise the exception, defer to the requester’s urgency, or simply approve without reviewing the detail.
The override rate of manual controls is almost always higher than the override rate of automated controls, because the barrier to override is psychological rather than systematic.
Evidence
A manual control that produces no verifiable evidence is a control that cannot be audited, monitored or tested. A manager who “reviews” a monthly report by reading it and moving on has performed an activity. Whether that activity constituted a genuine control depends on what was reviewed, what was questioned, what was challenged and what was accepted. Without documented evidence (initials on specific items, noted exceptions, documented queries), the control is an assertion that cannot be verified.
Segregation dependence
Manual controls frequently depend on segregation of duties: one person prepares, another reviews. But segregation is only effective when the reviewer actually reviews rather than rubber-stamping the preparer’s work. When workload is heavy, when the reviewer trusts the preparer, or when the reviewer does not understand the detail, the segregation collapses into a formality.
Key-person dependency
A manual control performed by a single individual creates a control dependency that mirrors a key-person operational dependency. When that person is absent, on leave, or leaves the company, the control does not operate, and there is no systematic fallback.
Fatigue and workload
A manual control performed under time pressure or heavy workload is a control performed with reduced attention. A month-end reconciliation prepared at 11pm on day 15 of the close, by a team that has been working 14-hour days for two weeks, is not the same control as the same reconciliation prepared by a rested team on day 5 of a well-managed close.
The Assessment Methodology
In Northrop Management Private Limited’s assurance and governance work, manual controls are assessed on five criteria.
Evidence quality: Does the control produce verifiable evidence of its operation? If not, the control cannot be tested and should be redesigned or automated.
Override frequency: How often is the control overridden, and what is the authorisation and documentation for each override? An override rate above 10% for a critical control indicates that the control is not operating as designed.
Segregation reality: Does the reviewer genuinely review, or merely sign? Test by examining whether the reviewer has ever rejected, questioned or modified the preparer’s work. A reviewer who has never questioned anything is not reviewing.
Dependency: How many people can perform this control? If only one, the control has a single point of failure. The backup should be identified, trained and periodically required to perform the control.
Automation potential: Could this control be automated, partially or fully, to reduce its dependence on human performance? Reconciliation, matching, threshold monitoring and exception flagging are candidates for automation. Judgment-based review, fraud detection and complex analysis should remain manual but be supported by automated data preparation.
The Automation Priority
Not every manual control should be automated. But every manual control should be evaluated for automation potential, and the controls with the highest combination of risk significance and human-performance vulnerability should be prioritised.
Automate first: Controls that are high-frequency, rule-based, evidence-dependent and critical to financial reporting. Three-way matching. Bank reconciliation. Threshold-based approval routing. Exception flagging.
Support with technology: Controls that require human judgment but can be made more effective with automated data preparation. Trend analysis for revenue recognition review. Automated ageing schedules for receivable provisioning. System-generated exception reports for management review.
Keep manual: Controls that are inherently judgment-based and cannot be reduced to rules. Fraud risk assessment. Related-party transaction evaluation. Impairment model review. Going-concern assessment.
Ashish Chaudhary, frames the control design principle directly: “The more critical the process, the less it should depend on memory, attention or individual motivation. A critical control that relies entirely on a human performing correctly, every time, under all conditions, is a critical control that will fail exactly when the conditions are worst: when the person is overworked, distracted, absent or compromised.”
Questions for the Boardroom
- What percentage of our critical controls are manual, and for each, do we have evidence of consistent operation?
- What is the override rate for our manual controls, and does the pattern suggest controls that are routinely bypassed?
- For each manual control performed by a single individual, who is the trained backup, and when did the backup last perform the control?
- Which of our manual controls could be automated to reduce human-performance dependency, and what would the implementation cost be?
- If the person performing our most critical manual control were unavailable for 30 days, what would happen to the control environment?
Closing Implication
Manual controls are necessary. They are also inherently fragile, because their effectiveness depends on human variables that the company cannot systematically govern. The governance discipline is not eliminating manual controls. It is identifying which manual controls protect the company’s most significant risks, testing whether those controls actually operate, assessing their vulnerability to override, absence, fatigue and competence gaps, and automating wherever the risk significance and the automation potential align.
A control environment where the most critical risks are protected by manual controls dependent on individual performance is a control environment that is one resignation, one sick day, or one moment of inattention away from failure. That is not governance. That is hope.
