Can Internal Control Be The Key To Longevity?

Thomas Frenehard

Co-workers working in computer roomBack in the 1920s the average longevity of companies in the S&P 500 index was 67 years, compared to just 15 years in 2012, according to professor Richard Foster from Yale.

It’s a safe bet that this has reduced even more since then. The question is, then: how can you ensure that your company is here for the long run?

Internal control journey: from pure compliance to delivering performance

In most companies, internal control is still addressed in much the same way as it was many years ago, using the same business structures and approach. Shouldn’t this change to focus more on performance?

I understand that there have never been so many regulations, and considering the increase in these last few years, I assume this isn’t going to slow down anytime soon. But I think companies need to be proactive rather than reactive in order to stay on top of things.

Picture this: You’re already doing internal control, so why not leverage all these controls that are assessed manually or automatically and shape them with a more performance-orientated intent?

Easier said than done, right?

I believe that progressing step by step can make this journey a lot easier than you would think. Of course, a big revamp will make this happen quicker, but the cost and resources required to do so might be too much in these economically challenged times.

My suggestion, therefore, is the following: During the regular internal process review, whenever creating or updating a control, try to associate it to an objective – not a control objective – a corporate objective. Ask yourself: What company value does this control relate to (delivering constant quality of service, releasing reliable financial communication to stakeholders, etc.)?

This is the first step, but not the most complex, and it’s a great step on this journey. Once this step is achieved, then comes the prioritization phase.

Select the corporate objectives that give you a competitive edge and collect all their associated controls. You will know precisely what controls can help you achieve your corporate objectives and what controls have a more regulatory focus. The great thing now is that you can follow your performance using controls that are regularly assessed. Like key risk indicators, these can feed you information on how well each department is doing, even allowing for a benchmark across divisions.

This means that you can investigate when one area is not performing as planned, and you can also focus your attention – or ask internal audit to focus – on the high-performing organizational units. These indeed might have implemented processes that are more efficient, and you might want to consider applying them to the rest of the group!

Combining a sound internal control process and linking it to strategy not only ensures that your current processes are running as designed, but makes you more sustainable in the short/medium term. Also, these processes are supporting your overall strategy and laying the path to a long-term viability.

So, is this the key to longevity? Unfortunately, I don’t have the answer, but protecting the value drivers of the company seems like a good starting point.

Is simplification part of your organization’s long-term strategy? See Business Simplification in Leadership.


Thomas Frenehard

About Thomas Frenehard

Thomas Frénéhard is a director in the Governance, Risk, and Compliance Solution Management team at SAP. His particular responsibility is with SAP Risk Management. Thomas's other functional areas of focus are in internal control and compliance management and audit management. In this role and in constant interactions with SAP’s network of partners, clients, and internal stakeholders, Thomas is responsible for bringing together technology, skills, and products to deliver an always-compelling solution for enterprise risk management.