Best Practice Internal Control Strategy Still is the Best

Posted by Nancy Johnson on September 12, 2011

In its September 2011 newsletter, global management consulting firm McKinsey & Company published a snapshot article entitled "Why Best Practice Isn't the Best Strategy."

This bold proclamation got my attention, for two reasons.

First, Vibato prides itself on a best-practice-based approach to internal control over financial reporting. So having a mega-consulting firm like McKinsey refute best practice gets me more interested in understanding their perspective. Second, given the history of the best practice movement (for lack of a better word), I suspect McKinsey has made a lot of money over the past few decades advising clients to incorporate best practices in their businesses. To now have McKinsey advise against best practices is a bit perplexing.

A Closer Review
Putting my confusion aside for a moment, I decided to take a closer look at the paragraph, which I've pasted below:  

 "Spurious frameworks and torrents of data often obscure the basic principles of good strategy. To beat the market, companies must exploit imperfections that stop (or at least slow) its workings. Such competitive advantages are scarce and fleeting because markets drive a reversion to mean performance as middling companies emulate the best and the worst exit or undergo significant reform. Good strategies therefore emphasize difference—versus direct competitors, potential substitutes, and potential entrants—not industry-wide best practices."  - From "Why Best Practice Isn't the Best Strategy," McKinsey Newsletter, September, 2011.  

It turns out this paragraph is based on a longer McKinsey paper called  “Have you tested your strategy lately?” After reading this longer paper, I concluded that McKinsey is talking more about the best practices employed to create a strategy for growing a business -- for new product development, for example -- than about best practices employed to contain the costs of running a business.

In this respect I can see the consulting firm's point. So much of business success is determined by timing - being ahead of your competitors to capture customer trends but not too far ahead - that defining a growth strategy around what's worked for other businesses might get you stuck in the past, rather than propel you forward.

Being Different - Not Good in Internal Control and Compliance
On the other hand, what we've seen here at Vibato is that there are certain business processes that remain static across industry and company size. A/P is A/P is A/P whether you're a small local business or a mega-corporation. Sure, any company can have some unique industry-specific caveats. But our experience shows that best practices around the A/P process (and other finance processes) can be applied in companies of all sizes and every industry, with the same results: effectiveness and efficiency.  

This is especially true for a company's internal control and compliance strategy. We advocate for a best practice approach in these areas because we have seen companies save time and money after adopting tried and true internal controls, policies and procedures, and testing methods. Contrary to McKinsey's approach, we at Vibato believe that a successful internal control and compliance strategy is driven by best-practice, rather than trying to be different or unique. 

Unfortunately, organizations that build their internal control and compliance strategy around the status quo just end up reinventing the wheel. They spend time and money defining controls, and creating documentation and test plans that are unique and proprietary to their own organization. To be fair, these efforts can be effective, in that they satisfy compliance and audit requirements. But most of the time, they are not efficient --  not only in the the time and money spent creating this infrastructure but also in the day-to-day operations of the infrastucture. This approach tends to "overdo" it by creating more controls than are actually necessary to mitigage the identified risks. And having more controls in place can perversely create more risk for any of them to potentially fail - which could ultimately lead to a material weakness. 

Best Practice = Effectiveness and Efficiency
At Vibato, we integrate best practices into our approach because we want our clients to achieve optimal output (effectiveness) with minimal input (efficiency).  Effectiveness and efficiency may not be what the visionaries in your company want to focus on when they're trying to determine the next big thing. But your finance organization should have a laser focus on this balance to help achieve your company's operational success -- and help keep those visionaries dreaming big while staying out of compliance and audit trouble.

Download our paper on Vibato's Best Practice Internal Controls for a Risk-Based Approach

Tags: best-practice