What to do when you know there are critical control deficiencies in your business
I was working for a global business in a regional finance leadership role. Internal Audit rotates their work so that each entity is reviewed every three years, and it was our turn.
The issue was that we had just launched a new business unit within our legal entity in the past 6 months. It was a greenfield opportunity, and it had a unique business model–at least when compared to the usual ways of working across the global business. We were treating it like a startup, focusing on growth and customer acquisition. It’s not that we made internal controls a lesser priority; rather the business was so new that we were still learning where all the control weaknesses were.
In consultation with the CFO, we had a decision to make. We could talk to Internal Audit and ask for an extension, explaining the situation and that we wanted to be better prepared for the audit. Or we could use the internal auditors as business partners and ask for their support in identifying the critical business areas that needed attention.
I talked to the Global Head of Internal Audit and made my recommendation to go ahead with the audit as planned, understanding there were control weaknesses, and asking for their support in identifying them. He agreed, and his team was happy to help. They were eager to look at the new business; an exciting opportunity, and a distraction from some of the more routine work they often faced.
When the audit report was issued to say it was bad would be an understatement. It was a disaster. There were multiple critical control deficiencies. This was unprecedented anywhere in the company. People were embarrassed, they were angry, heads were going to roll!
Back in the real world there was work to do. First, I had to manage the damage control. I explained the situation countless times to anyone who asked. More importantly, I had to clear the audit report. We had 4 months until the board of directors meeting where our audit results would be discussed. The CEO would be there, and he would have to account for the audit report.
The focus shifted to clearing the audit items. I took an inventory of all the control weaknesses. I prioritized them by severity and time to correct. I assigned each to the responsible individual and we agreed on a timeline to complete. Our goal was to have a 100% complete audit report before the board of directors meeting. I’m proud to say that we did it.
The CEO went in front of the board of directors with a clean audit report, signed off by the head of internal audit. And more importantly, our new business was under control.
