Why internal controls fail over time

Ask a room of finance professionals what the most common reason is that internal controls fail over time, and the answers cluster into four: processes become outdated, teams bypass procedures, documentation habits are poor, and nobody is accountable. In our experience every one of those is correct, and they usually arrive in that order.

Processes become outdated

The most common failure is also the least dramatic. A control is designed for a business of eight people with one bank account and one revenue stream. Five years later there are forty people, three entities, four bank accounts and a second product line, and the control has not changed at all.

It has not failed yet, which is not the same thing as working. What has usually happened is that the control now covers a shrinking share of the transactions it was meant to cover. The approval threshold set at $5,000 in 2019 catches a fraction of what it used to. The reconciliation that once took twenty minutes now takes three hours, so it gets done less thoroughly, or less often, or by someone more junior.

From a tax perspective this matters because the trail behind a position degrades quietly. A deduction that was properly supported when the process was designed becomes a deduction that is supported in principle, and in principle is not a document you can hand an examiner.

Teams bypass procedures

The second pattern is rarely malicious. Someone needs a purchase order approved, the approver is traveling, the client is waiting, and there is a faster way. It works. Nothing bad happens. So it happens again, and within a quarter the workaround has quietly become the actual process while the documented one survives only in a file nobody opens.

This is worth being honest about: when a control is routinely bypassed, the control is usually the problem. If the approved route takes four days and the workaround takes an hour, people will take the hour. The fix is almost never a memo reminding everyone of the policy. It is redesigning the control so that the compliant path is also the fast path: raising a threshold that was set too low, adding a delegated approver, or automating a step that was manual for historical reasons nobody remembers.

Documentation habits are poor

This is the one that costs the most in a tax context, and it is the hardest to retrofit.

A great deal of good work is done and never written down. The reasoning behind a revenue recognition treatment, the analysis supporting a worker classification, the market data behind a reasonable compensation figure, the business purpose of an intercompany charge. All of it existed clearly in someone's head at the time and none of it made it into a file.

Three years later, at examination, an undocumented position and an unconsidered position look identical. The examiner cannot see the difference, and neither, frankly, can you once the people involved have moved on. This is why we insist on documenting positions when they are taken rather than when they are questioned. The marginal cost at the time is fifteen minutes. The marginal cost later can be the entire deduction.

Nobody owns the control

The fourth pattern is the quietest. A control exists, is documented, and is genuinely performed, but no single person owns it. It sits between the controller and the operations manager, and both reasonably assume the other has it.

Controls without a named owner decay faster than controls that are merely imperfect, because there is nobody whose job it is to notice the decay. Every control on a risk register should have a person's name against it, a defined frequency, and evidence that it was performed. If you cannot say who performed a control last month and point at the evidence, you do not have a control. You have an intention.

What actually helps

None of this requires a formal internal audit function. For a business under a hundred people, four practices cover most of the ground:

1. Re-test annually against the current business, not the original design. Walk a real transaction end to end and see what actually happens. The gap between the documented process and the observed one is your finding list.
2. Treat every bypass as a design signal. When you find a workaround, ask why the approved route was slower before you ask who broke the rule.
3. Write the position down when you take it. One paragraph, dated, with the reasoning and the supporting data attached. This is the single highest-return habit in the list.
4. Put a name against every control. Not a department. A person, a frequency, and evidence.

Strong controls are not created once. They need to evolve with the business. Organizations that stay clean over long periods are rarely the ones with the most elaborate procedures. They are the ones that re-test, and that write things down.