Management control systems: purpose and frameworks

Every organization larger than a few people faces the same problem. The people who own it or run it cannot do all the work themselves, so they rely on others to make decisions that serve the organization's goals. Those others have their own goals, their own information and limited time and attention. A management control system is the set of formal and informal mechanisms that managers use to make it more likely that people behave in ways that help the organization achieve its objectives. This course is about designing, using and judging those systems, with a strong focus on the accounting measures that sit at their centre: budgets, responsibility centre reports, return on investment, residual income, economic value added, transfer prices, balanced scorecards and incentive plans.

ACCT-102 introduced responsibility accounting, ROI, residual income and transfer pricing in a single lesson, and ACCT-222 built the cost systems that feed them. This course goes much deeper. It asks why controls are needed, which kind of control fits which situation, how accounting measures can encourage or distort behaviour, and how a control system holds together as a package. Strategic performance management, pricing and capital investment decisions are developed further in ACCT-421, and BUS-450 treats strategy execution from the general manager's side. Here we take the management accountant's view: what to measure, how to measure it, and what the measures will make people do.

Throughout the course we follow one invented company, Cormorant Industries Ltd., headquartered in Hamilton, Ontario. Cormorant has three operating divisions. Components makes electric motors and control boards, selling some to outside manufacturers and some to its sister division. Appliances designs and assembles residential water heaters and heat pumps, sold through distributors across Canada and the northern United States. Services installs and maintains equipment, mostly in Ontario. A small sales subsidiary in Ireland, Cormorant Europe, distributes appliances in the European Union. All figures are illustrative and in Canadian dollars unless stated.

Why control is needed

Merchant and Van der Stede, whose framework many management accounting courses use, identify three reasons people may not do what the organization wants. The first is lack of direction: people do not know what is expected. A new sales representative may not know whether to push volume or margin. The second is motivational problems: people know what is expected but choose not to do it, because their personal interests differ from the organization's. A plant manager might delay maintenance to hit a quarterly cost target, knowing it will cost more later. The third is personal limitations: people know and want to do the right thing but lack the ability, training, information or time. A capable engineer promoted to division manager may not yet know how to read a cash flow forecast.

A good control system addresses all three. Clear targets and policies address lack of direction. Measures linked to rewards, and monitoring, address motivation. Hiring, training, job design and tools address personal limitations. A common error is to treat every control problem as a motivation problem and respond with tighter targets and bigger bonuses, when the real cause is that people do not understand what is wanted or cannot do it.

Control has costs as well as benefits. Direct costs include the time spent preparing budgets and reports, the systems that capture data and the bonuses paid. Indirect costs are often larger: tight controls can slow decisions, discourage initiative, encourage gaming and damage trust. The aim is not maximum control but adequate control, a state in which managers can be reasonably confident that no major unpleasant surprises will occur. What counts as adequate depends on the stakes, the uncertainty and the people involved.

Avoiding the problem: alternatives to control

Before designing controls, managers can sometimes avoid the control problem altogether. Activity elimination removes the risky activity, for example by outsourcing payroll processing to a specialist provider or exiting a business the organization cannot monitor well. Automation replaces people with machines or software for routine tasks, such as automatic three-way matching of purchase orders, receiving reports and invoices covered in ACCT-240. Centralization keeps critical decisions with senior managers, for example by requiring head-office approval for all capital spending above a limit. Risk sharing transfers part of the risk to outsiders through insurance, fixed-price contracts or joint ventures. Each alternative has its own costs. Centralization, in particular, gives up the benefits of local knowledge and speed that are the reason for decentralizing in the first place, a trade-off lesson 2 examines.

Anthony's framework and the levels of control

Robert Anthony's classic framework, first set out in 1965, distinguished three types of planning and control. Strategic planning sets the organization's goals and the broad strategies to achieve them. Management control is the process by which managers influence other members of the organization to implement those strategies. Task control, sometimes called operational control, ensures that specific tasks, such as filling orders or scheduling a production line, are carried out effectively and efficiently. Management control sits between the other two, translating strategy into targets and budgets for responsibility centres and monitoring results.

Anthony's framework remains useful for locating accounting information. Budgets, responsibility centre reports and performance measures are the main tools of management control. Detailed cost and quality data, many of them non-financial, drive task control. Strategic planning uses external data on markets, competitors and technology. Critics point out that the boundaries are blurred in modern organizations, where front-line employees make decisions with strategic effects and senior managers monitor operational dashboards in real time. Later frameworks therefore treat control as a package of interacting elements rather than three tidy layers.

Results, action, personnel and cultural controls

Merchant and Van der Stede classify controls by what is being controlled. Results controls reward or punish people for the outcomes they produce: profit targets, sales quotas, ROI targets, customer satisfaction scores. They allow employees freedom in how they achieve results and suit situations where the desired results are known, the people being controlled can significantly influence them, and the results can be measured accurately and promptly. Action controls specify or restrict the actions people may take: approval limits, segregation of duties, standard operating procedures, checklists and pre-action reviews. They suit situations where the desirable actions are known and can be observed, as in a regulated laboratory or an accounts payable department.

Personnel controls build on employees' natural tendency to control themselves, through selection and placement, training, job design and the provision of resources. Cultural controls shape shared norms and values through codes of conduct, group rewards, transfers between units, physical arrangements and the tone set by leaders. Personnel and cultural controls are cheaper to operate and have fewer side effects than results and action controls, but they take longer to build and are harder to change. Most organizations use all four. The design question is the mix: how much weight to put on each, given the activities involved.

# Classify Cormorant's planned controls into Merchant and Van der Stede's four types
controls = {
    "Divisional profit targets with bonuses": "results",
    "Capital spending limits needing head-office approval": "action",
    "Pre-shipment quality checklist": "action",
    "Hiring engineers with appliance experience": "personnel",
    "Two-day onboarding on the code of conduct": "cultural",
    "Monthly ROI and residual income reports": "results",
    "Segregation of purchasing and payment duties": "action",
    "Annual customer-satisfaction target": "results",
    "Team lunches to share lessons from failed launches": "cultural",
    "Supervisor training before promotion": "personnel",
}
from collections import Counter
count = Counter(controls.values())
for kind in ("results", "action", "personnel", "cultural"):
    items = [c for c, k in controls.items() if k == kind]
    print(f"{kind:<10}{count[kind]:>2}  " + "; ".join(items))
share = count["results"] / len(controls)
print(f"Results controls are {share:.0%} of the list")

results    3  Divisional profit targets with bonuses; Monthly ROI and residual income reports; Annual customer-satisfaction target
action     3  Capital spending limits needing head-office approval; Pre-shipment quality checklist; Segregation of purchasing and payment duties
personnel  2  Hiring engineers with appliance experience; Supervisor training before promotion
cultural   2  Two-day onboarding on the code of conduct; Team lunches to share lessons from failed launches
Results controls are 30% of the list

The program shows that three of the ten controls on Cormorant's draft list, or 30 per cent, are results controls, with action controls also three, and two each of personnel and cultural controls. A count alone does not show whether the mix is right, but it is a useful first check: a list made up almost entirely of targets and bonuses is a warning that the designer has reached for results controls by habit.

Simons' levers of control

Robert Simons, writing in the 1990s, asked how senior managers balance two needs that pull in opposite directions: the need for innovation, learning and opportunity seeking, and the need for predictable goal achievement. He identified four levers of control. Belief systems are the explicit statements of values and purpose, such as mission statements and credos, that inspire and direct the search for opportunities. Boundary systems define the limits of acceptable action: codes of conduct, strategic boundaries such as markets the company will not enter, and rules that must not be broken. Diagnostic control systems are the formal feedback systems used to monitor outcomes and correct deviations from preset standards: budgets, profit plans and project tracking systems. Interactive control systems are the formal systems managers use to involve themselves regularly and personally in subordinates' decisions, focusing attention on strategic uncertainties and stimulating debate and learning.

Simons' insight is that the same accounting system can be used diagnostically or interactively. A monthly profit report is diagnostic when managers glance at it, investigate only large variances and otherwise manage by exception. It becomes interactive when senior managers make it the focus of regular face-to-face meetings, asking what assumptions have changed and what new strategies the numbers suggest. Senior managers have limited attention, so Simons argued that most systems should be used diagnostically and only one or two, those tied to the organization's key strategic uncertainties, used interactively.

Otley's performance management framework

David Otley proposed in 1999, and later extended with Ferreira, a framework that asks a set of questions about any performance management system. What are the organization's key objectives, and how does it measure progress toward them? What strategies and plans has it adopted, and what processes and activities will implement them? What level of performance does it need in each area, and how does it set targets? What rewards will managers and employees gain, or penalties suffer, for meeting or missing targets? What information flows, feedback and feed-forward loops does the organization need to learn from experience and adapt? The extended framework adds questions about vision and mission, key success factors, organizational structure, the use of controls and how the system changes over time.

The framework's value is that it forces a designer to look at the whole system. A company may have well-defined objectives and targets but no clear link to rewards, or rewards that encourage the wrong things, or no way of learning from the results. Weakness at any point undermines the rest.

# Otley's five questions applied to one division, scored 1 (weak) to 5 (strong)
questions = {
    "Objectives: what are the key objectives?": 4,
    "Strategies and plans: how will they be achieved?": 3,
    "Targets: what performance level is needed?": 4,
    "Rewards: what happens when targets are met or missed?": 2,
    "Information flows: what feedback lets people learn?": 2,
}
for q, s in questions.items():
    print(f"{s}  {'#' * s:<5}  {q}")
avg = sum(questions.values()) / len(questions)
weakest = min(questions, key=questions.get)
print(f"Average score: {avg:.1f}")
print("First gap to fix:", weakest.split(':')[0])

4  ####   Objectives: what are the key objectives?
3  ###    Strategies and plans: how will they be achieved?
4  ####   Targets: what performance level is needed?
2  ##     Rewards: what happens when targets are met or missed?
2  ##     Information flows: what feedback lets people learn?
Average score: 3.0
First gap to fix: Rewards

Scored by its management team, the Appliances division averages 3.0 out of 5. Its weakest areas are rewards and information flows, both scored 2, and the program reports the first of these as the gap to fix. Lesson 11 returns to the design of rewards, and lesson 12 uses a fuller version of this diagnostic as part of the capstone.

Control as a package

Researchers Malmi and Brown argued in 2008 that management control should be studied as a package, because organizations operate many controls at once, introduced at different times by different people. Their typology groups controls into five types: cultural controls (clans, values, symbols), planning (long-range and action planning), cybernetic controls (budgets, financial and non-financial measures, hybrid systems such as the balanced scorecard), reward and compensation, and administrative controls (organizational design, governance structures, policies and procedures). Thinking in packages helps explain why adding a new control, such as a balanced scorecard, sometimes changes little: other parts of the package, such as a bonus plan based only on profit, may pull in a different direction.

Contingency: no single best design

Contingency theory holds that there is no universally best control system. The right design depends on factors such as the external environment (stable or uncertain), technology (routine or non-routine tasks), organizational size and structure, strategy and national culture. Studies have found, for example, that firms following a prospector strategy, continually searching for new products and markets, tend to rely more on interactive controls and broad, flexible measures, while defenders, competing on cost in stable niches, rely more on tight budgets and standard costs. A Canadian or US multinational may need different emphases in subsidiaries operating in very different cultures.

For Cormorant, contingency thinking suggests different control emphases for each division. Components is a relatively stable manufacturing business where standard costing and tight budgets work well. Appliances faces fast-changing technology and incentive programs, so interactive use of market information matters. Services depends on dispersed, skilled people, so personnel and cultural controls carry more weight. A single uniform control system imposed on all three would fit none of them well.

Ethics and the controller's role

Management accountants design and operate control systems, which gives them influence over behaviour and access to sensitive information. CPA Canada's provincial codes of professional conduct require integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. A controller who is pressured to set targets that encourage misleading reporting, or to overlook manipulation of divisional results, faces exactly the conflicts these codes address. Lesson 3 returns to budget gaming and lesson 11 to the ethics of incentive design.