Without clean bookkeeping, your finance operations will grind to a halt. I’ve seen it before, and it’s painful. It’s all so much easier when you have the right tools to help you. Let’s hear from Ledge, this season’s sponsor.
Is your team struggling with slow, error-prone manual reconciliations?
Meet Ledge, a finance operations platform that automates transaction reconciliation & double-entry ledgering and provides real-time cash flow visibility and reporting. Ledge automates workflows across your ERP, banks, payment processors, and other sources – no R&D or IT required – and makes sure you can properly account for cash movements even with a high volume of transactions and complex flows.
Make transaction integrity the foundation of your business. Check out Ledge.
Uncontrolled
“I’m glad you’ve joined. Now that you are on board I can show you this…”
My new boss handed me a piece of folded paper he’d pulled from his jacket pocket.
It was the second day in my first-ever Business Unit CFO role. And now I was working for a CEO who was entrepreneurial, to put it mildly.
I hadn’t worked with anyone like him before, and that was the appeal.
The business was a rocket ship. Explosive organic growth and a carnivorous M&A strategy. A potent pairing.
Whilst the BU had reached $1bn revenue, it had done so at warp speed. It was big but immature. Different from anything I’d seen before.
I was about to find out how different.
I opened the piece of paper and read it. It was a copy of a letter to a commercial partner dated six months earlier, promising them a payment in another six months as part of the settlement of a large negotiation.
Accounting alarm bells were ringing. The number in the letter was huge. $20.7m. While this was well over a decade ago, I’ll never forget it.
I didn’t yet know what audit materiality was, but I was certain it would be less than $20m. At first glance, at least half of this should have been in reserve by now. I was sure it wouldn’t be in any forecasts. Or earnings guidance. Yikes.
I was going to ask him if this had been accounted for, but I already realized this was a dumb question. We wouldn’t have been having this conversation if it had.
So I skipped a step:
“Tell me you aren’t the only person who knows this exists.”
He laughed: “No, of course not...”
I relaxed a bit.
“... now you’ve seen it too.”
A real ‘WTF’ moment.
I had a functional reporting line to the Group CFO. A strange old boy from a hard accounting background. The sort that felt the whole business was here to serve the accounting function, rather than the other way round.
I hadn’t gotten to know him well yet, but I knew he’d hate this. Rightly so.
And thanks to my maverick new boss, it was going to be up to me to break the news.
Wow… this is what it looks like when financial controls don’t keep pace with the growth of a business.
This is part 2 of a 3 part series exploring financial controls.
Balancing Control with Growth
This week we will start with a bit of theory, and then show how you can apply that theory.
Conventional finance wisdom is that more financial controls = better.
Last week we debunked that.
There is a trade-off between control and speed of execution (cost).
Operating with weak controls is expensive. Leakage.
Operating with overbearing controls is expensive. Lost growth.
There is a sweet spot.
So where is that sweet spot? It depends on the level of complexity in the business.
Here's a simple example:
Having a purchase order process in a small, founder-dominated business might slow things down. With no real benefit.
But, in a more complex organization (with decentralized decision-making), a purchase order process can stop costly mistakes.
The job of the CFO is to make sure the control environment evolves as the business evolves, at just the right pace:
The x-axis is business complexity. Keep in mind I don’t mean the stage of the business life cycle (i.e. startup, scale-up, growth, mature, etc). It’s not about big vs. small. It’s not about public vs. private.
This is a common misconception.
Does a mature, or big, business, need more sophisticated controls than a startup?
No, not necessarily.
A small start-up that holds customer funds is complex. It needs more sophisticated banking controls than a large, mature founder-owned business.
Failure to understand and honor this was at the center of the downfall of FTX. In the civilized financial world, there are strict rules on controlling customer funds.
But this wasn’t the civilized world. It was the crypto hypermania of the early 2020s. And without controls, the temptation to misuse customer funds was too great. They were here on the curve:
More on what happens when controls implode next week.
So, what does that complexity evolution look like? What are the stages? And what is the Minimum Viable Control Environment at each stage?
- Effective Autocratic Control
- Accounting Controlled
- Distributed Control
- Distributed Balance Sheet
- Public Interest Company
Let’s bring this to life:
1) Effective Autocratic Control (i.e. single convenience store)
Picture here the single convenience store owner. The owner counts cash at the end of the day. They make every payment. It’s the most efficient way they can guarantee their money doesn’t end up in the wrong hands.
Lean but effective financial control is a competitive advantage. This is a key advantage small businesses have. In many SMBs, the owner IS the control.
They sign off every ACH run. Check the bank balance every day. They know exactly what inventory they have and where. And there is no way any leaver is being paid by accident.
It’s also common for a founder to delegate this to one trusted person.
Note the word ‘effective’ in the title of this stage. Many businesses continue to operate this way long after it continues to be effective. Think: the founder that can’t let go, or won’t trust anyone else even as the business grows.
Minimum Viable Control Framework at this stage Includes:
- Banking and payment controls
- Physical inventory controls
- Pricing and sales invoicing controls
- Basic bookkeeping
- Monthly or quarterly P&L statement
- 13 Week Cashflow Forecasting
Note these are examples only, what is right for your business might be different.
2) Accounting Controlled (i.e. 10 convenience stores)
Now you have a chain of 10 convenience stores. The owner is still making all business decisions. However, the transaction volume is too big for one person to handle. They have a small central accounting team who coordinate the cash management and payments. Likely, the owner (or a single finance leader) is still making every decision.
So a bigger accounting function is necessary. There will still be a dominant controller. However, an accounts receivable team/individual will manage customer receipts. And likewise supplier payments with accounts payable.
This means distributing the trust beyond one person. But still within one small accounting team. Segregation of duties becomes important at this stage, as do review controls. It ensures that any mistakes (or fraud) have to get past a second pair of eyes.
Minimum Viable Control Framework includes (in addition to Stage 1):
- Segregation of duty controls on payments
- Bank account signatory rules (limits)
- Simple annual budget
- Monthly P&L statement vs. simple budget
- Monthly balance sheet fluctuation analysis (month-on-month movements by account)
- Finance administered purchase orders
3) Distributed Control (i.e. 50 convenience stores)
Now you have a chain of 50 stores or more. It’s too large to have all decisions made in one place. The owner/CEO no longer manages the supply chain. There is a procurement team. HR handles new hire decisions. There is trust that they are making great decisions on behalf of the business.
But they need a framework to operate inside. A framework of controls.
At this stage, you need to start evolving control beyond the finance team and into the wider business.
Department heads need the ability to commit to spend, and make decisions. All without having to run everything directly through finance. This is where systems and processes become more complicated. The permutations of decision and transaction flow increase exponentially.
And so do the points of failure.
Managing financial control through absolute control (i.e. finance handling everything) is not difficult. It’s hard work, but it isn’t difficult. Moving to where you have to control through others (outside of finance) is difficult.
Many business owners get stuck at gate 2. Their entrepreneurial brilliance carries the business into stage 3. But the control maturity can't keep up. As a result, they are losing money (through real losses or lost efficiencies), usually without realizing it.
There is also a whole population of controllers who can’t evolve to this stage. They only have the capability to control effectively through absolute personal control. This is career limiting.
Minimum Viable Control Framework includes (in addition to Stage 2):
- Extend purchase order access to non-finance contacts (finance second sign-off)
- Departmental budgeting
- Monthly balance sheet reconciliations
- 3-statement monthly budget
- Monthly reporting vs. budget
4) Distributed Balance Sheet (i.e. large multi-channel retail)
Now you have a complex grocery operation. 200 convenience stores. 50 supermarkets. 100 pharmacies. And about to launch online. Different businesses, with different dynamics. Maybe with different ERPs (due to acquisition). Rather than bringing the transactions to a central function, the nuances are best served by moving the point of control closer to the risk.
Stage 3 has many interfaces with the business. But now you are at a complexity where the financial control itself is distributed.
This means instead of one team, and one controller, you have multiple accounting teams. The business has different teams managing different parts of the balance sheet.
That means distributing the risk of controlling into different parts of the business. That creates a new requirement to properly consolidate those different controlling functions.
I see many businesses fall over on the shift from stage 3 to stage 4. It requires an elevated level of sophistication in the finance team.
Internal Audit plays a crucial role at this stage. Their perspective and oversight are invaluable in ensuring nothing falls through the cracks. Every good CFO I’ve seen is paranoid about this risk.
I shared an anecdote about the importance of perspective and oversight last week. Adam failed to understand that the risk of transactional control was his responsibility. He felt it sat with the corporate team, as had been the case in his previous business.
That was an unforgivable flaw in his approach.
Minimum Viable Control Framework Includes (in addition to Stage 3):
- Balance sheet accountability matrix (who is responsible for which part of the balance sheet?)
- Role of Internal Audit
- System controls
- Balance sheet certifications (for each Director of Finance/CFO)
5) Public Interest (i.e. grocery behemoth; i.e. Walmart)
The business is now of a size, structure, and/or complexity that the stakeholders extend well beyond the business itself.
You may be a public company with retail investors. Or a significant employer for a region. Supply chains depend on your prosperity. Like it or not, your business is a matter of public interest. Controls need to be designed to protect a wider set of stakeholders
Sarbanes Oxley exists to prescribe how these complex companies approach controls. A ‘risk and control first’ approach to managing your business is no longer optional.
Formal risk management protocols become embedded in the planning cycles. The scope of the audit is significantly increased.
This is difficult to comply with, without the right culture for embedding controls. This is why a natural progression from stage 1 to stage 5 is important. It’s hard to get what you need from the business at stage 5 if you haven’t graduated through the first four stages.
But public companies aren’t the only ones that need to think in these terms. Charities, banks, insurance companies, etc. all have a duty of care to the wider stakeholders they serve. Regardless of size.
FTX struck a chord because SBF and others lost customer money. These customers were speculating on the prosperity of FTX itself, without realizing it. All due to FTX's fraud.
FTX was a stage 5 company, being managed like a stage 1.
Throwing enough dollars at that control environment is how you end up with one of the biggest frauds in history.
Minimum Viable Control Framework includes (in addition to Stage 4):
- Whistleblowing controls
- CFO/CEO officer certifications
- Controls certifications for senior officers
- Audit Committee
- External audit of controls
- Tighter controls over custodial funds (charitable/client money)
The Unsung Hero
Each stage requires different levels of understanding and expertise. But there is one common theme: the financial controller. If you have the right controller at each of these stages, it makes your life as a CFO a lot easier.
A great controller in a stage 5 type business, will be different from a great controller in a stage 3 business. They are very different jobs.
Some controllers can grow with the stages, some cannot. As CFO you need to get this judgment right.
Your job depends on it.
In the final week of the series next week, we will talk about fraud and what to do in a situation where controls are compromised.
The Bottom Line
- As CFO in a changing business, you must evolve controls at the right pace. Too slow and you’ll drop the ball. Too fast and you’ll kill growth.
- Match the type of controller you need to the specific control environment you want.
- Don’t use an airbag as your seat belt. Internal Audit is an airbag. Accounting and Reporting Teams are the seat belt.
This post originally appeared on https://www.cfosecrets.io/.
