The Appeal and Limits of Internal Controls to Fight Fraud, Terrorism, Other Ills

INTRODUCTION Corporate internal controls have become a first-order policy option to respond to a wide variety of national problems.1 In response to early 2001's financial scandals,2 Congress adopted the Sarbanes-Oxley Act (SOX),3 to bolster controls over financial reporting and mandated audits of them. In response to 9/11 's terrorism, Congress adopted the USA PATRIOT Act (PATRIOT)4 with provisions expanding controls in the financial services industry to interdict terrorist financing and calling for audits of those controls. These two statutes continue a thirty-year trend of Congressional and regulatory reliance on corporate internal controls to address policies from antitrust, to worker safety, to environmental protection. These responses show internal controls as appealing. This Article raises questions concerning their limits. Corporate internal controls began as internal processes with positive aspirations of helping a corporation meet its objectives, a conception creating modest expectations of results. By using them as a leading policy option, controls assume a negative character. They become processes designed to prevent certain undesired events from occurring, a conception creating greater expectations. However, controls are inherently limited in what they can do, making the modest expectations associated with positive aspirational controls sensible but increasing the likelihood of disappointed expectations associated with the more ambitious efforts of negative preventive controls.5 Accompanying the proliferation of corporate internal controls to address various policy objectives has been a rise of audits to test those controls. But audits are also limited in what they can do. Auditors cannot guarantee that the controls they test are in fact effective, though they can offer some assurance about that. More important, as audit proliferates as a way to test control effectiveness, pressure builds to create controls that can be audited. This means that controls are increasingly designed according to whether they can be audited, not according to whether they are likely to be effective. The proliferation of controls and auditing of them creates so many controls that, by sheer volume, it becomes more difficult to determine which controls are likely to be effective. Numerous systemic forces make controls appealing as a policy option. The movements for deregulation and cooperative compliance make controls appealing as alternatives to direct regulation. Resistance to overt federal preemption of state corporate law makes controls attractive as an alternative way to inject federal policy into internal corporate affairs. The rise of the monitoring model of the board of directors in corporate governance makes controls essential tools to enable this indirect supervision of corporate affairs. The corporate social responsibility movement calls for greater corporate accountability; controls addressing interests of particular corporate constituencies seem tailor-made for the purpose. Backing these powerful systemic forces making controls appealing are two professional groups most-closely involved with internal control design and administration: the auditing and legal professions. In the case of auditors, controls are an appealing way to diversify the profession's services. Auditors can both design and test controls. The profession encourages control proliferation and auditing of controls as part of its business strategy. In their marketing, however, auditors oversell both what controls can accomplish and how auditing of controls can help make controls more effective. Lawyers like processes, including controls and audits; and this taste can lead them to believe auditor advertisements. An expectations-gap arises. Lawyers focusing on process encourage controls and audits of them and then expect results to follow. In the case of preventive controls, the expected result is preventing some undesirable outcome such as fraud or terrorism. …