Control debt: the risk that isn’t in your risk register
Updated: 11 hours ago
Every organisation quietly builds up debt in its internal control. It doesn't appear on the balance sheet or in the risk register. It sits in the gap between how controls work on paper and how they work in practice, and it does not resolve itself.
Sound familiar? A four-eyes check that the same two people have been signing off for years, both clicking "approve" without opening the underlying document. An authorisation matrix still based on the organisational structure from before the last reorganisation. A monthly reconciliation that has been done "temporarily" by hand since the migration to the new ERP system.
None of these examples will make the news, and none of them will cause an incident tomorrow. Together, though, they make up what we call control debt, and in many organisations it is larger than the board thinks.
What is control debt?
In IT, technical debt is a well-established concept. If you build a quick, messy solution under time pressure, you gain time today and pay for it later, because every subsequent change becomes more expensive and riskier. Software teams track that debt, discuss it and deliberately pay it down.
The same phenomenon exists in governance, risk and control, but it has no name and nobody keeps the books on it. We define control debt as:
The accumulated gap between the level of control an organisation believes it has and the level it actually has, caused by deferred, outdated or eroded measures.
The difference from an ordinary finding matters. An audit finding is a snapshot of a single control. Control debt is a stock. It builds up over time, across processes and across departments. And like technical debt, it is not wrong in itself. Sometimes it makes sense to defer control deliberately, for example during a period of rapid growth. The problem only arises when nobody knows how large the debt is or how to manage it sensibly.
How control debt arises
Control debt rarely comes from a single bad decision. It creeps in through five routes that are open in almost every organisation.
Change without redesign. Processes, systems and structures change constantly. The control framework is rarely updated at the same pace. After a reorganisation, acquisition or system migration, controls remain on paper that no longer have any grip on the new process.
Temporary fixes that stay. A manual workaround, an exception in the authorisations, an "interim" procedure. Intended for three months, still in place a year later.
Ritualisation. A control that has gone well for years loses its edge. Signing off becomes an action rather than a judgement. The control still exists, but the thinking behind it has gone.
Loss of knowledge. The employee who knew why a control existed has left. Their successor performs the action but no longer recognises when something is off.
New risks without new controls. Think of AI tools that employees adopt on their own, new supply chain partners or new regulation. The risk profile grows; the control framework does not.
The last route deserves particular attention. With the rapid rise of generative AI in everyday work, many organisations are currently building up new control debt at a fast pace, often out of sight of risk and compliance.
Why nobody sees it
If control debt is so widespread, why isn't it on the agenda? Because the usual instruments are structurally blind to it.
The risk register looks at risks, not at the state of control. Risk registers describe what can go wrong, outside and inside the organisation, such as a cyberattack or a supplier going under, but also process errors or fraud. Each risk lists the controls and the residual risk. But the question of whether those controls still work is usually answered with a tick in the "effective" box. That tick is often years old and rarely backed by recent testing.
Audits are samples. Internal and external audits test a selection of controls, within a defined scope, at a given moment. They find individual deficiencies but rarely see the pattern of the same kind of erosion occurring across the whole organisation.
The first line has no incentive to report it. Whoever performs a control is reluctant to report that it no longer really means anything. Not out of bad faith, but because it creates extra work and nobody asks.
Green is comfortable. Dashboards showing green give the board peace of mind. But a control that has been tested for design and existence says little about whether it still covers the risk it was originally designed for, in other words its operating effectiveness. The result is what we call paper assurance: the documentation is correct, but reality no longer matches it.
What control debt costs
Control debt has a price, even if it isn't visible anywhere. You pay it in four ways, often without noticing.
Wasted effort. Employees spend hours on controls that no longer cover anything. That is pure cost without return, and it crowds out attention for the controls that do matter.
Hidden exposure. The actual risk is higher than the reported risk. The board and supervisors make decisions based on a picture that is too rosy.
More expensive change. Every new strategy, system change or acquisition takes longer, because you first have to work out how the existing framework actually fits together.
Abrupt settlement. Control debt is rarely paid down gradually. Usually the bill arrives all at once, for example through fraud, a regulatory investigation or a qualified audit opinion. Then what has been left untouched for years must be fixed under time pressure, at the highest possible cost.
That last point is the crux. Organisations do not choose whether to pay off control debt, only when and under what circumstances.
How to make control debt manageable
The good news is that what has a name can be measured and managed. Four steps help to make control debt visible and pay it down deliberately.
Inventory: make the debt visible. Go through your key controls with one simple question: does this control still cover the risk it was designed for, in the process as it works today? Don't do this from documentation alone, but with the people who perform the control. Ask about workarounds, exceptions and "temporary" fixes. That is where the debt sits.
Price it: make the debt comparable. Not all debt weighs the same. Assess each item on two axes: how large is the risk that remains uncovered, and how much effort does remediation take? This gives the board an overview it can steer on, instead of a long list of findings.
Pay it down: make deliberate choices. Start with debt that combines high risk with low remediation cost. In addition, actively remove controls that no longer add anything. Rationalising is just as much paying down debt as repairing, and it frees up capacity for the controls that matter. Debt you deliberately leave in place is recorded as accepted risk, with an owner and an end date.
Prevent it: build it into your rhythm. Make "what does this mean for our control?" a standard question with every reorganisation, system change, acquisition and introduction of new technology such as AI. Give temporary fixes an expiry date by default. And report periodically on the size of the control debt, alongside your regular risk reporting.
Five questions for the board and supervisory board
Ultimately, control debt is a governance issue. Directors and supervisors can open the conversation with these questions:
Which controls in our organisation have not been substantively reviewed for more than three years?
How many "temporary" fixes and exceptions are active, and who owns them?
Was our control framework taken into account in the last reorganisation, acquisition or system migration?
Which new risks, for example from the use of AI, have we not yet translated into controls?
Which controls could we drop tomorrow without anyone noticing?
That last question is often the most revealing. The answer says a lot about how much effort goes into control that now exists only on paper.
Finally
Internal control is not a structure you build once. It is a system that moves with the organisation, or falls behind it. Organisations that name their control debt get a grip on it. They spend less time on pointless controls, have a more honest view of their risks and can change faster.
So the question is not whether your organisation has control debt. The question is whether you know how large it is, and how to deal with it sensibly.
Want to know where your organisation stands on control debt? The Wise Sailor helps organisations with a targeted scan of their control framework, from inventory to a concrete repayment plan. Feel free to get in touch.
Comments