Of Contract Labor and Your Control Environment

The KPMG Audit Committee Institute recently published its annual survey of audit committee worries—and don’t die of shock, but maintaining high ethical rigor across the extended enterprise was a big concern.

KPMG phrased the issue as “maintaining the control environment in the company’s extended organization.” It ranked third among audit committee worries, tied with cybersecurity and behind effectiveness of enterprise risk management systems and regulatory compliance.

That shouldn’t be news to compliance or audit executives. Instead, keep that detail about the control environment in mind and read “The End of Employees,” a superb feature in last weekend’s Wall Street Journal about the proliferation of contract employees in Corporate America. Not only are these legions of contractors part of your extended enterprise; they reach deep into the heart of your operation.

In that case, the news is that audit committees aren’t worrying even more about extending the control environment.

The article hops from industry to the next, estimating how many people in those fields don’t actually work for the companies they work at. In oil & gas and pharmaceuticals, contractors can outnumber full-time employees 2-to-1. In medical transcription, the Bureau of Labor Statistics figures that 25 percent of all workers are employed by “business support services” rather than medical offices.

Nobody knows exactly how many contract workers are roaming around the U.S. workforce, the article says, but academics have pegged the number as high as 20 million. The larger the business, the more likely that at least some people on staff are contractors.

Protect Your Environment

Compliance and audit executives alike should feel uneasy about those numbers—which, in all probability, will only increase over time. Contract labor can make good financial sense, but remember what else this arrangement does. It entrusts potentially large portions of your control environment to another party.

Consider these two principles for the control environment from the COSO framework of internal control:

• Principle 1: Demonstrate commitment to integrity and ethical values;
• Principle 4: Demonstrate commitment to a competent workforce.

Those principles are the cornerstone of any ethical organization. When you use contract labor, the risk of them failing goes up.

I know the counter-arguments: that staffing agencies have rigorous hiring processes and Codes of Conduct, just like your own organization; that staffing agencies are like any other vendor, subject to due diligence and ethics certifications the compliance department imposes. These arguments aren’t without merit. And if you read the Code of Conduct for a large staffing firm like Adecco, it hits all the right notes.

Still, those arguments also only go so far—which is to say, they don’t go far enough to address the risk fully. Which is why 28 percent of audit committee members, according to KPMG, list the control environment of the extended enterprise as one of their top worries.

The challenge with contract labor is that for all the due diligence, training, and ethics certifications a compliance program might impose, everything still hinges on one person serving two masters. I worry about how companies can make that work, when the business using contractor labor is always sending a subtle message: you’re disposable talent. As soon as it makes more sense to prune back on contractors, the company will.

Yes, some people enjoy working as contract labor; I’m one of them. But many others don’t. Many want to turn a contracted job into a full-time job, and the plain truth is that contractor status isn’t the same as full-time status. Companies even use differently colored ID badges to distinguish between contractors and full-time employees. If anything could ever tell a contractor, “You’re not one of us,” it’s a gesture like that.

Objectives in Conflict

When companies decide to pursue a strategy of contract labor, they’re trying to achieve one type of objective: operational. But as any student of the COSO cube knows, effective internal control balances other types of objectives, too—including compliance. And the most important part of effective internal control is a healthy control environment.

Let’s state that point again more plainly: reliance on contract labor pits operational and compliance objectives against each other. The more you use contractors, the weaker your grasp becomes over the extended enterprise’s control environment.

That, in turn, means you need greater reliance on the other components of effective internal control: shrewder risk assessment, better information & communication, more control activities, more monitoring.

And contractors are only one slice of the extended enterprise that boards worry about. One step removed from them are resellers and distributors (always famous for increasing your FCPA risk), plus all the other assorted partners who somehow convey your company’s brand and business proposition out to the wider world.

So maybe contract employees do make smart financial sense in the near term. But they make your job more complicated over the long term.

Something to think about for the next audit committee meeting.