The Evidence is the Control

The most comprehensively documented system of internal control does not provide any assurance that the enterprise is effectively, or even adequately, controlled. From a Risk Management perspective, controls are irrelevant; only the evidence of the functioning of the control is the control.

Let's consider the role of Risk Management in providing real assurance, and how to make this real.

I've posted the article on LinkedIn here

And below:

The most comprehensively documented system of internal control does not provide any assurance that the enterprise is effectively, or even adequately, controlled. We are so used to the SOX-generated idea that the system of internal controls needs to be documented, and where there are perceived to be inadequate controls, more controls need to be introduced and documented. This is limited, of course, to “controls over financial reporting”, as required by SArbanes-Oxley (SOX).  

This has resulted in probably hundreds of millions of dollars, probably billions, being spent to document controls over financial reporting, and then Internal Audit (and External Audit) testing of those control. A windfall for the Internal Audit profession and for External Audit firms. After all, well-documented controls, especially when the critical controls are tested, are the backbone of a sound system of internal controls. Or is it? 

We need to move from the paradigm that a documented system of internal controls equates to an effectively controlled entity. Nothing could be further from the truth, and this is why we have both Internal and External Audit. Internal Audit tests the controls, recommends improvements to controls and provides “assurance” to senior management and the board that the controls are functioning. External Audit places limited reliance (anything more and they couldn’t demand the level of fees they do) on the work of Internal Audit and on the controls. 

I’ve missed the “risk” word above. Of course, Internal Audit should determine the controls to test on a risk-assessed basis. Yet too frequently, Internal Audit focuses on the highest-risk areas (that is appropriate) while year after year, the non-high-risk areas effectively get a pass. There simply are not and never will be enough Internal Audit resources to test all areas.  

After all, a fire will destroy the kitchen and house, while the ants will slowly denude the pantry. So we audit the fire alarms, and make sure there is a fire extinguisher (have you checked the date on it recently), but we don’t hunt for ants unless they are right in front of our faces.  

To paraphrase Hemmingway, internal control failures happen slowly, and then all at once.  

So the classic three-year rolling Internal Audit programme never seems to get to the bottom two-thirds of the potential auditable areas. What does this mean? Fundamentally, too much of the entity will never be audited, and there will never the evidence that the controls are or are not functioning.  

And here is our problem. It will be one of those areas, probably not directly related to ‘financial reporting’ that will ‘go bad’, resulting in significant problems and costs. 

The evidence IS the control.  

Who cares if there is a full set of documented controls if operational management knows perfectly well that Internal Audit will never reach two-thirds of the entity? I.E., their function, system, or process? This means more resources that said operational manager could spend on resources, people, supplies, laptops, etc, because they know that the cost of the control can be deferred, because the chances of their every being audited are minimal. 

In some enterprises, the “Second Line” in the form of Risk Management contributes to the identification of appropriate controls, and should be monitoring the control environment. This augments and does not detract from the role of Internal Audit, whose role is to perform detailed reviews of processes, systems, or functions, confirming through testing that the stated controls are functioning.  

So what is the role of Risk Management, as 'second line', in providing assurance over the system of internal controls? Risk Management can provide the framework to ensure that controls are functioning, by providing the repository and process to enforce confirmation of the functioning of controls. So what can Risk Management do?

1. Risk Management assists management in the identification, description (including quantification) of risks, and 
2. Assists management in determining and quantifying the level of risk that is acceptable, and in gaining senior management and board endorsement of the level of acceptable risk (the Risk Appetite applicable to the risk), and 
3. Works with management to identify what ‘controls’ would provide confidence that the risk is being mitigated or otherwise managed within appetite, and 
4. Provides a framework for the regular assessment and reporting on the functioning of the identified controls, and 
5. Provides an independent repository for the collection and retention of the evidence that each control is functioning, and finally 
6. Reporting to senior management and the board on management’s reported assessment of the effectiveness of controls, to confirm that the entity is functioning within Risk Appetite, or 
7. Provide reporting and recommendations to senior management and the board on additional steps that may be required to bring the entity into appetite (which may include the explicit modification, ‘upward’ or ‘downward’ of the actual Risk Appetite. 

In this way, it is not the fact of the existence of a documented control that matters, it is the provision of evidence by management that the control is functioning This evidence is the control. Without the evidence, it must be assumed that the control may not be functioning, and, therefore must be tested by Internal Audit, something that probably will never happen for the vast majority of non-high-risk areas. 

Quite some time ago, you probably started saying, “But this isn’t the job of Risk Management”, and in a purist sense, I agree. But I also know that someone needs to do this, and that someone needs to have access to the board and to management. Relationship management across the first line is critical, as is the ability to synthesise the information provided in the evidence of functioning controls.  

Most importantly, there cannot be an adversarial relationship such as too often exists between Internal Audit and the business, and between External Audit and everyone. Note I’m saying ‘too often’, not that this should be the natural state of things. 

Risk Management has many responsibilities, and this one fits nicely. 

Where there is an ongoing demonstration of performance of the system of internal control, identification of new or evolving risks, and a risk appetite that is both detailed and macro, Risk Management should be there. As risk specialists (both ‘downside’ and ‘upside/opportunity’) with the ability to communicate potential impacts as well as provide  

So consider a framework that includes a quarterly provision of the evidence of each control, coupled with management’s assessment of the effectiveness of that control. Consider also a regular relationship meeting between Risk Management and operational managers to confirm that the range of risks is current, the rating of the risks continues to be in line with management’s understanding of the risk, and the mitigation in place, as evidenced by the provided evidence of the functioning on the controls, ensures that the entity, or at least this risk, continues to be managed within appetite.  

Finally, the evidence provided by management and monitored by Risk Management also enables Risk Management to provide greater confidence in their reporting of the current risk status of the entity, improving the quality of assurance provided.

After all, documented controls by themselves are worthless. The Evidence of the functioning of the control is the Control. 

#Risk #InternalAudit #SOX

Chinese Farm

(I wrote this a month ago, but I am only posting it now, after sharing it with a few people)

All this time, the West has been saying, "No shooting at Russian territory". If you do that, we'll cut off aid. We won't get into a shooting war with Russia. Etc, etc. This mantra has been said so often that it has become a "truth". But this is war, when truth becomes lies, and believing truths can get you in trouble. 

 

This is a war for the very survival of Ukraine. Russian forces are arrayed forward to the front lines, and the Russian high command knows (or assumes) that Russian territory will not be attacked meaningfully. The war is being fought and will be fought on Ukrainian territory (or "Russian territory" currently under the control of Ukraine).  

 

The assumption is that the coming offensive will be to retake Ukrainian territory, probably pushing south to the Sea of Azov and Crimea, busting through Russian well-prepared defences, line after line. Each one is a potential Somme waiting to happen. And for what, a few kilometres of advance while further eroding limited resources?  

 

The invasion has been halted, the Russian winter offensive has failed, and the positions are well established. Logistical lines favour Ukraine with shorter lines to any point on the front, while Russian logistics are stretched. The distance from Kviv to the farthest front line is around 500 kilometres. Realistically, however, forward positioning of materials will put the front lines no more than 150 – 200 kilometres at any point. Contrast this with the Russians' need to be able to deliver forces to any point along a 900+ kilometre front line.  

 

Will Ukraine repeat the Somme, or will they do something completely different? There are enough historical examples to follow, or that provide potential parallels to the current situation. And that has led me to think about what Ukraine may do. This is my "prediction".

If we want to see the future, we need only look at the past: the Battle for Chinese Farm and the two weeks following. I'll not review it in detail, you can look it up on Wikipedia (https://en.wikipedia.org/wiki/Battle_of_the_Chinese_Farm). 

 

What matters here is that the Russian military is exhausted, or they would continue their offensive operations. They've tried to take their own version of the Gidi Pass and Mitla Pass, and failed. Ukraine is contemplating how and where they will use the new Western armour and APCs, and how they will use their limited artillery resources. Western doctrine calls for the establishment of air superiority before engaging in ground operations, and the inability of either side to accomplish this has been a major talking point throughout.

In 1967, Israel had complete air superiority. In 1973 they were willing (or forced to) accept interdiction of all airspace by both sides, at a high cost. If neither side has air superiority, then the "air" just needs to move higher - space and satellite superiority, and Ukraine has that in spades through Western eyes.

 

They have eyes in the sky, and a massive amount of intel from the West, at strategic and detailed operational levels. They probably know the names of every commander on the Russian side, and probably know where each of them is to within a few hundred meters. They know how much fuel the Russians have, at a unit level. They know where the Russians are, how many they are, and probably what they will eat for breakfast tomorrow. How can I say this with confidence? Because this is the war that NATO has been planning for 70 years. The fall of the Soviet Union did not halt the continued development of Western electronic intelligence-gathering capabilities. 

 

I suspect Ukraine has been looking for the perfect "Chinese Farm" for the past three months or more, but one that will not result in the same desperate battle fought 50 years ago. And when they decide to attack, the objective will not be the Sea of Azov; the objective will be to push tens or even fifty or more kilometres into Russia before turning south and or north. They hope to puncture the front, and, using Israeli (and Soviet) tactics, run amok in the Russian rear, separating the front line and even reserve forces from their logistical bases in Russia, forcing Russian forces to look behind themselves as well as protecting their front.  

 

The frontline Russian forces will not even know that they are being surrounded until it is already underway. It is natural for commanders to limit the amount of information provided to front-line troops to avoid speculating about every piece of gossip or rumour. But this means that rumours will spread, will be denied, and will continue to spread.  

 

I'm going to go way out on a limb here, and suggest that anyone living west of the Russian M4 motorway (which is closer to Bakhmut than Bakhmut is to Kharkiv) may find themselves on the front lines or within the cauldron, with Ukrainian forces using that as the point at which they turn north and or south, aiming to cut off Russian forces from their rear positions and resources.  

 

From there, Ukraine can wait. Certainly, there will be intense fighting continuing all along the front, but that will be holding fighting for Ukraine, and breakout fighting on the part of Russian forces. The war will be over, and Moscow will face some very scary choices. But once Russian troops realise that their supply lines have been cut off, I do not expect morale to hold up for long. Those troops will be bombarded with propaganda more than shells. Breakouts will be attempted and will be stopped. The Russian air force will need to commit all that it can, and will lose the air. 

 

This will leave Moscow with few choices. Escalate to nuclear weapons or find a way to negotiate an end to the war that keeps Putin alive. China, Russia's only meaningful friend, has told Putin that nuclear weapons are off the table.  

 

We will know soon. 

(Since writing this, I've read that Russia is building defensive fortifications well back in Russian territory.)

 

Fortitude West & Fortitude South?

What offensive? Think Fortitude. One day soon, Ukrainian troops will advance out of their lagers and into Ukrainian territory occupied by Russia. It will be the biggest test of the Western European military doctrine developed over decades to counter the Soviet military. That there will be a Ukrainian offensive in the coming weeks is accepted. Only a small cadre of individuals may know what the offensive will look like, its direction, depth, and objectives. The rest of us can only speculate. History tells us that surprise and the ability to mislead the enemy play a critical role in success. History also provides some excellent examples of the type of deception that is underway at this moment. Leading up to D-Day and the invasion of the European continent during the Second World War, a massive programme was created, with two notable (intentionally) false operational plans named Fortitude North and Fortitude South. Fortitude South, the main deception, included the First United States Army Group (FUSAG), an utterly mythical army with Patton as the commanding general. FUSAG was to attack at the Pas de Calais, the narrowest part of the English Channel and the logical place to land to seize the channel ports and advance into Germany.

But the Allies landed in Normandy, not at the Pas de Calais as expected. For too long, Hitler refused to believe that Normandy was the main effort, tying up troops that could have hampered or even thrown the Allies back into the English Channel.

What is Ukraine doing? There are three possible axes for the coming Ukrainian offensive; Western crossing the Dnipro near Kherson, south through Zaporizhzhia Oblast to the sea, or another eastern axis to the East, that I've discussed elsewhere.

I think the best operational names for the Dnipro crossing and a Zaporishshia south axis are Fortitude West and Fortitude South. I'll skip any discussion of Fortitude East for now, though it is my (uneducated) guess that this will be the "real" offensive.

Fortitude West? Ukraine is on the East bank of the Dnipro River around Kherson, but that is meaningless. At most, it is a feint to distract and get the Russians to comment forces and attention to their western flank. It will be virtually impossible for Ukraine to transport adequate forces across that river, under artillery fire, with only pontoon bridges and rivercraft to support them. The Russians must know this. Which makes it all the more “real”. Double bluff. Attempt to distract where a distraction is only that, a distraction. Yet use that distraction, like Operation Overlord, as the real push, regardless of the perils and logistical difficulties. Bluff. Double bluff. Distraction before the 'real’ push. What is it, and for how long can Moscow ignore Ukrainian advances and footholds on the left bank of the Dnipro? And when they do take it seriously and assign forces, and begin to move them, will the ‘real’ Ukrainian push start somewhere else? Rivercraft can transport squad, not Challenger tanks. And landing craft that can transport Challengers are visible from satellites and drones, and can be targeted. And drones are flying up and down the Dnipro, both sides sending them up every day, and probably every night. The nights are becoming shorter, reducing the amount of time to bring armour to the embarkation points, and to get them across, unloaded and into cover. It would not surprise me in the slightest to see reports of Leopards and Bradleys on the east side of the Dnipro, in big “oops” moments. Just big enough to grab Moscow's attention. Meanwhile, the clock is ticking. The ground is firming. The artillery coordinates of defensive constructions are being mapped. Minefields are surveyed, and stockpiles are moved, again under cover of night to reduce drone and satellite observation. If this is the axis of the offensive, they will drive south directly to Crimea, aiming to liberate Crimea and panicking Russian forces and commanders across the rest of the front. The extraction of units to redeploy to the defence of Crimea could strip the front lines in the east, giving Ukraine the opportunity to advance and liberate the rest of Ukrainian territory. Bold, if it works. Fortitude South meets the Maginot Line? And over at the Pas de Calais (the Zaporizhzhia Oblast frontline), forces gather and prepare for the Ukrainian offensive to push through and south to Melitopol. That’s what we've been conditioned to expect, and if we have been conditioned to expect this, then so has Moscow. So the Pas de Calais is where Russian forces will sit, ready for the British tanks to “come ashore”. Enough Ukrainian (and Western military and politicians) have talked about the Southern Offensive and the importance of taking Melitopol and pushing south to the Azov Sea, then turning left (Mariopol) or right (Crimea). This will cut the land bridge to Crimea, forcing all reinforcement and general supplies for military and civilian populations to travel over the bridge, making it a, if not the prime target for, Ukrainian drone and or rocket forces.

And so, Russia is building defensive lines throughout southern occupied Ukraine, lines that are being surveyed daily. The Russians prepared almost 120 km of defensive lines, including multi-layered defence, with anti-tank ditches, lines of "dragons teeth" and then a primary trench line. Reuters also has a fascinating graphic and discussion about the defensive infrastructure in terms of the trenches and defence in depth with multiple lines of trenches. The graphics could be a modernised version of pictures I came across in a book written in the early 1920s, in the Pentagon library. The descriptions and drawings of trenches are, basically, an updated version of that book. While caltrops are no longer mentioned, they have been replaced with "hedgehogs", the modern equivalent designed to slow down or stop a tank instead of a horse. All in anticipation of the offensive. And that will draw more Russian forces and capabilities away from any actual frontline. The bridge is long (the longest in Europe at 19 km) and vulnerable at any point along its length. Defending that bridge is not a matter of positioning forces at either end. They will need maritime resources to be tied up, anti-aircraft and anti-missile forces, all of which detract from what is available for defensive operations to the north. GLOCs (Ground Lines of Communication) are critical for logistical support. Cutting these, when they are actually "ground" lines, is not easy and requires the ability to control or interdict not only the road itself, but enough on either side to make manoeuvre around a damaged section of road equally difficult. The ability to reroute around a damaged piece of road calls for engineers to keep the road open or to bypass the damage. Not so with a bridge. And certainly not so with the Kersh Bridge.

Will the opening action of the offensive be an attack on the bridge? Very probably.

If Russian forces face a southbound offensive, they must concentrate their capability in Zaporizhzhia Oblast, and protect the bridge. Russian planners must be looking at the map and their order of battle, trying to determine which units will be able to provide the right defence, and the real force levels of depleted units. The defensive lines they have built may have a distinct advantage in terms of the number of defenders needed to maintain the line (depending on the effectiveness of the attacker, of course), but larger numbers of soldiers are still needed. And each of these will need to be willing to stand their ground in front of advancing tanks, APCs and dismounted infantry. If the defending troops are the survivors of depleted units (as we are told), their morale and capabilities will already be severely degraded. Summary No matter what happens, it probably will not be what we expect. If it is an offensive straight south, then there will be a lot of hard fighting. If it is south across the Dnipro at Kherson, it may include a drive directly toward Crimea, in which case it will run right up against the defensive positions constructed at the narrow entrance to Crimea, and there will be much hard fighting. Expect large-scale use of precision munitions targeting individual defensive positions. But both of these options may be Fortitude West and Fortitude South. The blow may come somewhere else entirely. And so, as each of these potential lines of assault unfolds, the Russian command is going to be asking themselves where the real offensive is taking place. The speed at which they are able to assess and respond to the true line of offence will determine the outcome.

Probably the most important thing to remember right now is that Ukraine has options, and will be doing everything in their power to obfuscate and mask their real intentions. The real axis of the offensive will probably not become clear for some days after it starts. We wait. We all wait.

By May 15 we will know...

May 15th. By this day that the war in Ukraine will have been decided, one way or the other. 

By May 15th, Russia will be willing to negotiate to retain Sevastopol, or Ukraine will be willing to negotiate the final transfer of Crimea to Russia in exchange for peace and a return to the Feb 2022 “borders”. It might not happen on that day, but by then, we will know which will be the more probable outcome. 

 

There will be a Ukrainian spring offensive. This has been foreshadowed since December or before. And both the Ukrainians and the Russians have been attempting to shape the battlefield for just this event. Russia is trying to draw out Ukrainian reserves and shatter their line, forcing the distraction of resources from the offensive.  

 

The defence of Bakhmut has drawn in Russian forces into an inverse caldron, with the defenders taking advantage of terrain and almost a decade to prepare for an expected Russian war. Russian losses outside (and inside) Bakhmut are, according to Western media, staggering. Furthermore, the attention to Bakhmut may be drawing attention away from other potential fronts.

 

Training of Ukrainian tank crews across Europe took place in January and February, and tanks are arriving in Ukraine today. Ukraine today also, probably, has a military that is as large as Russia's, possibly even larger. Conscription and volunteers have swelled the size of the Ukrainian military. I would caution that we have no visibility on Ukrainian losses, but we continue to be told they are significantly lower than Russian losses.

 

The fundamental difference in capacity between Russia and Ukraine is that Russia is the aggressor. Therefore it is more difficult for them to source a large pool of volunteers, while the invaded country can rely on the citizenry to volunteer to defend their country. In addition, Russia has their own stocks of weapons and ammunition, while Ukraine is calling upon the stocks and resources of much of Europe and the United States. While this is simplistic, and Russia is sourcing weapons from international allies (Iran and North Korea, for example) these are providers with far more limited capacity than Ukraine's suppliers. 

 

All this is leading toward a late March offensive. The ground needs to dry, and the forces need to be positioned.  In an age of drones, surprise is harder to achieve, so both sides will see, to some extent, the positioning and manoeuvring of the other.  

 

When it comes, it will be ferocious. And it will need to be. Ukraine will quickly claim resounding successes, and Russia will claim they have stopped the Ukrainians in their tracks. Both sides will flood the info-sphere with photos and video of the other's equipment in flames.  

 

The info-warfare will be playing out to convince audiences far from the battlefield; the politicians and citizens in countries supplying Ukraine. Victory in the offensive will cement support, while a stalled or failed offensive will lead to a too-rapid erosion of support. 

 

By May 15th, we will know if the offensive has been successful, and the question then will be “how far, how fast, and what will Russia salvage"? I predict a successful offensive could see as much as parts of Crimea in Ukrainian hands by the end of summer. Russia may be forced to the negotiating table to retain Sevastopol (because that will not be given up by Russia in any scenario, and a multi-year siege is unrealistic in the “modern” world).  

 

By May 15th, we will know if the offensive has failed to live up to the hype. If this is the case, and the fields of southern Ukraine are littered with burning Leopards and Challengers, Bradleys and Marders surrounded by dead soldiers, then Western public opinion will turn. The prospect of going through the process of arming and training a replacement army will be too much for Western governments, some facing elections cycles. If this happens, Ukraine will be forced to the negotiating table to seek what it can get, which certainly will be more than they have today.  

 

Lurking behind all of this will be the Western governments and their willingness to put (some) sanctions onto a separate negotiating table.  

 

But by May 15th, we will have a pretty good idea of how this war is going to play out.