Making risk and control work easier to see and act on
Frisian Flag Indonesia operates in a business where financial and operational discipline matters across many teams. Its Risk & Control function, or R&C, is responsible for reviewing control activities, following up on audit recommendations, and helping the company manage identified risks.
The work involved many people: R&C teams, business process owners, control executors, assigned persons in charge, and company leadership. Yet the process was not fully supported by a single system. Assignments, evidence, approvals, reminders, and follow-up status could become difficult to coordinate, especially when several activities competed for the same limited time.
Suitmedia developed the FFI Task Management web application, also known as Digicam, to create a more structured way to manage this work. The platform brought assignments, tasks, users, approvals, reminders, and monitoring into one place so R&C could work more consistently with business teams and leadership.
Risk control was being managed through fragmented effort
1. A quarterly control cycle created a narrow operating window
Within each quarter, the R&C team had to assess approximately 50 internal control framework, or ICF, control numbers as part of business process owner, or BPO, implementation. The assessment had to be completed within two weeks.
This created a concentrated workload. R&C needed to collect evidence, check whether controls had been carried out properly, and determine whether the evidence supported the required assessment.
The short timeline left little room for repeated clarification or late submissions. If evidence arrived late or incomplete, the team had to spend additional time following up, leaving less time for review and analysis.
2. Evidence quality was inconsistent
Several control executors, or BPO persons in charge, submitted evidence that was delayed, incomplete, or not aligned with requirements. In some cases, the person responsible did not fully understand what evidence was needed.
This problem was not necessarily caused by a lack of commitment. Employees were balancing control activities with their regular responsibilities, and the process depended heavily on people remembering requirements and deadlines.
However, inconsistent evidence made assessment harder. R&C could not simply review what had been submitted; it often had to determine whether the evidence was complete, request additional information, and track whether the issue had been resolved.
3. The process created more operational risk
A control is useful only when it is implemented consistently and supported by reliable evidence. When implementation is delayed or incomplete, the company has less confidence that the underlying risk is being managed.
This created a second-order problem for Frisian Flag. Weak execution could affect the quality of the assessment, which could then affect the company’s internal control compliance score and broader corporate targets.
The issue was therefore larger than administrative inefficiency. A fragmented process could make it harder for the organization to identify whether controls were working as intended.
4. Audit recommendations also needed structured follow-up
R&C was responsible not only for quarterly control assessments, but also for following up on the status of internal audit recommendations.
These recommendations were assigned to auditees, often within the BPO structure. R&C needed to know whether corrective actions had been completed, whether evidence had been provided, and whether identified risks had been addressed.
Without a reliable follow-up process, recommendations could remain open longer than necessary. This reduced visibility into whether agreed improvements were actually being implemented.
5. R&C had to manage several priorities at once
The team’s available resources were limited, while its responsibilities extended across the audit universe, ad hoc projects, advisory work, and corporate programs.
This meant follow-up activity could be delayed even when it was important. Team members had to remember which tasks were due, which items required escalation, and which assignments were waiting for responses from other parties.
The challenge was not simply to give R&C more information. It was to organize the work so that important actions were visible, assigned, monitored, and completed in a more predictable way.
6. Collaboration involved several levels of the organization
The process connected R&C, BPO teams, control executors, BPO persons in charge, and FFI directors. Each group needed a different level of access and responsibility.
A control executor needed to know what task to complete and what evidence to submit. R&C needed to review status and follow up. Leaders needed visibility into progress and unresolved issues.
The system therefore had to support collaboration without exposing every user to every function. Clear roles and access rules were essential to making the workflow manageable.
7. The company needed a system, not another checklist
A simple checklist might record whether a task existed, but it would not fully solve the problem. Frisian Flag needed to manage assignments, task ownership, deadlines, evidence, approvals, reminders, users, and reporting within a connected process.
The platform had to reduce reliance on memory and informal communication. It needed to show what had been assigned, who was responsible, what remained incomplete, and where attention was required.
That would help transform control management from a periodic scramble into a more visible operating discipline.
Designing a single workflow for assignments, evidence, and accountability
1. Define the workflow around the work R&C already performed
Suitmedia began by understanding the client’s needs and the way control and audit follow-up activities were managed.
The goal was not to impose a separate process that employees would need to learn from scratch. It was to make the existing work more structured and easier to monitor.
This distinction mattered because adoption depends on fit. If the platform required teams to work in a way that felt disconnected from their responsibilities, it could create additional effort rather than reducing it.
2. Use a dashboard to create a shared view of progress
The application included a dashboard to provide visibility into assignments, tasks, statuses, and activities.
A dashboard gives users a starting point. Instead of searching through separate messages or files, they can see the work that requires attention and the progress that has already been made.
For R&C, this helped create a broader view of the department’s workload. For leaders, it offered a clearer picture of whether important control and audit activities were moving forward.
3. Make assignments and tasks explicit
The Assignment and Task module allowed work to be allocated to specific users or teams.
This addressed a common source of delay: unclear ownership. When a request is shared informally, people may not know who is responsible, when it is due, or whether someone else is already handling it.
By creating explicit assignments, the platform made accountability easier to understand. Each user could see what they were expected to complete, while R&C could monitor whether tasks were progressing.
4. Use reminders to reduce dependence on memory
Reminders were included to help users keep track of deadlines and outstanding actions.
This was particularly important during the two-week quarterly assessment window. R&C did not need to rely only on manual follow-ups or memory to remind control executors about missing evidence.
Reminders also supported audit recommendation follow-up. When a corrective action remained open, the system could help keep it visible until the responsible party provided an update or completed the task.
5. Create a structured place for control evidence
The workflow was designed to support the management of control-related tasks and their evidence.
A structured system makes it easier to understand whether the required documentation has been submitted and whether the item is ready for review. It also reduces the chance that evidence will be lost across email threads or disconnected files.
This improved the quality of the assessment process. R&C could spend more time evaluating the evidence and less time reconstructing where information had gone.
6. Support approvals within the same process
The platform included approval-related functionality to help move tasks through the required review stages.
Approval is important because submitting evidence does not necessarily mean that the control activity has been accepted. The relevant reviewer must be able to examine the submission and confirm whether it meets expectations.
By keeping approval within the same system, the platform reduced the gap between submission, review, and completion. Users could see where an item stood instead of waiting for updates through separate channels.
7. Add master data to create consistency
The Master Data module provided a structured base for the information used across assignments and tasks.
Consistent underlying information helps prevent confusion when the same control, process, user, or activity appears in different parts of the system. It also supports more reliable reporting and monitoring.
This was an important design choice because a task system can become difficult to manage if each user enters information differently. Shared data structures create a more dependable foundation for daily operation.
8. Manage users and roles centrally
The Role and User Management module allowed administrators to add users and define which menus and functions those users could access.
This enabled the platform to reflect the organization’s responsibilities. Different users could receive different levels of access based on their roles in the control and audit process.
Role-based access also supported security and usability. Users were more likely to understand the platform when they saw the functions relevant to their work rather than a long list of options intended for other groups.
9. Make the platform useful for several stakeholders
The system was designed to support R&C, BPO teams, BPO persons in charge, and FFI directors.
For R&C, the platform created a way to assign, follow up, review, and monitor work. For BPO teams and control executors, it clarified the tasks and evidence required. For leadership, it created greater visibility into the state of control and audit activities.
This shared structure helped align different groups around the same information. Each stakeholder could work from a common view of responsibility and progress.
10. Reduce the distance between detection and action
Risk information is only valuable when it leads to action. The platform identified tasks and recommendations with assigned owners, deadlines, updates, and approvals.
That shortened the path between recognizing a control issue and following up on the steps needed to address it.
The design also supported escalation. When tasks remained incomplete, their status could be seen more clearly, allowing R&C and leaders to focus attention where it was most needed.
11. Make the system suitable for continuing use
Although the platform addressed quarterly control assessments and audit recommendation follow-up, its modules were designed for broader task management.
This gave Frisian Flag a reusable foundation. New assignments, projects, and control activities could be managed within the same structure rather than through separate tools.
The long-term value was greater operational resilience. R&C could use the system as its workload changed without depending entirely on manual tracking.
A more reliable control environment emerged from better visibility
1. Frisian Flag gained a central system for R&C activities
The FFI Task Management web application was adopted internally to manage assignments, tasks, and activities carried out by the R&C Department.
This created a shared source of information for work that had previously required more manual coordination. R&C could manage tasks in a structured environment and maintain better visibility into what was active, delayed, or awaiting action.
The platform supported the department’s role without requiring the organization to manage control and audit follow-up through disconnected methods.
2. Task ownership became clearer
By assigning responsibilities through the application, Frisian Flag could make it easier to understand who was responsible for a task and what stage it had reached.
This reduced ambiguity between R&C and BPO teams. Control executors had clearer expectations, while R&C had a more direct way to monitor whether work was progressing.
Clear ownership also improved follow-up conversations. Teams could discuss a specific assignment or task rather than trying to reconstruct responsibility from past messages.
3. Monitoring became more consistent
The dashboard, task module, reminders, and approval flow created a more consistent approach to monitoring.
R&C could follow up on control evidence and audit recommendations through a repeatable workflow. This helped reduce the risk that important items would be overlooked because they were buried among competing work.
Consistency is especially valuable in risk management. A process that is performed the same way across cycles creates a stronger basis for comparison and improvement.
4. Collaboration improved across organizational levels
The platform helped create collaboration among R&C, BPO, BPO persons in charge, and FFI directors.
Each group could participate according to its role, while still working from a connected system. This reduced the distance between the teams responsible for performing controls and the leaders responsible for understanding the overall control environment.
The result was not simply faster task completion. It supported a more shared understanding of how control activities and audit recommendations were being managed.
5. The organization strengthened its control environment
The application helped Frisian Flag build a stronger control environment by making activities, responsibilities, and outstanding work more visible.
A control environment depends on more than policies. It also depends on whether people understand their responsibilities, follow through on them, and provide evidence that can be reviewed.
By supporting these behaviors through one system, the platform helped make control management more practical and repeatable.
6. R&C gained greater operational capacity
The platform reduced the amount of manual coordination required to manage assignments and follow-ups.
This created more operational capacity for the R&C team. Less time could be spent searching for updates, sending repeated reminders, or organizing disconnected information, leaving more time for assessment, advisory work, and risk judgment.
The benefit was not the elimination of human involvement. It was a better use of human attention.
7. Leadership received better visibility into unresolved issues
Because tasks and statuses were managed within the application, FFI directors could gain a clearer view of progress and outstanding items.
This supported more timely attention to issues that required escalation or management support. Leaders could see where control implementation or audit recommendations were not moving as expected.
Better visibility also strengthened accountability. Important risk-related work became easier to discuss at the management level.
8. The platform created a foundation for future process maturity
The application gave Frisian Flag a structure that could support more than the immediate project requirements.
As the organization’s control and audit processes evolve, it can build on the existing modules, roles, and task framework. This makes future improvements more manageable than relying on separate manual systems.
The second-order effect is greater organizational maturity. A company that can consistently assign, monitor, and close important work is better equipped to manage risk as its operations become more complex.
The deeper lesson: control quality depends on workflow quality
1. Risk management is weakened when ownership is unclear
A control may be well designed, but it can still fail if no one is certain who must complete it, what evidence is required, or when the work is due.
The platform addressed this by making assignments and responsibilities visible. Clear ownership is one of the simplest ways to improve follow-through.
2. Evidence requirements should be built into the process
People are more likely to provide the right evidence when the expectations are clear and connected to the task itself.
A structured workflow helps move evidence from an afterthought to a normal part of completion. This reduces rework and improves the quality of review.
3. Monitoring must be continuous enough to support action
Quarterly assessments and audit follow-ups can become reactive when teams only review status near a deadline.
Dashboards and reminders make progress visible before the final review window. This gives R&C more time to address delays and allows business teams to correct problems earlier.
4. Automation should protect judgment, not replace it
A task system can track assignments, deadlines, and status, but it cannot determine the significance of every risk or decide whether evidence is truly adequate.
The platform created more space for professional judgment by reducing administrative effort. People remained responsible for evaluating controls and recommendations, while the system supported the process around that judgment.
5. Shared visibility creates shared accountability
When R&C, BPO teams, and leadership work from the same information, it becomes easier to understand where responsibility sits and what needs to happen next.
This shared view can improve collaboration without removing accountability. Each stakeholder sees the part of the process they own and how it connects to the wider control environment.
Strategic Insights for the C-Suite
- Treat control management as an operating workflow, not a reporting exercise. Strong controls depend on clear owners, deadlines, evidence, review, and follow-up. A connected system can make these responsibilities visible before problems become urgent.
- Use technology to reduce coordination work around risk. Reminders, dashboards, and structured assignments do not replace professional judgment. They free risk teams to spend more time assessing issues and less time chasing information.
- Make evidence requirements part of task design. Control quality improves when people know what must be submitted and how completion will be reviewed. Clear expectations reduce rework and strengthen confidence in assessments.
- Create one shared view across control owners and leadership. R&C, business teams, and directors make better decisions when they work from the same status information. Shared visibility improves accountability and speeds up escalation.
- Build risk platforms for repeatability and growth. Quarterly assessments, audits, and special projects will continue to evolve. A reusable task foundation allows the organization to improve its control environment without rebuilding the process each time.
