The CFO's Operational Skills Program delivers the core CFO competencies that organizations expect and demand. Get up to speed on corporate governance and risk management along with changes resulting from the pandemic and post-pandemic business environment. The next in-person session runs October 15-18, 2023 in Whistler. Register now to save your spot.
We need to consider developing internal controls as a way to add value, not just as a tick-the-boxes compliance task.
One of the major compliance responsibilities of finance managers is to help ensure that their organizations have satisfactory internal controls in place. In the past, this has been seen as a fairly routine and somewhat passive requirement: after all controls can be seen as just an added cost – until something goes wrong. With the rapid changes happening right now to our business environments, however, improving internal controls can be an asset – a source of added value – rather than a cost.
Internal controls have a broad definition: they are intended to help an organization achieve its objectives. We normally think of reporting or compliance objectives, but the objectives may also be operational, which includes almost everything else within an organization.
Here are a few ways that improving internal control can be a source of added value, rather than just a cost:
- Sustainability and responsible business practices:
In the early days of environmental, social and governance (ESG) development, there was a lot of debate about the conflict between being a good corporate citizen versus optimizing profits and returns to shareholders and owners. But nowadays, the focus on sustainability has combined with a realization that businesses are accountable to stakeholders beyond just their shareholders. (In fact, this has always been true in Canada, although the Canadian business community has been unduly influenced by American business culture and Milton Friedman’s famous, “The social responsibility of business is to increase its profits.”)
A good summary of the Canadian position can be found in the 2022 report by Peter Dey and Sarah Kaplan, 360° Governance: Where are the Directors in a World in Crisis?
“It is increasingly clear that corporations depend on a wide variety of stakeholders to function effectively. Customers, the planet, workers, communities and others offer the resources and markets required to grow businesses. And, while corporations contribute jobs, innovation and economic growth to our country, corporate operations have also contributed to creating or exacerbating social problems: climate change, income inequality, gender inequality, the opioid crisis, etc.
Too often, these social costs have been treated as “externalities,” outside the scope of action for companies. At a time when a company’s primary responsibility has been to produce short-term returns to its shareholders, they have been dismissed as simply the cost of doing business. Yet, for an accumulating set of reasons, stakeholder concerns are now corporate concerns.”
So, to the extent that improved controls enhance broader objectives, such as improving the community, the environment, or even customer service, it may be wrong to simply consider the “cost” of such enhancements. Engaging with the community by sourcing supplies locally, supporting local events and in general being a “good corporate citizen” are all examples of building resilience and goodwill, and contribute to improved internal control since they can help the organization achieve its objectives.
- Data is valuable
We know that accounting data is valuable and financial managers safeguard it. Accounting records are reconciled, audited, balanced and analyzed to maintain accuracy and reliability. One of the deep lessons in the modern world is the importance and value of all data, not just accounting records. The finance area may play a major role in enhancing internal control within their organizations by helping improve the accuracy and usefulness of non-accounting information sloshing around in all areas. Website hits, customer queries, marketing campaign statistics, and quality measurements, are all examples of data that can be vital to the organization where finance could play a role in ensuring it is of high quality.
Similarly, just as accounting data is protected, because of its value, so indeed all data within the organization needs a “security mindset” to ensure that it cannot be exploited by outsiders. For example, third-party cookies may reveal patterns of browsing and internet searches by employees that may be valuable data to a competitor or other actor outside the organization. An internal control focus will not only ensure that non-accounting data is accurate and useful, but help maintain security and privacy.
- Analog to digital
In many organizations, particularly smaller ones, there remain a surprising amount of manual reconciliation and checking processes. Automating a manual process will certainly improve efficiency and reduce the potential for human error, but there are two other benefits:
- Automating processes forces examination of the processes themselves. In the course of automating, redundant controls, missing controls and vague requirements must all be addressed. In some cases, manual processes have not been re-examined for decades, so installing new processes provides a wonderful opportunity to re-evaluate the process itself. Merely the processes of defining the procedures, in writing, can be valuable.
- In order to effectively use the data within the organization (see “Data is valuable” above) it needs to be digital. Then it can be sorted, analyzed, and in general turned into as valuable asset.
- Consumers as stakeholders
Nowadays, any accepted definition of stakeholders clearly includes customers and consumers. Internal controls may help ensure that customer requirements are met by ensuring that feedback is monitored and that there is transparency in pricing and billing. Similarly, regarding customers and consumers as stakeholders means a focus on ethical behaviour and having processes in place to prevent unethical actions. These processes include training staff and offering ombudsperson or help lines to deal with customer concerns, and then taking the required actions to address the concerns.
- Strengthening culture
There is renewed recognition of the importance of culture in any organization. Many recent frauds and corporate collapses resulted from serious flaws in the internal culture ranging from a lack of integrity and ethics to outright fraud. Internal control can play a significant role in strengthening culture by:
- Encouraging transparency – for example, if the culture discourages silos but encourages transparency and communication between different groups as well as within teams.
- Fostering continuous improvement – for example, feedback loops and similar controls can foster learning and growth by employees.
- Promoting accountability – for example, clear job expectations and reporting relationships promote accountability.
- Explicitly requiring ethical behaviour – for example, written guidelines, codes of conduct, and even ethical discussion in values statements all strengthen culture while consequently enhancing internal control
These are five areas … there are many more … in which changes to the business environment have created a renewed focus on innovative and value-added sources of improved control.
This article is an extraction from Jeffrey's CFO's Operational Skills Program. Register now to save your spot in the next in-person session, running October 15-18 in Whistler. This article was originally posted to Jeffrey's LinkedIn.
Jeffrey Sherman, FCPA, FCA, MBA, is a finance executive, author and educator. He is an instructor for CPABC's CFO's Operational Skills Program.
