A vital component of strong governance is a robust internal controls environment. A 14th century nursery rhyme still holds true today for companies as a reminder of the importance of internal controls. For those who haven’t heard the rhyme or have forgotten it:
“For want of a nail the shoe was lost.
For want of a shoe the horse was lost.
For want of a horse the rider was lost.
For want of a rider the message was lost.
For want of a message the battle was lost.
For want of a battle the kingdom was lost.
And all for the want of a horseshoe nail.”[i]
We may not have many kingdoms today, but we do have a plethora of companies–each a kingdom in its own way. In a company’s terms, the nail is akin to internal controls, whether at entity level, process level, anti-fraud controls or IT general controls. The shoe could represent a set of transactions, the horse an entire process, the rider a material reporting gap, the message the financial statements, the battle the capital markets or the stock prices and finally the kingdom the company. You can tweak the elements but the message remains clear.
This story has been repeated many times in the past couple of decades as companies get larger and more complex. At the same time, pressure on management is growing to meet the increasing expectations of stakeholders. The missing nails are often overlooked to focus on more pressing issues and bigger problems: upcoming mergers and acquisitions, the latest expansion plan, the new product launch, or Covid-19.
As the missing nails are allowed to linger, they slowly multiply and spread—and rapidly, soon what could have been stopped by replacing a nail needs a new shoe. The situation may spiral completely out of hand. An easy recovery may become either a massive financial charge or a cover up, and instead of things getting better, they come to a sudden end.
Common areas where missing internal controls are identified in companies in the region include:
- Revenue recognition of delayed invoicing resulting in under recognition of revenue
- Revenue recognition of the over estimation of percentage completion resulting in excess recognition of revenue
- Poor controls over cut-off procedures
- Lack of robust financial close processes
- Under accruals of expenses and liabilities
- Lack of documented policies, procedures and delegation of authority
- Absence of a robust legal compliance framework and fraud risk management
- Poor controls over bank reconciliations, vendor reconciliations and inter-company reconciliations
- Absence of checks on segregation of duties
In the last two years alone, companies had to adapt to Covid-19 with remote working, which brought its own set of challenges to systems and processes. Cryptocurrencies are also exploding into the mainstream along with climate change, environmental, social and governance (ESG) policies and decarbonization. Companies in the region–which were just getting accustomed to VAT–will soon need to also adapt to corporate taxes and the new global minimum tax regime. It is critical to ensure that processes and controls are robust enough to navigate these changes without losing a shoe or a rider along the way.
Many CEOs, CFOs and board members believe they should spend their time resolving urgent matters and leave the nails with junior management or individual employees. It has been proven that the tone at the top is the overarching factor that determines whether the company continues to grow. Regulators’ investigations into failures at companies like Enron, Worldcom, Xerox, Barings, and Satyam always come back with the same recommendations–make it mandatory for companies to establish proper internal controls and make boards, management and auditors responsible for testing these controls every year.
The Abu Dhabi Accountability Authority (ADAA), Insurance Authority (IA) and Securities and Commodities Authority (SCA) have also made it compulsory for companies in the UAE under their remit to move in this direction.
Organizations should not wait for regulators to fix their nails. They would do well to instead proactively establish a strict internal control framework—and while we are immersed in childhood memories—bearing in mind that “all the king’s horses and all the king’s men, could not put Humpty together again”.
