2 Why study internal control?
Next week you have an exam. Your friend & classmate asks you for the time of the exam. After checking the course manual, you answer ‘11:45’. On the day of the exam, you meet your friend and show up at 11:30 at the exam location, to participate in the exam that’s supposed to start in 15 minutes. But, horror, the exam actually took place at 09:45!!! Your friend starts crying and you are in shock.
What happened?!?
This is a case of using unreliable information - information you should not trust. The course manual was not properly updated and anyway, for exam times, you should have checked the university timetables application. Wouldn’t you wish there was a procedure in place which would dictate the use of standardized course manuals with only content information, and not organizational information (such as rooms and times of classes and exams)? Internal control procedures would have taken care that you would have had access to reliable information.
2.1 It´s not about scandals!
One answer to the question ‘Why use internal control?’ is ‘If you don’t use internal control, you get in trouble’. Examples of when internal control fails are a good way to understand its relevance.
2.1.1 Theranos
The charismatic, Steven-Jobs-like character, Elisabeth Holmes, was very convincing when selling the story behind Theranos. When she was little, Elisabeth was scared of having her blood drawn. Who wouldn’t be? This traumatic experience of having blood drawn led her to found Theranos, a Silicon Valley based health-care company aiming to quickly process a full range of laboratory tests (from cholesterol to cancer tests) from only a few drops of blood. Imagine how many lives can be improved from such a product. Imagine the small kids, with even smaller veins, who need to have have blood drawn, sometimes multiple times a day. With only one small pinch of a needle in a finger, Theranos’s product could get sufficient blood for a full set of tests. If this product proposition sounds too good to be true, then you are on to something.
Although by 2015 Theranos was valued by venture capitalists at around $9 billion, the investments received from private investors were not enough to fund its ambitious products. In 2015, Theranos was forced to take a loan whose terms included the production of audited financial statements. In the process of auditing the financial statements of Theranos, the auditors discovered that the company was not complying with rules and regulations for blood testing. In 2017, the OUM & Co.’s audit company issued a going concern opinion (which means that ‘we don’t think your business can survive one more year’) on the 2017 financial statements of Theranos and, indeed, by 2018, Theranos collapsed. It turns out that Theranos was not complying with rules and regulations on blood testing, and was lacking an internal control system because it was trying to hide a failed product. Here, the lack of internal control was a sign of a company being out-of-control.
2.1.2 Wirecard
Auditor: ‘We cannot trace €1 900 000 000 cash supposedly held in two Asian Banks.’
Investors: ‘WHAT?’
……………………………………..
Who doesn’t love a good Cinderella story? Cinderella, in the form of a small little-known Bavarian processor of payments for gambling and porn, went to the ball (hosted by the Deutsche Boerse) and made a lot of money. Wirecard’s share price went from €4 in 2009 to €200 in 2018. The company was the German version of a Silicon Valley-type of company, innovative and full of potential - a sure gain. But, as the story of Theranos above, Wirecard was also hallucinating its success.
From the 2020 collapse story of Wirecard, we can safely assume that Wirecard failed to implement good internal controls on cash. Cash is very important for a company because cash shortages may lead to bankruptcy. As such, almost all accounting textbooks have a chapter dedicated to the control of cash. One item discussed in these chapters on the control of cash is the bank reconciliation control. In a bank reconciliation you check what you recorded as cash transactions against what the bank statement says (where the bank statement represents the source of truth). Ideally, the difference between your records and the bank records is minimal. In the case of Wirecard the difference was indeed minimal, but only because Wirecard invented the bank statement information altogether. Wirecard claimed to have (a lot of) cash with Singapore’s OCBC Bank and later on, when it turned out that Wirecard had no account with the OCBC Bank, it claimed that the cash had been moved to two banks in the Philippine. So, the bank statement information was imaginary, and not a source of truth. At Wirecard, the internal controls failed because they were just paper exercises instead of responsible applications of the concept.
2.1.3 Luckin coffee
Ailing (Eileen) Gu, born and raised in California, decided to compete for China in the Beijing 2022 Olympics. Not only that, but she went on to become the biggest start of the Olympics, winning a historic one silver and two gold medals in her sport. Her controversial decision of competing for China instead of US, and her resounding success made Eileen Gu into a positive public figure. Lucking coffee was lucky to associate themselves with Eileen Gu. Lukin coffee’s Gu-endorsed drinks sold out and managed to get the company out of from the shadow of fraud allegations.
Luckin coffee was founded in 2017 but grew rapidly due to its use of small pick-up locations that served coffee in office buildings and college campuses based on online orders. At the beginning of 2020, Luckin coffee surpassed the presence of Starbucks in China and was trading on Nasdaq U.S. stock market for up to $50 per share. In April 2020, the company revealed that it had inflated its 2019 sales revenue by up to US$310 million by selling redeemable vouchers for tens of millions of cups of coffee to companies that had ties to Luckin’s chairman and controlling shareholder, Charles Zhengyao Lu. These redeemable vouchers were falsely booked as revenue because they were never redeemed; the customers did not actually use them to buy coffee.
The first actor to disclose irregularities with Luckin was the short-seller company Muddy Waters. Muddy Waters analyzed over 11.200 hours of video footage of Luckin stores. According to the footage, the number of customers could not have been as big as the sales of Luckin indicated. This review of external data with the purpose of confirming company numbers is an analytical review type of control where you check what-is against what-should-be. This control can be implemented by the company but in the case of Luckin coffee, the fraud was at the top, making any control attempts useless.
2.1.4 Enron, WorldCom, Arthur Andersen
Scandals don’t go unnoticed and sometimes result in huge regulatory changes. In 2002, after a series of corporate debacles involving companies such as Enron and WorldCom and the resulting demise of Arthur Andersen audit firm, the US congress passed the Sarbanes-Oxley Act (SOX) to restore investor confidence in the capital markets and the audit profession. Especially sections 302 and 404 had a big impact on organizations. According to section 302, CEOs and CFOs of companies are responsible for internal control: they need to evaluate the effectiveness of these controls and report this evaluation. If an internal control weakness is identified, then the officers need to report this weakness. Section 404 mandates the annual filling of an internal control report to the Securities and Exchange Commission (SEC).
Is there a problem that SOX was enacted in 2002 and the frauds I use as examples are from 2018, 2020 and 2020? I guess this shows that doing internal control on paper is not the same as actually having internal control (owning internal control). To me, it underscores the fact that an understanding of internal control by everyone in a business is needed.
2.2 Job market
Now let’s turn to a positive view on internal control.
When you study internal control you develop skills which are very important if you plan to be an auditor, a manager or an other employee. An auditor needs to check the internal control system, the manager needs to approve the internal control system, and the employee needs to implement the internal control system. Internal control also forces all these parties to deeply understand how organizations function (through, for example, the visualization of organizational processes). So, I would say that it’s important to know about internal control.
In general terms, I think that learning about internal control teaches you to set goals, implement activities which allow you to reach goals and measure the achievement of these goals. It’s like you are implementing Atomic Habits1, but for organizations!