Add-on Module
Why documenting how work actually gets done is a governance and audit imperative, not a paperwork exercise
Every organization runs on processes; how invoices are approved, how new suppliers are onboarded, how financial statements are closed. Most of these processes exist only in the heads of the people who perform them. Process documentation is the discipline of capturing that knowledge deliberately: the steps, the roles, the decision points, and the controls, set down in a form that can be reviewed, tested, and improved. It is unglamorous work, but it is where good governance and reliable internal control actually begin.
Why It Matters
- Control assurance: You cannot assess the design or operating effectiveness of a control without first documenting the process it sits within. This is the walkthrough stage that precedes every ICFR and internal audit test.
- Segregation of duties: Swimlane-style process maps expose conflicting responsibilities across roles that a narrative description alone tends to obscure.
- Regulatory demonstrability: Governance codes such as the CBN Code and NCCG 2018 require that Board and management responsibilities are not merely acknowledged but operationalized; documentation is the evidence.
- Continuity: Undocumented processes are a single point of tailure; when the one person who "just knows how it's done" leaves, the process breaks with them.
Principles of Good Documentation - Document the process as it is actually performed, not as the policy manual says it should be, through direct walkthroughs and interviews.
- Name an owner at every step, not just an action.
- Mark control points explicitly: distinguish routine processing from steps that are genuine controls; approvals, reconciliations, system validations.
- Version and date every document; undocumented drift is itself a control weakness.
- Calibrate granularity, detailed enough to support testing, simple enough that people will actually use it.
At PML Professional Services, we help organizations turn how work actually gets done into clear, structured process documentation, mapping workflows, naming owners, and identifying control points along the way. The result: documentation detailed enough to be useful, simple enough to be followed, and durable enough to outlast staff changes and regulatory scrutiny alike.
