Mark B. Mitchell, MBA, CIA, CGFM Director of Internal Audit NYSERDA November 12, 2008 Understanding the Importance of Soft Controls in Improving Operations AGA Audio Conference

2 November 12, 2008 Contents Understanding The Importance of Soft Controls What Are Soft Controls? What Are Soft Controls? Why Do Soft Controls Matter? Why Do Soft Controls Matter? Evaluating Soft Controls: Key Elements of Improving Operations Evaluating Soft Controls: Key Elements of Improving Operations What Makes Soft Controls So Difficult? What Makes Soft Controls So Difficult? Soft Controls: A New View Soft Controls: A New View GAO’s Model of Strategic Human Capital Management GAO’s Model of Strategic Human Capital Management

3 AGA Audio Conference November 12, 2008 What are Soft Controls?

4 AGA Audio Conference November 12, 2008 What Are Soft Controls? Integrity & Ethical Values Integrity & Ethical Values Commitment to Competence Commitment to Competence Board or A/C Oversight Board or A/C Oversight Management’s Philosophy & Operating Style Management’s Philosophy & Operating Style Organizational Structure Organizational Structure Assignment of Authority and Responsibility Assignment of Authority and Responsibility HR Policies and Practices HR Policies and Practices COSO Model: The Organizational Culture

5 AGA Audio Conference November 12, 2008 Understanding Soft Controls Internal Control – Integrated Framework, by COSO Internal Control – Integrated Framework, by COSO Enterprise Risk Management – Integrated Framework, by COSO Enterprise Risk Management – Integrated Framework, by COSO Internal Control over Financial Reporting – Guidance for Smaller Public Companies, by COSO Internal Control over Financial Reporting – Guidance for Smaller Public Companies, by COSO Foundation Guidelines “Red Book,” by OCEG Foundation Guidelines “Red Book,” by OCEG Where Are Soft Controls Written About?

6 AGA Audio Conference November 12, 2008 Why Do Soft Controls Matter?

7 AGA Audio Conference November 12, 2008 “Selling” Soft Controls Why Do Soft Controls Matter? 1 1. They can help manager understand why people behave as they do; 2. They can increase managers’ effectiveness in predicting future behavior; and 3. They enable managers to understand how they can direct, change and control behavior. 1 Paul Hersey and Kenneth H. Blanchard, Management of Organizational Behavior: Utilizing Human Resources, Third Edition (Englewood Cliffs: Prentice-Hall, Inc., 1977) p. xiv

8 AGA Audio Conference November 12, 2008 How can I “Sell” Soft Controls to Management? Management: Working with and through individuals and groups to accomplish organizational goals. 2 “Selling” Soft Controls 2 Ibid. p. 5 Employee Potential Percentage of Ability 80 to 90 percent 20 to 30 percent Area Affected by Motivation Potential Influence of Motivation on Performance

9 AGA Audio Conference November 12, 2008 Evaluating Soft Controls: Key Elements of Antifraud Controls

10 AGA Audio Conference November 12, 2008 Evaluating Soft Controls Evaluation Techniques:  Whistleblower Hotlines  Staff Focus Groups  Employee Surveys  “Customer” Surveys  Internal Control Evaluations  Audits (Internal, External)  Studies

11 AGA Audio Conference November 12, 2008 Evaluating Soft Controls Integrity & Ethical Values Integrity & Ethical Values Commitment to Competence Commitment to Competence Board or A/C Oversight Board or A/C Oversight Management’s Philosophy & Operating Style Management’s Philosophy & Operating Style Organizational Structure Organizational Structure Assignment of Authority and Responsibility Assignment of Authority and Responsibility HR Policies and Practices HR Policies and Practices COSO Model: The Organizational Culture

12 AGA Audio Conference November 12, 2008 Evaluating Integrity & Ethical Values 1. Has a Code of Conduct/Ethics been adopted that promotes:  Honest/ethical conduct, including internal and external dealings, and the handling of conflicts of interest?  Accurate accounting records and reporting?  Compliance with applicable laws, rules, and regulations?  Prompt reporting of violations of the code?

13 AGA Audio Conference November 12, 2008 Evaluating Integrity & Ethical Values 2. Is the Code of Conduct Operating Effectively?  Communicated effectively (know to staffs)?  Annual certification by everyone covered?  New hire and periodic reinforcement training?  Management involvement and oversight?

14 AGA Audio Conference November 12, 2008 Evaluating Commitment to Competence 1. Are employees properly trained to carry out their work? Evaluation Techniques:  Employee Surveys  Internal Control Evaluations  Audits  Staff Focus Groups

15 AGA Audio Conference November 12, 2008 Evaluating Commitment to Competence 2. Is employee morale good?  Employee Surveys  Staff Focus Groups  Studies (e.g., sick leave patterns, turnover)  Audits  Investigations

16 AGA Audio Conference November 12, 2008 Evaluating Management Oversight 3 1. Are there established procedures for an Ethics Hotline/Whistleblower Program? Evaluation Techniques:  Is there a procedure for receiving and retaining information?  Do procedures provide whistleblower protection and provide for anonymous tips?  Are any calls coming in? 3 Adapted from COSO, the Sarbanes-Oxley Act of 2002 and PricewaterhouseCoopers white papers.

17 AGA Audio Conference November 12, 2008 Evaluating Management Oversight 2. Is Top Management providing oversight? Evaluation Techniques:  Are they periodically evaluating internal controls and antifraud programs?  Assessing whether control activities over fraud risks are adequate and effective?  Are fraud audits and are investigations conducted fairly and objectively?

18 AGA Audio Conference November 12, 2008 Evaluating Management’s Philosophy and Operating Style 1. Does management evaluate and test the design and operating effectiveness of antifraud controls on an annual basis?  The potential for fraud should be considered as part of the agency-wide risk assessment.  Antifraud programs and controls should be in place that are appropriate to the likelihood and impact of potential fraud

19 AGA Audio Conference November 12, 2008 Evaluating Management Philosophy and Operating Style 2. What is the way in which management responds to any significant deficiencies and material weaknesses that are identified by the agency, internal audit or OIGs? 1.Are matters thoroughly investigated? Disclosed? 2.Are internal controls assessed and improved? 3.Is there communication and training to reinforce values, policies, etc. 4.Are violators treated in a consistent and appropriate manner?

20 AGA Audio Conference November 12, 2008 Evaluating Assignment of Authority and Responsibility 1. Are unit and individual performance linked to organizational goals? Evaluation Techniques:  At the most senior level are executive performance agreements used?  Are executives held accountable for results?  Are expectations set so that staff understand how their daily activities contribute to results-oriented programmatic goals?

21 AGA Audio Conference November 12, 2008 Evaluating HR Policies and Practices 1. Are targeted investments in professional development being made? 2. Is a results-orientated culture encouraged? 3. For sensitive positions, are background checks being performed?

22 AGA Audio Conference November 12, 2008 What Makes Soft Controls So Difficult?

23 AGA Audio Conference November 12, 2008 Understanding Soft Controls What Makes Soft Controls So Difficult? 4 With hard controls both theory and practice are provided (technical skills) With hard controls both theory and practice are provided (technical skills) Early contributions to behavioral sciences seemed to provide knowledge without effecting changes in behavior. (Elton Mayo) Early contributions to behavioral sciences seemed to provide knowledge without effecting changes in behavior. (Elton Mayo) The challenge is to identify social skills that are usable in ordinary human situations. The challenge is to identify social skills that are usable in ordinary human situations. 4 Paul Hersey and Kenneth H. Blanchard, Management of Organizational Behavior: Utilizing Human Resources, Third Edition (Englewood Cliffs: Prentice-Hall, Inc., 1977) p. 1

24 AGA Audio Conference November 12, 2008 What Makes Soft Controls So Difficult? 5 The Nature of Change: Understanding Soft Controls Time and Difficulty involved in Making Various Changes Knowledge Attitudes Group Behavior Low High Difficulty Involved Short Individual Behavior Long Time Involved 5 Ibid. p. 3

25 AGA Audio Conference November 12, 2008 Understanding Soft Controls A Behavioral Approach to Management 6 “Our greatest failure as human beings has been the inability to has been the inability to secure cooperation and understand with others.” 6 Ibid. p.1

26 AGA Audio Conference November 12, 2008 Soft Controls: A New View

27 AGA Audio Conference November 12, 2008 How can I better understand employee motivation? Understanding Soft Controls Are the things that make people satisfied and motivated on the job either the same as or different from the kind of things that make them dissatisfied? Answer: They’re different

28 AGA Audio Conference November 12, 2008 How can I better understand employee motivation? Understanding Soft Controls 7 Frederick Herzberg, “One More Time: How Do You Motivate Employees?”, Harvard Business Review 81, no. 1 (January 2003), p. 91 “The... factors involved in producing job satisfaction (and motivation) are separate and distinct from the factors that lead to job dissatisfaction.” 7

29 AGA Audio Conference November 12, 2008 How can I better understand employee motivation? 8 Understanding Soft Controls 8 Ibid. pp. 87 – 96. Job Satisfaction (Motivation)  Achievement  Recognition  Work itself  Responsibility  Advancement  Growth Job Dissatisfaction (Environment)  Company Policy and Admin.  Supervision  Interpersonal Relationships  Working Conditions  Salary  Status, and Security

30 AGA Audio Conference November 12, 2008 Contact Information: Mark B. Mitchell Director of Internal Audit NYSERDA (518)