INTRODUCTION

This paper introduces a potent internal control concept. Called "control triggers," these controls initiate the right activity at the right time. They play an important role in the control systems of any organization, but especially in high performance systems.

Curiously unrecognized before, a brief study of some history may help explain the oversight.

The last half century has seen a growing concern among accountants, auditors, and managers with respect to internal control. As part of the process of attestation of financial statements and in contrast to the first half of the 20th Century, external auditors today rely heavily on their examination and evaluation of internal controls. Established in 1985 in response to increasing concern about fraudulent financial reporting, the Treadway Commission recommended a broad range of internal control applications, encompassing virtually all of management policies and procedures. Management's growing concern over internal control has even spawned an entire profession, maturing only in the last 20 to 30 years: internal auditing's primary focus is on the design and practice of good internal control.

As might be expected, given the several objectives of the interested parties, diverse perspectives and attitudes have arisen regarding internal control. Operations managers, financial managers, accountants, internal auditors, and external auditors have had different, and even opposing, notions of what internal control is and should be. In 1992, a report was issued by a committee sponsored by the major professional organizations interested in internal control: the American Institute of CPAs (AICPA), the Institute of Internal Auditors (IIA), the Financial Executives Institute (FEI), the Institute of Management Accountants (IMA), and the American Accounting Association (AAA). Internal Control--Integrated Framework, the report of the Committee on Sponsoring Organizations of the Treadway Commission, or "COSO", as it was called, attempted to integrate, unify, and harmonize these notions. The report represents the most recent and broadest-based effort to establish generally accepted practice, or the "doctrine", of internal control [Coopers & Lybrand].

Throughout this growth of interest and activity, the core of internal control has remained embedded in the theory of bureaucracy. In rewriting management theory, the quality revolution's dismantling of bureaucracy now exposes some weaknesses in traditional approaches to internal control. Fundamentals of the new management practices, such as customer-focus, empowerment of employees, just-in-time production, poka yoke systems, and partnering frequently seem inconsistent with traditionally recommended internal control practices. There is a need to rethink much of what we have accepted as good internal control.

This paper recommends control triggers as one control concept as a step toward that objective. The main points of this paper are (1) that control triggers compose an important internal control concept, (2) that they previously have gone unrecognized as such, (3) that control triggers are important to the control and application of operations, and (4) that they are critical to the application of what may be described as world-class management practices.

THE BASIC ARGUMENT

The following section provides a proof of the argument in this article through the use of simple rules of deduction:

Premise 1

The most fundamental control objective is to assure that the right thing happens at the right time.

Organizations are created to achieve various goals and objectives. In order to achieve those purposes, organizations do specific things--e.g., produce and sell products and services. In the process of doing those things for which the organizations were created, they do a variety of other things--e.g., hire people, build production lines, buy inventory, collect money, pay bills, and so forth. In addition to things being done by organizations, things happen in organizations--e.g., people learn, production processes change, etc.

Good control assures the right things are done and the right things happen in order to achieve an organization's purposes, generally expressed in the form of objectives and goals. This point is fundamental to successful operations. "The overall control system...is...used by an organization to achieve its objectives and goals." [IIA, 300.06.4] Because timing is critical, good control also assures that these right things are done at the right times.

Premise 2

A related fundamental control objective is to avoid anything else.

Although logically redundant, this second premise bears a psychological dimension different from Premise 1. The IIA standards define three categories of controls: preventive (i.e., to "deter undesirable events"), detective (i.e., "to detect and correct undesirable events which have occurred"), and directive ("to cause or encourage a desirable event to occur") [IIA, 300.06.1]. While directive controls relate specifically to Premise 1, preventive and detective controls deal with avoiding anything other than the right thing at the right time.

Remember that the overall purpose of controls is achievement-motivated--to achieve objectives and goals. Notice, however, that two of the three types of controls are avoidance- motivated--to prevent and to detect undesirable events.

Premise 3

The methods of such assurances may be described as "control methods," or simply as "controls."

"A control is any action taken by management to enhance the likelihood that established objectives and goals will be achieved." [IIA, SPPIA, 300.06] Examples of general control methods include the following listed by the IIA [IIA, 300.03.2]:

- Authorizing performance.

- Monitoring performance.

- Comparing actual with planned performance.

- Documenting activities.

The AICPA has specified five general control methods [AICPA, AU 319.11]:

- Authorization of transactions and activities.

- Segregation of duties that reduce the opportunities to allow any person to be in a position to both perpetrate and conceal errors or irregularities in the normal course of his duties.

- Documents and records to help ensure the proper recording of transactions and events.

- Adequate safeguards over access to and use of assets and records.

- Independent checks on performance.

General control methods uniquely defining bureaucratic organizations include:

- Functionally structured organization.

- Specialized division of labor.

- Limited span of control.

- Scalar relationships (i.e., chain of command) and unity of command (i.e., one boss per person).

With the advent of modern management methods and production techniques, new types of management practices have evolved. Because such practices are intended to influence the results of business operations, they may also be thought of as control methods. Examples include:

- Statistical process control systems.

- Quick change-over systems.

- Just-in-time systems.

- Cross-functional teams.

- Value analysis.

- Partnering.

All of these various methods are intended to assure the right things happen at the right times, and to avoid anything else.

Premise 4

A necessary element of such assurances is the initiation of the right actions at the right times to produce a desired outcome.

Causes are a necessary condition of effects. Accepting the principle of cause and effect, and given that action is the effect, then something must cause the action. Thus, in an attempt to influence the outcome of their processes, managers and workers utilize specific cues designed to initiate the right actions, leading to desirable outcomes. In the absence of such signals, there can be no initiation, resulting in no action, resulting in turn in no favorable outcomes.

Premise 5

By definition, methods of controlled initiation may be called "control triggers."

Control triggers are the things which signal, initiate, and cause a specific, correct action to happen at the right time. No action can be assured to happen at the right time without an appropriate trigger. Thus, no process can be controlled without a series of triggers systematically embedded throughout the system.

Six possibilities exist with respect to the initiation of an action:

- The right action can be initiated at the right time.

- The right action can be initiated at a wrong time.

- The right action can fail to be initiated.

- A wrong action can be initiated at the right time.

- A wrong action can be initiated at a wrong time.

- Wrong action can fail to be initiated.

The point of controlled initiation is to limit the outcomes to the first and last possibilities only: to initiate precisely the right action at exactly the right time, and avoid anything else. Any other possibility suggests a lack of control. Simply as a matter of definition, methods of controlled initiation may be called "control triggers." The point of a "trigger" is to initiate some action. The adjective "control" suggests the initiation of the right action, i.e., management's desired action, at the right time.

Obviously, some triggers are more effective than others. The better the quality of the trigger, the better the control. Faulty triggers may misfire, fire at the wrong time, or motivate some wrong action. Missing triggers fail to initiate action. Reliable triggers fire at exactly the right time, every time, and motivate precisely the right action.

Triggers may be either "built-in" (systemic) or "tacked on" (attached) to a process. They may be inexpensive or costly. They may be simple or complex. They may be formal or informal. Yet, for the right actions to consistently occur at the right times, control triggers must be present.

Conclusion

Therefore, control triggers constitute a necessary control method to initiate actions producing desired outcomes.

Under the rules of deductive logic, a conclusion must be true when the supporting premises are true. If the above premises are accepted as true, control triggers must be accepted as a control method necessary for all processes.

Perhaps as compelling as a formal proof is the simple intuitive appeal of the argument. The need for systematic means to initiate the right actions at the right times as methods of control would seem to be quite logical and instinctively appealing.

Because there are numerous possible control trigger methods, all of which may be differentiated from the others in some particulars, yet all of which bear the same essential characteristics of control triggers, they may be said to compose a category of control methods and a general control concept.

OBSERVATIONS ABOUT THE BASIC ARGUMENT

At least three observations may be made about the above argument:

Observation 1: Control Triggers have not generally been recognized as a control concept.

A search of authoritative auditing, accounting, and management literature, and interviews with recognized authorities in control theory and practice, failed to identify a reference to activity initiation as a control concept--by the name of "triggers" or by any other reference.

The concept of "triggers" as a class of control devices or methods is also not addressed in main stream engineering control theory. The engineering concept of "actuators" seems to be closely related, but not synonymous. "...[M]achine output...[is] initiated by prime movers...[called] actuators...." [Lentz, p. 64.] The discussion of actuators, however, suggests that while they may motivate some machine action, they do not of themselves "trigger" a specific action at a specific moment.

Consider, for example, a forced air gas furnace system [Eveleigh, pp. 3-4]:

"An electronic thermostat, or temperature sensor, is placed in a central location....When the room temperature drops below a preset reference level, a relay is actuated to turn on the furnace fire. When the temperature in the furnace air duct system reaches a reference level, a blower fan is activated by another relay to force the warm air throughout the building. When the room temperature reaches a maximum limit...the furnace is turned off. The blower runs until the residual heat in the system has been dissipated and then also turns off automatically....The actuators in our gas heater system are the furnace fire and the blower." (emphasis added)

Note the difference between the "actuator" and the "trigger" in the above example. While the furnace fire (actuator) motivates the initiation of the blower fan by increasing the heat, the "trigger" to actually turn on the fan is the thermostatic switch which trips the fan relay. Again, while the blower (actuator), by moving the heat through the system, motivates the turning-off of the furnace fire, the "trigger" to turn off the furnace fire is another thermostatic switch. Without these switches as control triggers, the specific actions critical to the success of the system would fail.

Observation 2: Control Triggers are important to all organizational processes both in traditional bureaucracies and in today's new management environments.

Regardless of the organizational context, actions of many types are taken. All actions are specifically initiated in some way--i.e., they must all somehow be "triggered" or they would not be undertaken.

The importance of the role of control triggers becomes clearer when we understand that some actions are improperly initiated, or are initiated at the wrong times. In other instances, actions may fail to be initiated due to missing triggers or trigger malfunction. In such instances, the related operating systems are ineffective, inefficient, and/or dysfunctional. In other words, they lack internal control.

Observation 3: Control Triggers are particularly critical to world-class performance.

Much has been written in recent years about time performance becoming the chief distinguishing feature among today's new generation of successful companies. World-class management success is specifically dependent upon the speed and accuracy of actions taken in response to changing conditions. Thus, in an environment of time-based competition, the importance of precise, dependable control triggers is greatly magnified.

For example, control triggers are in fact the central feature of kanban systems. A kanban signal--in whatever form that signal may take--that indicates a need for a resupply of work from the previous work station, triggers a specific action (the resupply of work) at a specific time (the moment of signal). Thus, the signal, or trigger, is in fact the heart of the kanban system. As a second obvious example, the success of statistical process control rests squarely upon triggers which control feedback and adjust the production process.

ILLUSTRATIONS OF CONTROL TRIGGERS

A portion of a typical flow chart of a purchasing function can help illustrate "control triggers." Exhibit A shows the purchasing process from the preparation of a purchase requisition in the stores department to the filing of one copy of the purchase requisition with a copy of its related purchase order delivered from the purchasing department. Exhibit A (see published article for Exhibit A) has four columns: the first shows the flow chart itself; the second states the control objective at each trigger point (what action is to be initiated); the third identifies a typical control trigger to fill that need; and the fourth column states the control risk related to trigger failure.

(Note: Exhibit A is not available on this Web page. See the original article in Internal Auditor.)

The control objective of the first trigger point on the flow chart is to initiate the preparation of the requisition. An example of a simple trigger at this point is a verbal request by the stores supervisor. In a more sophisticated JIT environment, the trigger signal might be initiated by the MRP computer system which senses a need for the item to be requisitioned. In either case, without a proper trigger, the control risks include failure to order the needed item, ordering the wrong item, and/or ordering the correct item at the wrong time.

The control objective of the second trigger point is to initiate the delivery of the completed requisition to the purchasing department. Again, the control risk here is the failure to order, or perhaps a delay in the order due to delayed delivery of the requisition. In this case, specific times may trigger such delivery, at say, 11 a.m. and 4 p.m. daily. In sophisticated, paperless systems, the delivery of a requisition may be automatic, triggered by a simple keystroke on the computer keyboard.

The control objective at the third trigger point is to initiate filing of the second and third copies of the purchase requisition. The control risk is the loss or misplacement of these documents. A typical control trigger in simple systems such as the one depicted here would be placement of the copies in a file clerk's in-basket. The presence of the documents in the basket triggers the filing action by the clerk. Again, in computerized systems, such filing (on disk) may be triggered immediately and automatically by a keystroke.

The control objective at the fourth trigger point on the flow chart is to match and compare the purchase order completed by the purchasing department with the requisition. The related control risk is a failure to check the order for errors, and thus to risk erroneous orders and subsequent inefficiencies in the purchasing operations. The arrival of the copy of the purchase order could act as the trigger for the stores clerk to make the comparison.

The control objective of the fifth trigger point is to file the paired documents in a timely manner. The control risk here is lost support documentation for the purchase. A simple control trigger to initiate filing might be the stapling of the two documents together.

Again, were this system automated, certainly, it would be a simple matter to illustrate systemic computerized control triggers satisfying the same initiating functions in the process. The point of the example is to illustrate the major role that these very simple triggers play in a control process. Without them, an accurate purchase would not occur in a timely manner, and the supporting documentation would be faulty, at best. Such triggers are present in every system, yet they are largely taken for granted. Because their importance to internal control has not been formally recognized, too often, little thought is given to their design and little effort is made to measure their effectiveness.

IMPLICATIONS

Control triggers have significant implications related to the reliability, efficiency, and effectiveness of operations.

Reliability of Operations

Reliability may be defined as "doing the right thing every time." Any time something is supposed to happen and it does not, the system is said to be unreliable. An operation can be no more reliable than its control triggers. An otherwise perfectly reliable accounts payable system will be totally unreliable without a control mechanism to trigger the writing of checks. And should that control trigger not be completely reliable in initiating the writing of the check to the right party at the right time, then the entire system is only partially reliable.

Efficiency of Operations

Efficiency may be defined as "doing the right thing the right way." Reliable control triggers help do things the right way. On the other hand, unreliable and untimely triggers cause inefficient operations, because they create a need for more burdensome detective and corrective controls. Unfortunately, by the time detection and correction become necessary, errors have already occurred. The detection and correction of errors are expensive in terms of both time and money, not to mention the cost of the errors, themselves.

Conversely, good triggers may reduce the overall cost of operations by eliminating the need for other, and frequently more expensive, controls. Some feedback controls, such as some inspections and some checks on performance, become unnecessary if systemic triggers are designed and built into a process. For example, suppose that in order to avoid missed billings, a billing department employs a part-time clerk to check the monthly billings before mailing. A perfectly reliable, computer-generated control trigger which motivates the creation of accurate bills for every account requiring them, immediately whenever they are required, would eliminate the need for the clerk. The computerized trigger may be both less expensive and less time-consuming than the manual detection control.

Effectiveness of Operations

Effectiveness may be defined as "hitting the right mark." A reliable system of control triggers, that assure the right action at the right time, obviously makes an organization more effective in achieving its goals. Conversely, missing or faulty triggers that fail to initiate needed actions or which initiate some wrong action, thwart the organization's progress toward its objectives, because they fail to make good things happen and they may even make bad things happen.

One horrendous example occurred when a commercial air company bought a new aircraft and put it into operation, but because of a missing trigger to record the purchase, the company treasurer was not alerted to the sizable related liability until a bill was received some months later. No money had been budgeted to pay for the plane, and because of a fierce competitive environment, the company did not have the financial reserves to pay the bill. As a result of this internal control failure, along with an accumulation of other similar, although individually less severe, control problems with the financial management system, the company was forced out of business. While the plane operations functioned very well, the financial management system was ineffective. Because of faulty or missing control triggers, the system failed to "hit the right mark."

LIMITATIONS AND UNANSWERED QUESTIONS

While control triggers are necessary to the successful operation of a system, they are not sufficient for success. Initiating an activity does not necessarily assure its successful completion. Therefore, control triggers constitute only one element of an effective control system.

Acknowledgment of triggers as a control concept which has always existed but has not been formally recognized as such raises a disturbing question: What other control concepts have gone unrecognized? Perhaps an answer lies in the further dismantling of bureaucracies. If traditional control systems have arisen from the control needs of bureaucratic structures, then it is reasonable to expect that new control principles and methods will surface to meet the needs of a new generation of management systems and organizational structures. Nevertheless, it is apparent from the above discussion that control triggers are important even to bureaucracies. One cannot help but wonder why they have not been recognized as such.

SUMMARY AND CONCLUSION

In summary, control triggers constitute a category of control methods intended to initiate desired actions in an organization at the right times. As a control concept, triggers have not been recognized in the main stream literature on control theory in accounting, business, or engineering. Control triggers are important to the success of any enterprise, but are especially important to world-class operations. Implications of control triggers affect the reliability, efficiency and effectiveness of an organization's operations. As important as they are, however, the initiation of actions does not assure their successful completion. Other controls are also necessary for a complete control system.

American Institute of Certified Public Accountants, Codification of Statements on Auditing Standards, 1994.

Coopers & Lybrand, Internal Control--Integrated Framework, Committee of Sponsoring Organizations of the Treadway Commission, National Committee on Fraudulent Financial Reporting, 1992.

Virgil W. Eveleigh, Introduction to Control Systems Design, McGraw Hill Book Company, 1972.

Institute of Internal Auditors, Inc., Codification of Standards for the Professional Practice of Internal Auditing, 1993.

Kendrick W. Lentz, Jr., Design of Automated Machinery, Van Norstrand Reinhold Company, 1985.

To read other articles by this author, link here.