The Tea Talk titled “Fortifying Foundations: Strengthening Internal Controls for Enhanced Risk Management” explored the role of internal controls in mitigating risks.
Key Insights
- Dynamic internal controls act as an organisation’s “invisible scaffolding,” evolving alongside corporate strategy to replace rigid compliance with confident, responsible innovation.
- Strategic automation and data analytics strip away excessive bureaucracy, turning manual workflows into agile systems that sustain continuity during sudden market shocks.
- Eliminating departmental silos between risk management and internal audit transforms control ownership from an administrative burden into a shared daily habit.
Many professionals still dismiss internal controls as mere bureaucratic red tape or a frustrating box-ticking exercise. When limited to finance and internal audit teams, these processes often feel like obstacles that stifle agility rather than safeguards that protect the business.
This compliance-heavy mindset leaves organisations exposed. In reality, a strong internal control framework is the practical implementation of governance. It embeds transparency and accountability across all levels.
To explore this shift, the Institute of Enterprise Risk Practitioners (IERP®) hosted a discussion titled “Fortifying Foundations: Strengthening Internal Controls for Enhanced Risk Management”. The session featured Chyselle Oh, General Manager of Corporate Development at Hartalega, and Nandini Devarajan, Senior Manager of Group Risk at AirAsia.
During the session, Chyselle described internal controls as “the invisible scaffolding that keeps an organisation upright.” She likened them to everyday safety measures: “Controls are like the seatbelts in a car. They may not make the car move faster, but they ensure you reach your destination safely.”
How Internal Control Frameworks Drive Corporate Strategy
Internal controls must evolve directly alongside corporate strategy. Within the manufacturing sector, for example, leaders regularly review and align their internal control framework with the company’s growth trajectory, sustainability goals, and stakeholder expectations.
“Controls should never be static,” Chyselle noted. “They must adapt as the business model evolves, particularly in response to new risks or technological advancements.” Achieving this requires active cross-departmental collaboration so teams naturally integrate risk considerations into every major business decision.
When integrated effectively, a robust control environment transforms from a traditional roadblock into a core driver for business success. The end goal is never to stop action or enforce rigid compliance to tick a box. As Nandini highlighted, “A good control environment is not about saying ‘no.’ It’s about enabling the business to say ‘yes’ confidently and safely.”
Navigating Disruption Through Tech-Enabled Controls
Recent years have proven that sudden operational shifts act as a brutal stress test for a company’s internal controls. Rapid market volatility and digital transformations quickly reveal the cracks in rigid structures that rely too heavily on manual intervention***
Sudden disruption forces businesses to distinguish between necessary controls and excessive bureaucracy. “When people were suddenly working from home, we realised that not all controls added value,” one speaker remarked. “It became clear which ones were essential for risk management and which ones were simply procedural comfort.”
To navigate these shocks effectively, leaders must embed technology into their internal controls framework. This transition requires a deliberate approach:
- Deploy automation: Artificial intelligence and data analytics transform how businesses monitor compliance. Automated approval workflows and data analytics dashboards strengthen oversight while maintaining agility.
- Enhance human judgment: Technology acts as an enabler, not a replacement. As Chyselle explained, “Automation doesn’t replace human judgment. It enhances it by providing timely, accurate insights that help risk teams focus on areas that truly matter.”
- Refine the underlying process first: Technology is not a silver bullet. Internal controls are only as strong as the understanding behind them. Before automating a workflow, teams must verify the foundational process is sound.
As businesses push further into digitisation, they must evolve their internal controls to address new frontiers of risk, such as cybersecurity and data privacy. By adapting proactively, they ensure their governance framework remains relevant in an increasingly unpredictable economy.
Fostering a Collaborative Risk Culture
Even the most sophisticated systems fail if employees dismiss their importance. For organisations looking to build a resilient risk culture, it starts at the top. When leaders actively model responsibility in their own decisions, they pave the way for a fundamental shift: control ownership becomes a shared responsibility.
Rather than viewing controls as an external imposition, employees should adopt them as a natural part of their daily work. “An empowered workforce makes stronger decisions,” the speakers agreed. “When people understand how controls protect them and the organisation, compliance becomes natural, not forced.”
But individual accountability only goes so far without structural alignment. Risk management, internal audit, and compliance teams share the same goal of protecting corporate value, yet they often operate in silos. Breaking down these walls gives organisations a much clearer picture of business health. As Nandini advocated, “When risk, audit, and compliance functions work together, they create a more complete picture of organisational health.”
Here, internal audit naturally bridges these departmental gaps. By integrating its efforts with broader governance functions, it establishes a consistent approach to risk identification, control assessment, and corrective action.
To achieve this level of coordination within the broader risk infrastructure, organisations should develop unified reporting mechanisms and shared risk taxonomies. By aligning people and functions across departments, businesses transform their internal controls from an administrative burden into a collaborative daily habit.
Key Lessons for Risk Leaders
Complacency remains the greatest enemy of strong, effective oversight. Leaders must treat their internal controls as a living system, continuously testing and refining processes as their organisation matures. Building this level of adaptability requires risk professionals to rethink how they structure their daily operations across three key areas.
1. Aligning Controls with Corporate Strategy
This operational shift begins by ensuring a dynamic internal control framework evolves alongside the business model. Active alignment transforms compliance from a bureaucratic roadblock into a competitive advantage that supports long-term goals.
2. Navigating Disruption through Tech-Enabled Controls
When sudden market shocks occur, resilient organisations rely on strong governance and strategic automation to adapt proactively and maintain continuity.
3. Fostering a Collaborative Risk Culture
Sustaining these systems ultimately depends on shared accountability. Breaking down departmental silos and integrating internal audit with risk management creates a unified approach to protecting business value.
Looking forward, the future of risk management demands constant development. By fortifying these foundations, businesses prepare themselves for emerging challenges like digital transformation and ESG compliance. As the Chairman of the IERP® aptly summarised, “Strong controls do not limit innovation; they give organisations the confidence to innovate responsibly.
