And the Oscar for Control Failures Goes to…

Internal control enthusiasts everywhere are performing a root cause analysis of what went wrong at the Oscars this weekend, so Radical Compliance might as well get a piece of that action too. After all, when was the last time a control failure was household news?

The debacle, for those last few who haven’t yet heard the news, happened when Warren Beatty and Faye Dunaway announced the wrong winner for Best Picture. The true winner was Moonlight (no spoilers please, haven’t seen it yet), but someone handed Beatty the wrong envelope. That led Dunaway to announce incorrectly that the winner was La La Land.

Only several minutes into the La La Land team’s acceptance speech did someone interrupt the La La Land team, who graciously told the audience that actually Moonlight beat them out. As live television snafus go, this one was pretty epic.

That’s the meet-cute for this control failure. Now let’s do the flashback scene.

Audit firm PwC has managed voting for the Oscars since 1935, tallying the votes and preparing the envelopes that contain the names of winners. The firm shamelessly promotes its role, telling anyone who will listen (which can’t be a large number of people, really) that the PwC partners who oversee this client engagement are the only people who know the winners ahead of time.

This year, those partners on scene were Brian Cullinan and Martha Ruiz. Cullinan was the person who handed the wrong envelope to Beatty. Just minutes before Cullinan did so, he tweeted a photo of actress Emma Stone that said, “Best Actress Emma Stone backstage! #PWC!” (Yes, Stone did win the Best Actress Oscar.)

That’s the setup and the cast of characters. Now let’s get on with our analysis of control failures.

Environments, Control or Otherwise

The prime suspect here is Cullinan. According on an article in the Wall Street Journal, tweeting from backstage “was not sanctioned” by the Motion Picture Academy, and PwC had not given him permission to do so. What’s more, Cullinan deleted the tweet in question on Monday morning—an indication that he knew he had violated policy, and was trying to destroy evidence that he had.

Right away, then, we could say this lapse was a failure of the control environment. Look at the COSO principles for an effective control environment. Among those principles are “Demonstrates commitment to integrity and ethical values,” (Principle 1); and “Demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives,” (Principle 4).

You’d like not to beat up Cullinan too much for what could be an honest mistake—but that’s not easy. He has been head of PwC’s practice in Southern California since 2012, and been with the firm for 20 years. Right away, then, we can assume he knew the importance of the Oscars to the firm’s reputation. He knew the need for proper procedures and risk controls.

One might even wonder if Cullinan were simply starstruck by the presence of Emma Stone. Lord knows I would be, and probably you too. (Cullinan says no, according to the WSJ article.) Perhaps backstage at the Oscars is a chaotic environment, although with so many millions of people watching, I suspect that it’s a tightly scripted environment.

Still, we can’t escape the fact that Cullinan wasn’t supposed to tweet from backstage, and he did. Then he deleted the evidence.

Then again, let’s remember another fact: the envelope Cullinan handed to Beatty contained the results for an award that had already been announced. That’s not a failure of the control environment. Handing someone a duplicate envelope means PwC lost version control; Cullinan shouldn’t even have had a spare version of the wrong envelope at all.

Control Activities and Risk Assessments

If a company has multiple versions of a report floating around (which, in abstract terms, is what happened here), that tells me to look more at the risk assessment and control activities. Someone handing an announcer the wrong envelope is not a far-fetched risk to imagine; when you include the sky-high reputation consequences for PwC, it seems like a singularly easy risk to identify and anticipate. (COSO Principle 7: “Identify and analyze risks.”)

What were the control activities PwC used to mitigate that risk? Alas, we don’t know. In theory Cullinan and Ruiz could have sat at a computer terminal, printing out only one award announcement for each category, exactly when it was needed. In practice, that probably would slow down an awards ceremony that’s already too long.

A photo from Reuters has surfaced of Cullinan, Ruiz, and Beatty, presumably with the offending envelope in hand. No markings are visible that might have helped to prevent a mix-up, like “Best Picture” emblazoned on the front in bold color, but perhaps we simply can’t see them. We just don’t know enough detail yet about what controls PwC typically does use, or why those controls failed.

Which brings me to my last concern. Whatever the root control failure might be, for an operation so high-profile, the correct strategy is to assume that all your controls are inadequate—and therefore, as always, you’ll need compensating controls.

First, Cullinan and Ruiz did recognize their mistake as soon as Dunaway incorrectly named La La Land. For whatever reason, they huddled with Oscars staffers and two minutes passed before the correction was announced. In the highly visible world of the Oscars ceremony, two minutes is a lifetime.

And in this case, the final compensating controls were Warren Beatty and Faye Dunaway. They didn’t work either. Video of the moment suggests that Beatty at least knew something seemed off, since he had the Best Actress award in front of him. He handed the card to Dunaway for her opinion, who seems to have decided that since the card said, “La La Land,” that was the film to announce.

What could they have done? They could have paused the ceremony to clarify. (Call it a pause for dramatic effect.) Yes, announcers are just announcers, and we should not depend on them for accuracy like we should PwC. But they were poorly trained in how to interpret the cards correctly, and they seemingly didn’t know that asking for help was OK. Yes, the show must go on, but sometimes you can take an intermission.

Principle 5: Hold People Accountable

We should give credit to PwC for falling on the sword as soon as fate drew the blade. On Monday the firm’s chairman, Tim Ryan, said, “This was our issue. PwC made the error, and we’re accountable.”

Ryan also said he spoke with Cullinan. We don’t know what sanction Cullinan might face, if any. I don’t know what punishments would even be worth the bother, since Cullinan is going to beat himself up for this more than anyone else ever could.

The Motion Picture Academy, meanwhile, says it will “determine what actions are appropriate going forward.” Does that only mean it wants tighter controls from PwC so we don’t have a sequel to this snafu? Or might the Motion Picture Academy not allow PwC to have a repeat performance at all?

All we can do is keep watching.