Risk and Control Issues Commonly Overlooked by Internal Auditing 4: Linking Strategy to Execution

It would be hard to find an organization today that does not have a strategy that has been blessed by the board, and which is intended to drive performance. But there is often a major gap between establishing a strategy and fulfilling its promise – a gap created by defects in management processes.

Questions for your consideration, that might help assess whether your organization has effective processes that link strategy to execution:
1.       Have management and the board established a strategy that is clear and well understood by top management?
2.       Is it clear what actions are required to achieve the strategy?
3.       Is it clear who is accountable for every action?
4.       Does every required action have appropriate dates established, both for completion of the action and for any interim milestones?
5.       Have the actions and accountabilities been appropriately communicated to those who will not only be responsible for participating in the actions, but also to those whose active participation is necessary (e.g., by providing resources or sharing information)?
6.       Does every action have sufficient resources?
7.       Are risks to the strategies, and the related activities, monitored and are appropriate actions being taken to ensure success?
8.       Have management and the board established, and are they using, appropriate metrics to measure progress on all required actions and achievement of measurable goals?
9.       Is compensation linked to completion of the actions and achievement of the strategies? Are individuals’ incentives aligned with the organization’s strategies?
10.   Do managers’ goals and objectives include activities that are not relevant to achieving the strategy, and may even lead managers to prioritize other activities over those necessary to the achievement of organizational goals?
This last point is very important.
I have worked at a number of otherwise fine companies where my MBOs (on which my bonus was calculated) were based on what I and my manager thought were my priorities. While we tried to reach up and link to corporate strategies, the MBOs were not the result of a top-down process.
I would like to think that what I and my team did was essential to corporate performance. But there is always a possibility (even a probability) that without a top-down process of cascading top-level strategies, goals and objectives throughout the organization, day-to-day execution is not linked to strategy – and the company will fail to optimize performance.

I welcome your perspectives. Is this an issue at your company? Are there other questions auditors should ask?

Posted on Jul 6, 2010 by Norman Marks

Share This Article:    

  1. Marks,

    I am pleased to share that this is one of the levers in control environment covered by us in all assignments irrespective of the audit topic. We view this as a direct link to performance of the organisation. Thus a clear top-down communication of strategy and goals, the quality and stregnth of the related objectives and their downward flow to others, clear evidence of associated action plans to reach the objective, monitoring process and course correction activities, if any, are the various sub-activities of this process. Believe it or not, we can discover skeletons in the cupboard!! Infact, we also check if the binus schemes are fallacious in ceratin respects - Individual achievement and enrichment (ofcourse bonus!) may not be correlated to the orgainisation's performance. Basically, sum of the parts may not be the whole!!!

  1. There will always be a gap between operations and strategic directions. I know from my experience in BC Government that the day to day operations (tactical if you want to call it that) will always trump strategic. When you are putting out fires, how can you focus on strategy? The reality is that directors and managers (middle management) do not spend much time with executives. Just to emphasis the point that operations takes priority over strategy, my spouse came home the other day and told me that her manager wants staff to take time from production to think and act strategically. So the question that we ask was how are you measured? In her case the processing of financial payments was her metric. In other words production took priority over strategy. It's great for managers to say you should take the time. It's great for executive to say this is our strategic direction. However operational processes will always trump. If you do not get widgets produced, then how can the company survive? There is a disconnect between executive and operations. Blue sky thinking does not get work done. It's like a project. Projects are comprised of many tasks. Each task must get done before the project gets done. The executive is thinking project. The worker is thinking task. What is often missing in the project thinking is the details. The details probably cause more strategies to fail or not even start to get executed. Another example is military. The general says take the hill. Easy to say, hard to do. Somehow there are many things like people with guns that will prevent the taking of the hill. The soldier sees the hill as a series of steps. Each step is fraught with risk to the soldier. Note that the general does not take any risks. The worst that can happen is being relieved. For the soldier the worst is being killed. The last note is about employee engagement. Executives tend not to engage employees in strategic decisions.
  1.  In my day we used to call this stuff effectiveness auditing, and used to draw on the CCAF methodologies. When I was cutting my teeth in internal audit (straight out of management consulting) I assumed this is what we were supposed to do, so it just became part of our operational audit process. The by-product however was astounding as if you apply this approach consistently across an organisation, bumbling tired old bureaucracies become highly performance driven, and usually in a space of just 2-3 years. Very, very potent stuff, but alas often forgotten, and it seems rarely applied, even though this was a mainstream concept in the early 90s. Time to dust off some of the old CCAF methodologies? 

    Oh, and if there's any KPMG people reading this, there's a work paper template we designed which does all of this in your internal audit manual from around about 2000.


    Your list of 10 questions is very good. The first five deal with accountabilities and communications.  My experience in working with companies is that “accountabilities” are often defined through paper programs. The shortcomings often arise due to a lack of enforcing the accountabilities for a wide variety of reasons.  This is why I especially like #9 because this is an attempt to align actions to personal gains.  Unless people see and feel the ramifications of their actions companies will continue to experience that 90% failure rate in execution.
  1.  For organisations that embrace corporate governance, the rule of thumb is that tactical plans are aligned entirely to strategy. Ideally, the tactical plans (day to day operational procedures) should be a translation of the strategy into daily routine processes and procedures.

    That said, the process of formulating strategy should be all inclusive. All members of the organisation, who shall be expected to play a role in execution of strategy, should be involved in the strategy formulation process. This will create a feeling of strategy ownership among employees at all levels and probably increase enthusiasm in strategy execution.
    If all employees understood how their areas of specialisation married into overall realisation of goals and objectives and truly believed they were an integral part of the whole that is the organisation, maybe organisations would achieve better success rates in executing strategy.
  1.  This is a nice and valuable article. My only addition to it will be in the area of how execution fall-outs (variances of execution from the plan) are escalated and managed. This should clearly be defined and closely monitored via a clearly defined and communicated reporting mechanism.There should be an objective assessment of this for it to be meaningful and get the desired result.

    Best Regards,

    Segun Awode

Leave a Reply