The Illusion of Security: Why Your Internal Control Might Be a House of Cards

 

Once, during a consulting project, a manager told me something that sounded reassuring: "We have control for outgoing goods; it’s done every single day." However, as I dove into the process, I discovered the harsh reality behind those words. That "control" was merely an employee jotting down what left the warehouse in a notebook, no verification, no signature, and no oversight. In the manager's mind, the risk was covered; in practice, he had a hollow procedure, but not an effective control.

Many people confuse control with bureaucracy, and I often hear that "bureaucracy kills business." But that isn't true. 

Bureaucracy, in its essence, is not a bad thing. If we look at Max Weber’s theory, we understand that it was conceived as a form of human organization based on rationality, ensuring impersonality, a clear hierarchy, and meritocracy. It ensures that the process depends on the rule, rather than the mood of whoever is executing it. 

I always say that bureaucracy is simply the formalization of what is already working.

The real problem isn't bureaucracy itself, but "bureaucratic excess", when the ritual becomes more important than the result. 

An internal control system based on best practices, right sized to keep risk factors within acceptable levels, is essential for operational efficiency. It creates order and prevents the "rigidity" that often blinds an operation.

We know that internal control is an action designed to mitigate the cause of a risk before it materializes. It manifests in the "doing": in the review, the verification, the recalculation, and the careful approval. If there is no confrontation between "what should be" and "what is," the risk continues to walk freely through your company’s hallways.

For a control action to be more than just figurative, it requires four non-negotiable attributes:

• First, the Objective, which is the very reason for its existence and must target the risk factor. For example, if the risk is the use of incorrect labor hours, the objective is to ensure that the hours in the payroll system are consistent with the time-tracking system.

• Second, Practical Action, such as a data verification. It is vital to formalize how this action is performed so that a "prudent person" could re-perform it.

• Third, the Evidence, because a control without a trail is invisible. It could be a sign-off, a system log, or an email. To an auditor or an internal controls specialist, a lack of evidence implies the control does not exist. Finally, the Frequency, which must match the speed of the risk, whether it be daily, monthly, or per event.

 

When we talk about Control Modeling, the starting point is knowing the risk factor and the magnitude of what we are mitigating, allowing us to define the necessary attributes to keep the operation within the organization's risk appetite. 

These same attributes allow us to evaluate Design Efficiency, concluding whether the control has the theoretical capacity to mitigate the risk.

 Once we move to Effectiveness Evaluation—the actual control testing—the focus shifts to two crucial points: discipline, observing if the evidence exists within the defined frequency; and quality, re-performing the action to ensure it wasn't just a formality. 

This is why these attributes must be formalized, at the very least, in an Internal Control Matrix.

 It is also fundamental to understand that control is neither absolute nor infallible, as it is designed and executed by people. And where there are humans, there is vulnerability—whether through errors in judgment or, in grave cases, omission, fraud, and collusion. Therefore, the effectiveness of a control does not reside solely on paper, but in the discipline and ethical stance of its execution.

Recently, the market witnessed a testimony that serves as a stark warning. A former bank director admitted to signing documents without reading them. More than a momentary lapse, his confession revealed a void: despite heading the department, he did not perform monitoring or prevention duties.
Here we have the perfect "Window Dressing Control"—the evidence and frequency exist, but the execution of the action is null.

Unfortunately, this is not an isolated case; it is present in many corporations where management still mistakenly views control as mere bureaucracy.

To conclude, I leave you with a thought for reflection:

"The effectiveness of a control depends on action, evidence, and frequency, but it only stops being a house of cards when the integrity of the person executing it is greater than the convenience of simply signing."

Be happy!

Internal controls, the responsibility of everyone!

Questioning who is responsible for internal controls is a common and recurring situation in the corporate world. When the company has an area of ​​internal controls, it is attempted to wrongly attribute this responsibility to it.

Why does this happen?

In my opinion, this behavior is a consequence of the lack of maturity in the management process in relation to good practices, in line with the fragility of a university that does not properly teach managers.

This weakness is evident when, managers and other professionals, relate internal controls to bureaucracy and / or “plastering” the business process. They fail to see and associate that internal control is a response to the action of mitigating a risk factor, which results in increasing the company's ability to achieve its strategic objectives.

The maturity of governance involves the improvement of the internal environment through the strengthening of the culture in the use of good management practices and the consolidation of awareness of risks and controls.

An essential point for this to happen is the correct addressing of the responsibility of each person within the organization in relation to the internal control system.

The model of the three management lines helps us to demonstrate these responsibilities, and was the basis for the construction of the diagram that I prepared to facilitate this understanding.

Let's see:

1. Governance Structure - I include here the Board and statutory committees, which are responsible for promoting the appropriate environment for the culture development and awareness of risks and controls. In addition, they must be committed to good management practices, supervising and monitoring the application of these concepts by the executive and operational management, following up on the implementation and improvement of internal controls.

2. Executive and Operational Management - In this case, executive management is the president and his directs, while operational management is the managers below the executive management line. The responsibility lies in exemplifying the commitment to internal controls, and in defining, implementing, executing and supervising the internal control system in order to keep operational risks within acceptable limits, as defined by the corporate risk appetite. This first line of management are the “owners” of risks and control, with no exception.

3. Specialists - Responsible for supporting the executive and operational management, first line, to apply the best management practices for the modeling, implementation, maintenance and improvement of the process and its internal control system integrated with the corporate risk management structure. This group includes specialists in internal controls, specialists in risk management, compliance and governance. They are the second line of management.

4. Internal audit - It is an independent and objective activity, usually reporting to the governance structure, with the objective of adding value, through the application and execution of an independent and objective evaluation on the internal control, risk management and corporate governance systems.

As you may see, every single person within an organization, without exception, has explicit responsibilities regarding internal controls, either in their design, implementation, execution or in their quality.

However, the greatest responsibility is left to the executive management (president and its directs) which must promote the properly environment, based in the ethics and best practices, in order to create the culture where all managers and employees recognize their responsibility for the existence of high quality internal control system.

I would like conclude this article with this quote:

“The great enemy of truth is often not the lie - deliberate, contrived and dishonest - but the myth - persistent, persuasive and unrealistic” J.F.Kennedy

 

Always, be happy!