Why internal controls fail over time
Strong controls are not created once and left alone. Four patterns explain almost every control failure we find in growing firms.
Read the article
“This will just take a minute.” “Let's skip that step for now.” Sometimes it works. Over time, shortcuts become patterns, and patterns quietly weaken everything around them.
We have all seen it. “This will just take a minute.” “Let's skip that step for now.” And sometimes it works, once. But over time, shortcuts become patterns, and patterns quietly weaken the controls they were taken around.
If shortcuts failed immediately nobody would take them twice. The difficulty is that they usually succeed. The invoice does get paid. The client does get their deliverable. The month does close. Nothing visible goes wrong, and the person who took the shortcut has now learned, correctly, that the step they skipped was not strictly necessary on that occasion.
That is the trap. A control is not there for the ordinary case. It is there for the unusual one: the duplicate invoice, the vendor whose bank details changed, the contract with unusual terms, the expense that is not what it appears to be. Skipping a control on ninety-nine ordinary transactions carries no cost at all. The entire cost lands on the hundredth.
What starts as one person's exception becomes the team's default with surprising speed. A new hire is trained on the actual process rather than the documented one, because the actual process is what everyone does. Within two years nobody in the room remembers that a step was ever performed differently.
By that point the control has not merely been weakened; it has been forgotten. And a forgotten control is worse than an absent one, because the risk register still says it exists. Management believes it is covered. The lender's questionnaire says it is covered. It is not covered.
In our work the consequences surface in three predictable places.
Substantiation. Expense documentation is the most-skipped step in any finance function, and the easiest to defend against: a receipt, a business purpose, a name. Reconstructing a year of it under examination is an enormous amount of work for a deduction that was legitimately yours all along.
Classification. Contractor-versus-employee decisions get made quickly under hiring pressure and rarely revisited. The cost of getting it wrong is not one year of payroll tax; it is every year of the relationship, with penalties.
Timing. Elections have windows. A Section 83(b) election runs thirty days from grant with no extension available. An S-election has a fixed date. A 1031 identification is forty-five days. These are the shortcuts that are genuinely unrecoverable: there is no reasonable cause argument that reopens a statutory window.
The answer is not to demand that nothing is ever done quickly. Businesses that try to eliminate every shortcut end up with procedures so heavy that the shortcuts multiply. The answer is to be clear about which steps are load-bearing.
In most finance functions that is a short list: perhaps five or six things. Segregation between the person who approves a payment and the person who releases it. Verification of a change to vendor bank details. Documentation of any position that is a judgment rather than a fact. Statutory deadlines. Those steps get no exceptions, ever, regardless of who is traveling or which client is waiting.
Everything else can flex. That distinction, a small number of absolutes and sensible flexibility elsewhere, is what discipline actually looks like in practice. Strong organizations do not rely on perfection. They rely on knowing which corners cannot be cut.
A control is not there for the ordinary case. It is there for the unusual one.
Donna R. Byrd, CPA, CIAManaging Partner, Alleviate TaxKeep reading
Strong controls are not created once and left alone. Four patterns explain almost every control failure we find in growing firms.
Read the article
The S-election is the most over-recommended move in small business tax. Here is the arithmetic that decides whether it is right for you.
Read the articleA 30-minute review is usually enough to tell you whether you are leaving money on the table, carrying compliance risk, or both.