The purpose of controls
Managers and assurance providers have usually got a good handle on the management controls in place in their organisation. Although there are various definitions of a control, At Imergo, we believe it it is any action, procedure or operation that helps an activity or function achieve its objectives.
Controls are the response that managers employ to help manage the risks or uncertainties of an outcome. In short, they help organisations carry out their business in an orderly, effective way and contribute to the enhancement and protection of value created by an enterprise.
Different types of controls
Controls generally fall into four categories:
- Detective controls identify (undesirable) outcomes that have occurred and work best when it is possible to accept the loss incurred. An example of this is a financial reconciliation (where unauthorised transactions are detected after they have occurred).
- Directive controls steer an activity towards a desired outcome and usually encourage positive behaviour as part of an organisation’s culture. An example might be the existence of values statements that guide staff towards accepted behaviours and decision-making.
- Preventative controls limit or stop the possibility of an event happening, e.g. different authorisation limits and access rights within an IT system. It’s the mind-set of ‘prevention is better than cure.’
- Corrective controls adjust undesirable outcomes after they have happened and examples include the process to recover an overpayment to a supplier, insurance policies and business recovery plans.
Stories as organisational controls
On face value, storytelling may not be considered as an organisational control, but we would argue differently. Organisations are full of stories: stories about change, stories about values, stories about teams and collaboration, etc. Storytelling is a means of communication (itself a management control) but it also forms part of an organisation’s culture and its knowledge management arrangements, as well as being used effectively in collaborative environments such as project teams.
As well as its importance in organisational culture – both reflecting it and reinforcing the way people behave and how decisions are made – storytelling consists of data and information that can provide an indication of how an organisation works. On first viewing, ‘story data’ may appear unstructured, vague or fluffy and incapable of being used by managers and assurance professionals.
However, closer examination reveals that all stories have a structure and pattern that can be analysed and interpreted. Following this argument through, in the right setting and with the right techniques, data that exists in organisational stories can be evaluated to form a view of how well the organisation is working, or consciously used in the design of communication, e.g. to support change initiatives.
For us, stories fulfill at least one, but in practice many, of the above control categories: they can influence decisions and behaviours (directive), can alert managers to issues and problems to be addressed (detective and corrective) or can be used as cautionary tales to stop the repeat of past mistakes (preventative). When viewed through this lens, they are valuable tools to help in managing an organisation, but invariably they go unnoticed, unused and untested. At Imergo, we have developed tools for story-based assurance and management and an example of our approach can be found here.
Design and operation considerations
Control theory encourages assurance professionals to think about the ‘design and operation’ elements of a control. Applying this approach to the area of organisational stories and narratives, may result in the following considerations:
- Is the story type that is being communicated relevant to one or more of the organisation’s aims?
- Is it being told by the right person and what is the perception of this ‘narrator’ by the audience (i.e. their credibility, experience and knowledge)?
- Does it fit in with the organisational culture, language and house-style?
- Are the ‘channels’ of delivery for the story (i.e. audiences, grapevines, etc.) effective?
- Are the sources of the story reliable and credible?
- Is the timing of when the story is told a relevant factor?
- How aligned is the story to what goes on in the organisation – is it seen as something that could happen there?
- Are there any contradictory accounts that may undermine the main message of the story; how are these managed?
- Is there a way of measuring and codifying any effects or impacts of the story?
- What might be the longevity of the story – has it, or is it, likely to become part of the organisation’s folklore? To what extent might this limit or enable the progress of the organisation?
- Can the extent of the story’s reach and coverage be determined so that any adoption or acceptance of it by its audience can be ascertained?
- Is the narrative style or delivery of the same story adjusted to reflect the needs of different audiences?
It’s highly likely that as you read this, someone in your organisation is using a story to make a point – the project that went wrong, the behaviour of a nightmare employee who they share an office with, or that big contract that was won against all odds, under the noses of a competitor.
As human beings we are culturally and genetically inclined to tell and listen to stories and we naturally adopt such communication techniques in our work and personal lives. Many work spaces also promote such practices – from the over-used example of ‘the water cooler,’ to open plan offices and meeting rooms which encourage collaboration and sharing of information.
At Imergo, we believe that stories can be considered and used in the same way as traditional management controls. Advances in the assurance and audit profession mean that traditional controls based around validation of transactions and systems are being delivered increasingly through technological developments, releasing people to focus on other areas. The profession is also nudging towards examining and reporting upon areas such as organisational culture, albeit that this is still an emerging and maturing practice.
The use of stories and narratives provide a different, value-added and more engaging way for such professionals to evaluate the strengths and weaknesses of their organisations – we just have to be brave enough to start doing it.