The Speed Bump Dilemma: Rethinking Controls

The misconception

There is a natural instinct in risk management: if something matters, put a control around it. If it matters a lot, put more controls around it.

And when something goes wrong? Strengthen the controls.

It sounds sensible. But there is a flaw in the logic:

More controls do not necessarily mean better risk management.

Controls exist for a reason. They might prevent something from happening, detect when something has happened, direct behaviour, or provide a mechanism for review and response. Individual controls should protect the functions, processes, people and activities they are designed around.

But every part of an organisation can make the same argument.

The question is whether those controls, taken together, are providing the right level of protection for the organisation and what it is trying to achieve.

And herein lies a trap.

The more controls we put in place, the easier it can become to rely on the control environment itself. Six checkpoints can feel safer than one.

But imagine a road with six speed bumps.

The driver might slow down for each one, miss some, or find a way around them.

You still have six speed bumps. But you may not have six effective controls.

If we rely on the process simply because there are six checkpoints, we may be placing more confidence in the control environment than its actual effectiveness warrants.

The control is an intervention. It isn't the outcome.

So the question isn't simply how many controls we have. It is whether they are actually providing the protection we need, in the circumstances in which they operate.

Consider the speed bump

Think of a speed bump as a control. It changes your behaviour, reducing the likelihood or potential impact of something happening without stopping you from continuing your journey.

Perhaps there is a school nearby. Perhaps children regularly cross the road. Perhaps visibility is poor. Whatever the reason, something about the environment means that normal driving behaviour isn't considered appropriate.

The speed bump is an intervention designed to influence that behaviour and, in doing so, mitigate the risk the road presents.

Its value comes from what it does in the environment in which it is used.

Now imagine putting the same speed bump on every road.

A quiet residential street? Perhaps.

A road outside a school? Quite possibly.

A motorway? Probably not.

The control hasn't changed.

The environment has.

A control therefore needs to make sense in the context in which it is being used. The level of control should be proportionate to the exposure it is intended to manage.

There is more than one way to control the road

A speed bump isn't the only option.

Intervention	How it influences behaviour	Control type
Stop sign	Relies on people seeing and responding	Directive
Speed bump	Physically interrupts the journey	Preventative
Lollipop person	Introduces human judgement	Directive
Traffic lights	Gives a clear directive	Directive
Bollards	Prevents access	Preventative
Speed camera	Captures speeding vehicles	Detective

These aren't stronger or weaker versions of the same control. They are different interventions designed to produce different behaviours and manage different aspects of the exposure.

The objective isn't to maximise control. It is to have enough control to manage the risk appropriately and within appetite.

Too little control can leave an exposure inadequately managed. Too much can create unnecessary friction, cost and complexity without providing equivalent benefit.

Sometimes a sign is enough. Sometimes it is a speed bump or a person. And sometimes no additional control is needed because what we have is already designed and operating effectively in the environment for which it is intended.

What are we giving up to get the control?

Every control changes something about the way work gets done. The driver slows down, the pedestrian waits, someone has to operate the crossing, or traffic stops altogether. In an organisation, someone might need to complete an approval, perform a reconciliation, document a decision or wait for another person to review something.

Every intervention has a cost. It might be time, money, management attention, administrative effort, delay or complexity. Or simply another step between deciding to do something and actually doing it.

This is where the idea of friction becomes useful.

If a control materially reduces an important exposure, then the time, effort or cost involved may be entirely justified. But if it doesn't, we need to consider what we are actually getting in return.

What if we have created significant effort without materially changing the exposure? Or added three more controls because the first one didn't work, without asking why it didn't work in the first place?

A control should help protect the organisation and what it is trying to achieve. The control itself isn't the objective.

When people can drive around the speed bump

Imagine a speed bump with a convenient way around it.

Most drivers might slow down and go over it as intended. But some might take the alternative route because they are in a hurry, the road looks clear, or they have simply learned that going around is easier.

The same thing can happen in organisations. People may find a way around an approval process, structure work differently to avoid triggering a control, or create an informal workaround because the formal process doesn't fit the circumstances.

Sometimes that will simply be a failure to follow the control. But sometimes the behaviour is telling us something about the control.

Perhaps it is impractical. Perhaps the circumstances have changed. Perhaps it is no longer proportionate. Perhaps it is addressing the symptom rather than the underlying exposure.

And if people are finding ways around a control, adding another layer may not be the answer. We may first need to understand why the alternative route looks attractive in the first place.

This is also where internal audit can add real value: looking beyond whether a control exists, or whether a procedure has technically been followed, to consider whether the control is practical and achieving what it was intended to achieve.

The right control, not the most control

The road doesn't stay the same forever.

A school may close, traffic patterns may change, a new road may be built, or the reason for putting the speed bump there in the first place may no longer exist. Organisations change too. Processes change, technology changes and the nature of the exposure changes. A control that was appropriate yesterday may no longer be the right control today.

The right level of control depends on the exposure, the circumstances and what the organisation is trying to achieve.

Good risk management isn't about building the organisation with the greatest number of controls. It is about having controls that provide appropriate protection while allowing the organisation to pursue its objectives.

An invoice approval may not achieve a strategic objective in itself, but it can help protect the organisation from inappropriate expenditure, error or fraud as the business pursues those objectives.

The challenge is making sure the control is proportionate to the exposure it is intended to manage, practical in the environment in which it operates, and capable of achieving what it was designed to achieve.

Sometimes that means adding a control. Sometimes it means changing one. Sometimes it means removing one. And sometimes it means recognising that the road has changed.

If the environment has changed, are our controls still fit for purpose?

Conclusion

So, perhaps the next time we see a control, we can think about it a little differently.

A speed bump might be exactly what the road needs. Or perhaps a sign would be enough. Perhaps the situation calls for someone to make a judgement in the moment, traffic needs to be stopped altogether, or access needs to be prevented.

The point isn't that one control is better than another. It is that each intervention changes behaviour in a different way, carries a different cost, and makes sense in a different environment.

And the same is true inside an organisation.

Controls help mitigate risk so the organisation can pursue what it is trying to achieve. The right control depends on the exposure, the circumstances and the behaviour we need to influence.

The road matters.

The destination matters.

And sometimes, the most important question isn't whether we need another speed bump.

It's why we put this one here in the first place.

Ken De Negri

BSc, MSc, FCCA

De Negri Advisory Pty Ltd

About the author

Ken De Negri is the founder of De Negri Advisory, providing governance, risk, internal audit and sustainability advisory services to organisations across Australia. If this perspective resonates with your organisation or you'd like to discuss how these principles could be applied in practice, feel free to get in touch.