What happened to internal control systems?, By Bolutife Oluwadele

Internal control systems are essential to corporate governance, ensuring financial accountability and efficiency. Yet, there are growing signs that such systems are becoming troubled, making it unclear if they’re still effective and pertinent in the ever-changing business landscape.

One of the most cherished aspects of my career as a Chartered Accountant is the rare privilege of working in virtually all areas of the accounting profession. An experience over two decades ago triggered the title of this article. When I was specifically asked back then how I would want my department to be designated, I was presented with two broad options. I chose the option that captured the essence of the role I was rigorously headhunted for. The two options were to name the department “Internal Audit and Control” or “Internal Control and Audit.” I opted for the latter, internal control and audit. When asked the rationale behind my choice, I gladly retorted that what is there to audit without robust systems in place?

As vital as auditing is to organisational processes and procedures, a robust internal control system is a solid foundation on which it functions well. Internal control systems explain and provide the proper and continuous evaluation of functionality. Suppose there is anything to audit to correct, improve, or even revise what may not be working. In that case, the internal control system should provide the essential platform for doing that.

Historical Context

Internal control systems date back to the ancient world when elites used checks and balances to thwart scams and be accountable. These systems gradually became refined and more complex when contemporary accounting systems were introduced. Internal controls became more institutionalised in the 20th century, as regulations like the Sarbanes-Oxley Act in the US called for strict internal control requirements for publicly traded corporations.

Key Issues

Even as historical practices, however, internal control systems suffer from problems:

1. No Segregation of Duties: Segregation of duties is one of the basic concepts of internal control, which avoids a single person controlling every facet of a financial transaction. However, most companies can’t manage this effectively, causing the possibility of fraud and mistakes.

2. Management Override: Even the most robust in-house control mechanisms can be beaten out of existence if the management decides to abuse them. This is especially true in organisations that lack supervision and accountability at the top. The tone at the top always matters.

3. Collusion: Internal controls are designed to prevent individual misconduct, but they are often powerless against collusion between employees. When individuals conspire to bypass controls, it becomes challenging to detect and prevent fraudulent activities.

In the recent past, we have been inundated with monumental fraudulent practices or outright theft of our commonwealth, with some figures that are unbelievable to any discerning mind by some single individual. Do not get me wrong; this is not disputing some unabated corruption in the economy’s public and private sectors. There are sickening occurrences and reports of such. The situation is further exacerbated by the unparalleled impunity and lack of consequences for the ‘celebrity’ thieves in our climes.

My hands-on experience as a fraud investigator also allowed me to witness and understand the undercut dealings in the polity. In those successful investigations, some elements of internal control compromise became glaring. These are a lack of segregation of duties, management override, and collusion, all finding expression within the triangular fraud pyramid. This is further heightened by the lack of appropriate lifestyle auditing as part of cultural evolutions required more than ever.

Returning to the unbelievability of many of the figures taunted around is a glaring disservice to the fact of fighting whatever ‘war’ against corruption. It is rather amusing that we must throw out big figures to ‘convince’ us that corrupt practices have already occurred. I do not think the amount alone should matter, but that stealing has indeed happened. It is as if the amount is too ‘small,’ and we believe there is no big deal about that. I think stealing remains stealing, big or small.

Where internal control exists, one of its purposes is to prevent any actions injurious to the financial and other well-being of the organisation, either by individual or collective actions. On this premises, segregation of duties stands out, as no process should be initiated, vetted, approved, or implemented by a single individual. Different personnel are expected to handle each aspect independently of each other and act as “checks and balances” against each other. Yes, while hierarchical orders may be significant to the successful observance of this incredible control, they should, in an ideal situation, reinforce their workability.

One of the most dangerous threats to internal controls is managerial override. In this situation, those who should uphold the sanctity of such controls choose to abeyance the fiduciary duties imposed on them for pecuniary interests and gains. Akin to that is the most intricate onslaught on internal controls through collusion. The collusion can even be worse when it has full support with managerial override. In such cases, whatever internal controls system is in place may not be worth more than the paper it is written.

It belittles our collective wisdom when an individual in an organisation is said to have stolen more than 80 per cent of the budgetary allocation. In some ridiculous circumstances, we have heard of those accused of stealing more than what was available to the organisation. This undue exaggeration itself is an urgent issue we should address. Unfortunately, it gives the perpetrator an escape route, which has become the norm rather than the exception.

Where internal controls exist and are allowed to function as they should, all this unabated stealing should not occur.

Case Studies

To illustrate these issues, consider the case of the former CBN and similar others, with figures beyond imagination thrown around. Many past Ministers and Governors are in the same boats, including a former Accountant General who has reportedly pillaged resources in their care.

Technological Advancements

With the advent of new technology, there are new ways to improve internal control mechanisms. For instance, artificial intelligence (AI) and blockchains can deliver real-time analysis and permanent records. These innovations can assist organisations in identifying anomalies earlier and keeping their financial data up to date.

Best Practices

Creating strong internal control systems requires some best practices, including:

• Segregation of Duties: No individual is responsible for everything in a transaction. Though this may not be a problem in large organisations, it may still be undermined by collusions and wrong tones at the top.

• Regular Audits: Internal controls should be regularly audited for proper functioning and areas for improvement. This is, however, meaningful if there are means and ways of enforcing recommendations for lapse corrections.

• Culture of Accountability: Establishing an organizational culture whereby internal controls are stressed and people are accountable. Again, this is primarily dictated by those charged with governance. Board oversight and management commitment can be the driving forces here.

Regulatory Frameworks

Regulatory environments are also the building blocks of internal control systems. For example, the Sarbanes-Oxley Act made the internal controls of public companies more robust and transparent. Such rules must be complied with to maintain investor confidence and avoid prosecution.

What Happened To Internal Control Systems, Then?

There are no simple answers to this question. I am sure no notable professional will stick out their neck to tell us what is going on with the functionality of internal controls, though they report on these things year in and year out. Of course, there is always the clause that auditors’ primary role is not fraud detection, but where their work triggers any suspicion, they must probe to the fullest extent possible. Such probing might draw the attention of management/board to the likelihood of unwholesome practices in the organization. This article intends not to debate the probity of such assertions but to ginger our thoughts to have a new reflective mindset about internal control systems.

Due process was established back then, with pomp and pageantry as the ubiquitous solutions to the identifiable patterns of managerial override and impunity. Unfortunately, it is doubtful that it achieves its taunted mantra’s intended purpose.

What Happened To the Internal Control Systems?

Can we detour and find a means of rejigging this essential tool so that it works for us at all strata? Can we wake it up from its seemingly deep and hopeless sleep?

Can we make the internal control system work for us again and bring sanity to our financial ecosystem?
If we want to, it is within our collective ability and willingness to recreate the internal controls that will serve practical purposes for us across the board. Impunity and lack of consequences do a disservice to effective internal control systems. As it stands, we have collectively, deliberately, or perhaps ignorantly disabled a veritable tool that should enhance financial integrity and probity, thereby leaving us to keep asking, what happened to internal control systems?

Bolutife Oluwadele is an author, chartered accountant, certified fraud examiner and public policy scholar based in Canada. Email: bolutife.oluwadele@gmail.com