Interplay between technical and social control : Internal control and SOX compliance at Nokia
Niina Ratsula · UTUPub (University of Turku) · 2020
There are high expectations for companies to act responsibly and provide transparent and reliable information about their operations and financial status. Regulations such as the Sarbanes–Oxley Act of 2002 (SOX) have put pressure on companies to increase their technical controls and formalize their internal control and compliance systems. At the same time, authorities are adding significantly more weight on company ethics and the “tone set at the top” in determining whether a compliance program is comprehensive and effective. For example, the most recent DOJ guidance (U.S. Department of Justice Criminal Division 2019) on evaluating corporate compliance programs does not recommend that companies adopt a specific set of policies or procedures. Rather, it instructs prosecutors to assess whether a company has “incorporated the culture of compliance into its day-to-day operations.” This study is about understanding the relationship between these written rules (i.e., technical control) and the culture of compliance (i.e., social control). Technical controls constitute written rules and procedures, whereas social controls are about the efforts to persuade people to adapt to certain values, norms, and ideas about what is good and important in terms of work. Increased attention toward this softer aspect of controls is because, in many accounting fraud scandals, the issue has not been the lack of technical controls but the existence of toxic culture and poor tone at the top. To meet the stakeholders’ expectations of acting as responsible corporate citizens, companies need both technical and social controls. Despite this realization, the research around management control systems has still been largely focused on technical control systems. Social controls have been studied in the sociological literature, with only a few studies focusing on the relationship between social and technical controls. This study explores the different elements of control systems and their interrelations in a rather unexplored context: focusing on the design and implementation of an internal control system under a SOX compliance program. The study seeks to understand what happens when an organization introduces new technical controls as part of its SOX implementation project. More specifically, the focus is on the relationship between technical and social controls. Furthermore, this study seeks to differentiate between the control design, which is a management task, and the control implementation, which is about how the controls are introduced to and adopted by the employees. Empirical analysis is drawn from a case setting in which Nokia, a Finnish-based public company subject to SOX legislation, has designed an internal control system and introduced it to its employees globally. This study provides managerial and legislative implications and contributes to the literature on both management control and internal control systems. The management control literature has previously considered internal control as primarily related to controls that are in place to safeguard assets and ensure financial reporting quality. This study widens this traditional view and brings the definition of internal control closer to the concept of management control. The key finding of this study is that the social controls can play a significant role in implementing technical controls. This study suggests that these two control types should not be considered as isolated in the control design process because their continuous interplay will affect how the controls are perceived and performed. It is a matter of how managers apply social control when designing and introducing technical controls. They must consider that employees do not always follow the controls as a result of rational decision-making; instead, employees’ emotions affect how they decide to act. In this study, employees who had strong emotions toward the controls were also more likely to perform the controls. Thus, emotions are tied with employee perceptions of the controls. Even though today’s technology provides endless possibilities for automated, system-based controls, a human factor will always be central in an effective internal control system. KEYWORDS: internal control, management control systems, technical control, social control, SOX compliance, global companies, Nokia