Chapter 2: Grounding the Green Book in Reality

Objectives:

•  Identify reasons why most organizations do not achieve the ideal internal control structure described in the the Green Book

The Green Book describes control nirvana

The GAO Green Book lays out an ideal control structure – a nirvana for internal controls, if you will. And I have never encountered any entity that has achieved this ideal. Yes, I’ve seen some entities achieve control nirvana in some part or aspect of their business. But I have never seen an entire entity under complete control, and I doubt I ever will. In my experience, implementing the COSO model/Green Book for just one piece of an entity’s operation is rare. And I think that is a reasonable state of affairs.

So before we start dissecting the Green Book and seeking to meet its ideals, I want to take a few minutes to ground us in reality. I have a few stories that should do the trick, One is about Paco’s Tacos and McDonalds and one is about controls in my similarly tiny little business. First let’s talk about Paco’s Taco’s and compare it to a few restaurants I’ve patronized.

McDonald’s

If you have been to Austin in the past 10 years, you realize how crowded my hometown has become. Over the years, my commute to downtown at 8 a.m. has increased by 45 minutes. The Austin economy is great; the traffic is horrific.

In order to avoid the ridiculous traffic when teaching at the University of Texas or a state agency downtown, I leave the house an hour early and have breakfast and put on my makeup at a restaurant on MLK Boulevard. MLK Boulevard divides the UT campus from the state capital and offers a variety of breakfast options including McDonald’s, Taco Cabana, and a little locally owned Mexican restaurant I will call Paco’s Tacos. (Paco’s Tacos is not the real name of the restaurant, and you will see why I changed the name in just a bit).

On mornings that I am emotionally fragile and tired, I head straight to McDonald’s in order to minimize upset and frustration. I eat at McDonald’s quite a bit when I am on the road because I can count on their consistency and speed. I am pretty sure I ate the exact same biscuit with bacon in Alaska that I ate a few weeks later in Manhattan. The exact same biscuit! (Of course, I cannot prove that.) No matter where I am (and I have visited 48 states), my McDonald’s breakfast is always in my hand and correct within five minutes of my order. This is an absolutely amazing feat!

How does McDonald’s make my experience of their restaurants, nationwide, so consistent and, therefore, so comforting? Did I hear you say, “internal controls?” Yes, McDonald’s is one of the most controlled businesses I have ever encountered.

And that recurrent biscuit is not the only proof I have of their strong controls. My husband is a Diet Coke fanatic, drinking two liters a day, easy. Yes, I have expressed my concern for his health over this choice. But after years of resisting his habit, I have now become an enabler.

I sometimes stop at McDonald’s on the way home and get him two large Diet Cokes. And as a true soda addict, he wants more soda than ice in his cup. Once I asked through the drive-thru speaker whether I could get less ice and more soda, and the answer was, “No. Your total is $2.16. Pay at the first window.” It turns out that the soda cup travels along a conveyer belt, and a measured amount of ice and soda is automatically put into each cup. The attendant only has to place the lid on the cup. Wow. That is controlled.

Because I am an accountant, I know that this means that someone in the McDonald’s corporate offices has created an Excel spreadsheet analyzing the most profitable and customer-pleasing ratio of ice to soda. Does their entire organization suffer from OCD? (I saw a t-shirt recently that said, “I am CDO. It is like OCD, except the letters are in the proper alphabetical order!)

Paco’s Tacos

Now contrast McDonald’s to a neighboring restaurant, Paco’s Tacos. I tried Paco’s Tacos a few times because our weekly arts and entertainment paper, The Austin Chronicle, gave it a good rating and mentioned the fabulous refried beans. Any refried bean aficionado will tell you that good refried beans are cooked with pork lard. No vegetarian, low-fat refried beans will suit this Austinite!

So I went to Paco’s for breakfast one morning, and indeed their beans were good – really good. But nothing else was. My huevos rancheros came out all wrong, and it took them a half-hour to get my order to me.

But because the beans were so delicious, I went back a second time. But this was also my last visit because my order was wrong, it was late, and it was served by a man who had been sleeping on the street only an hour earlier. I might have been able to tolerate his smell and disheveled clothes, but what I couldn’t tolerate was the deep gash on his nose that needed stitches. I paid my bill without touching my meal and ran through the drive-thru at McDonald’s to grab that same old biscuit.

Plotting McDonald’s and Paco’s Tacos on a scale rating their internal controls that spanned from 0 to 5, McDonald’s is a 5 and Paco’s is a 0 or a 1!

The internal control rating scale 0-5

0 – nonexistent: internal controls are not applied at all
1 – initial: controls are ad hoc and disorganized
2 – repeatable: controls follow a regular pattern
3 – defined: controls are documented and communicated
4 – managed: controls are monitored and measured
5 – optimized: good control practices are followed and automated

The case of Taco Cabana

If you have never experienced Taco Cabana, then you are missing out. Think of it as a Taco Bell with margaritas and beer.

Because breakfast at Taco Cabana is tasty and interesting, I am willing to tolerate flaws in their internal controls system here and there. One morning, my huevos rancheros were topped with a cold pico de gallo instead of a warm ranchero sauce, they were out of napkins another morning, and I once drove away with coffee in my iced tea cup. I could go on. It isn’t just the food that gets messed up; they have money issues as well. The corporate office would probably like to know that the beautiful lady that works the cash register might give you an $8 meal for $3 if you chat with her about her kids.

Taco Cabana is a 3 on the internal control scale. They have written policies and procedures, and everyone knows what they are supposed to do, but it doesn’t get done all the time, for one reason or another.

Personally, I don’t think there is anything wrong with being a 3. I wish I was a 3 in more areas of my business.

An embarrassing story about me

I would like to be able to brag and say that I have never messed up or harmed any of my clients due to weak internal controls. But I can’t. As a matter of fact, a few years ago, I experienced a failure of epic proportions. OK, I didn’t threaten the welfare of humanity, but it felt epic to me!

I was sitting in the Austin airport on a Monday morning preparing to board the airplane when I got a call from my client in Kentucky. I was traveling to see them because my calendar said that I was to teach two full-day seminars for them on Tuesday and Wednesday. My client had called to ask me if I was lost!

My heart sunk, and I felt sick to my stomach. For over 17 years, I had never missed a seminar. But I was missing this one because I messed up the dates on my calendar.

I was getting busier than I could handle alone, and I was making little errors here and there that should have clued me in that I was headed for big trouble. And big trouble was in the form of 100 people waiting for me to show up to teach a seminar in a city over 1000 miles away.

After bowing and scraping and making it as right as I could with my client in Kentucky, I immediately started putting controls in place. One control was to hire an assistant to review all of my booking and sync them up with my travel reservations. Her suggestion to use the TripIt app has changed my life, by the way.

So, as you can see, I am not a 5! I can confidently rate myself a 3 in some areas of internal controls in my business, and I am a solid 1 in other areas. And I worked hard to get there, thank you very much!

Two main reasons we can’t reach control nirvana

And those stories allow me to make a few points about the reality of controls. When you combine the facts that most organizations are more reactive than proactive when it comes to controls and that controls are expensive, you can see why most control systems are pretty patchy and weak.

Controls are created because someone messed up

Just like laws, controls are created when someone does something stupid. Most of us don’t have the foresight to think ahead about consider the consequences of our actions or inactions. Most often, we wait until something goes wrong before putting controls in place. Think bike helmets, banking regulations, and the like.

I wish I had thought ahead and put controls in place before I missed that gig in Kentucky.

Controls are expensive

Why isn’t Taco Cabana more like McDonald’s when it comes to controls? And why isn’t Paco’s Tacos as strong as Taco Cabana when it comes to controls? It’s not a matter of will or culture. Much of it ultimately boils down to money.

Although I could really use the help, my assistant doesn’t help me pack my clothes when I travel. Recently, I taught a CPE seminar in Beaumont in casual sandals that were only one step up from flip-flops because I forgot my dress shoes!

As wonderful as being perfect in all of our business activities would be, Paco and I can’t put controls over everything because we simply can’t afford it!

Therefore, controls are patchy

I am afraid that most controls are applied in a willy-nilly, patchy fashion without any regard to risk. Most organizations’ internal controls instead barely hold everything together.

We all know that sometimes putting patches on things doesn’t really resolve issues. Issues that are approached systematically and methodically often hold better.

As we will see, looking through the Green Book, the GAO recommends a comprehensive, systematic approach to controls and, thereby, rejects quick fixes and patches. Patches seem cheaper and faster in the short run but, in the long run, you end up with an unwieldy, ineffective bureaucracy that halts operations and progress. Maybe you work in one of those?

Where are you on the scale?

Enough talk about me and Paco. Where is your organization on the internal control rating scale? Where is your specific function on the scale? Maybe you’d give your fellow departments a 2, but award yourself a 4. You are reading this book, which could indicate a higher level of consciousness about controls than the average bear.

No matter what you think you are, the Green Book is here to help you be a 5!