Control or chaos: impact of workarounds on internal controls

Abstract

Purpose -There have been many studies that investigated the causes of workarounds, but there is less research on their outcomes, such as the impact on internal control. This study aims to investigate the use of workarounds by a multinational organization that implemented SAP about 10 years ago, and how those workarounds affected internal controls.Design/methodology/approach -A qualitative study is performed by analyzing interviews with company personnel for a multinational organization. Employees selected for interviews are primarily users of SAP's accounting functions.Findings -Workarounds have significant impacts on the internal controls over financial reporting.Workarounds cause compensating controls to be implemented, which are often manual in nature, and decrease the organizational efficiency and effectiveness.Research limitations/implications -Workarounds become integrated into an organization's activities to meet its business needs. This research raises questions to determine when maintaining organizational efficiency and control outweighs the need to provide customer service and other business needs.Practical implications -Companies should consider whether their business processes can be modified to ensure that they can be handled within the enterprise system. In addition, the number of compensating controls required due to workarounds may decrease the organizational efficiency expected from having an enterprise resource planning system to ensure the integrity of financial information.Originality/value -This paper moves beyond finding the causes of workarounds, and expands what is known about workarounds and their impact on an organization. An important contribution of this study is to consider the intersection of workarounds, ERP systems and internal controls.

Internal control through the lens of institutional work: a systematic literature review

“…Several authors highlight the importance of the whole top management team (e.g. Pernsteiner et al 2018;Petrovits et al 2011;Chernobai et al 2011;Huang et al 2009;Mikes 2009;Ashbaugh-Skaife et al 2008;Patterson and Smith 2007;Roberts and Candreva 2006), since it possesses the necessary executive power to implement or deny changes in control systems. Moreover, top management is said to have unique interests in a firm's well-being, especially if a significant amount of wealth is bound up in stock holdings (Chernobai et al 2011).…”

“…Middle managers are thus free to conduct business any way they want, including to potentially change or implement new internal controls to ensure successful business without the guidance of corporate policy. Pernsteiner et al (2018) explore another interesting issue: the effect of ERP systems on the internal control system of organizations. They find that managers often have to implement workarounds because the initial ERP system does not allow for special requests.…”

“…In the case outlined in Woods (2009), the internal control practices were similarly maintained and gradually formalized through the introduction of a professional IT system that could process internal control and risk management issues more efficiently (see also Huang et al (2009) for an example of a possible detecting mechanism that can aid internal control). Pernsteiner et al (2018) likewise show that the introduction of an ERP system shifts the work of management accountants away from routine processes that can be completed by the system toward more strategic work. At the same time, their study also shows that if the ERP system is not thorough enough and top management decides to avoid pricey updates of the system, the management accountants will have to go back to their own manual ways of controlling the processes through spreadsheets.…”

“…The lower-level management accountants thus need to exercise a great deal of reflection on the process that is imposed on them and find solutions to make the process work. Unfortunately, Pernsteiner et al (2018) clearly show that the solution of having both an ERP system that is known to be faulty throughout the organization, and workaround solutions on the local level, led to a situation of chaos in the company. This highlights the importance of routinely updating the IT system in order to avoid internal control flaws.…”

Corporate social responsibility, internal control, and firm financial performance

“…Research on internal control has focused on the influencing factors and consequences. Examples are the internal audit department ( Oussii and Taktak, 2018 ), audit committee ( Lisic et al, 2016 ), the top management team ( Roberts and Candreva, 2006 ), board diversity ( Monem, 2011 ), CFO career diversity ( Campbell, 2007 ), ERP system effectiveness ( Pernsteiner et al, 2018 ), internal audit function ( Woods, 2009 ), and external competitiveness ( Rothenberg, 2009 ), can indirectly or directly affect the effectiveness of internal control. The effectiveness of internal control, in turn, has implications for firm risk management, audit quality, financial reporting quality, financial innovation, and financial performance ( Otley and Soin, 2014 ).…”