The orphaned control: when ownership drifts after an organisational change

A common failure is the orphaned control. A control is assigned to a role, then the organisation changes and nobody inherits it. Sign-offs continue, evidence thins out, and system tolerances drift away from agreed risk limits. Audit sampling usually exposes it. The fix is to reassign ownership, re-walk the control and reset the settings.

How it starts

Controls are usually designed well. Someone defines the process objectives and risks, sets a tolerance for each unit, and names an owner for every control. The cycle memo is written. The audit committee sees a tidy matrix.

Then the business moves. A team is merged. A manager leaves and the post is split between two people. A shared service takes over payee setup. Nobody updates the control matrix, because nobody thinks of a restructure as a control event. The role named against the control still exists on paper. The person who understood why the control mattered does not.

The new staff inherit a task, not a purpose. They see a monthly approval queue and clear it. They do not know that the approval was meant to compare expenditure against obligation, or that a breach above tolerance should have been escalated. The control keeps its name and loses its meaning.

Why it stays hidden

Orphaned controls rarely fail loudly. Approvals still happen. Reconciliations are still signed. The general ledger still balances.

What changes is quieter. Funds control rules in the system stay as they were configured, even though spend limits or cost centre structures have shifted. A tolerance between commitment and obligation that once suited a small programme now lets large variances pass without a flag. Cost centres that should have been closed stay open and collect postings. Each of these is minor alone. Together they mean the control environment described to the board is not the one operating.

How it gets spotted

The most reliable trigger is an auditor's request for evidence. A sample is pulled, and the team cannot show who reviewed an item or what they checked. The approver signed, but cannot explain the threshold they applied. Sometimes the evidence exists but was produced by a different team from the one the cycle memo names.

Other signals appear earlier for anyone looking:

• Sign-offs that are complete but uniform, with no queries, rejections or comments over a long stretch.
• Undelivered order balances that age without anyone chasing them.
• Overspend warnings overridden by users who are not on the authorised list.
• Cycle memos that refer to job titles or system screens that no longer exist.

A walkthrough settles it. Sit with the person doing the work and ask them to perform the control on a live item. The gap between the memo and the screen is usually obvious within the first transaction.

Questions to ask the people who run it

Documentation describes intent. These questions find out what actually happens.

• When this approval lands in your queue, what do you look at before you accept it?
• What would make you reject one? When did that last happen?
• Who told you this was your task, and what did they say it was for?
• If the system lets a transaction through above its limit, who hears about it?
• Is there anyone else who does this when you are away, and do they do it the same way?
• Which parts of the written procedure do you skip, and why?
• Who changes the tolerance or spend limit settings, and who asks them to?

Listen for hesitation on the purpose question. Someone who can describe the mechanics but not the risk is running an orphaned control.

How it is fixed

Start with ownership. Name a single accountable person for each control, by name and by role, and have their line manager confirm it. Shared ownership tends to mean no ownership.

Next, re-walk the control with that owner. Confirm the objective it serves and the risk it addresses. Check the tolerance against what the unit can genuinely absorb today. If the business has grown or shrunk, the original figure is probably wrong.

Then bring the system into line. Update funds control rules, spend limits and obligation tolerances so they reflect the agreed limits. Close cost centres and cost objects that no longer serve a purpose. Review who holds override rights and remove anyone who does not need them.

Rewrite the cycle memo from the walkthrough, not from the old version. Keep it short enough that the owner will read it. Where audit findings prompted the work, record the adjustments made and link each one to the finding it answers, so the auditor can trace the response.

Finally, tell the audit committee. A control that was weaker than reported is a disclosure matter, and boards respond better to an early account with a fix attached than to a late surprise.

Keeping it fixed

The lasting change is to treat any reorganisation, system change or outsourcing decision as a trigger for control review. Add a line to the change approval form asking which controls the change touches and who will own them afterwards. That single question catches most orphaned controls before they form.

It also helps to make the code of ethics and the control responsibilities part of induction for anyone moving into a finance or approval role. People protect controls they understand.

APQC's Process Classification Framework® (PCF) is an open standard developed by APQC, a nonprofit that promotes benchmarking and best practices worldwide. To download the full PCF or to view definitions and measures, please visit www.apqc.org/pcf.