Of Blown Calls and Internal Control

Effective internal control can be a difficult subject to understand, so ethics and compliance officers who hail from the legal world should be delighted right now. A great example of internal control issues gone awry fell into our laps this week from the world of sports.

I speak, of course, of the blown referee call in the NFL playoff game between the New Orleans Saints and the Los Angeles Rams.

For those last few Americans who haven’t heard about what happened, let’s first review the play. Last Sunday the Saints lost the NFC Championship game — and thus their chance to play in the Super Bowl next week —  to the Rams, in a 26-23 thriller of a game that went into overtime.

The blown call happened with 1:45 left to play in the fourth quarter, when the game was tied 20-20. New Orleans quarterback Drew Brees threw a pass to receiver Tommylee Lewis, who conceivably could have caught the ball and run to the end zone for a touchdown. Except Rams defensive back Nickell Robey-Coleman slammed into Lewis and knocked him flat before the football arrived.

That is pass interference, an illegal move. What’s more, as anyone can see from the below clip, this was clearly pass interference. Anyone versed in football could see that, and the referees should have called it so. Except they did not, and didn’t issue a penalty against the Rams — which could have put victory back within the Saints’ grasp.

Apparently this is not pass interference?? 🤔 pic.twitter.com/XmOyqnbSkr

— Simms & Lefkoe (@SimmsAndLefkoe) January 20, 2019

There’s no quibbling about whether pass interference actually occurred here. Robey-Coleman, the Rams player, admits he knew he was committing pass interference, and says he did so to prevent Lewis from scoring a touchdown. The NFL admits that its referees for the game made a mistake by not calling a pass interference penalty. And because pass interference calls are not subject to review by instant replay, the missed call stood. Then came overtime, and the Rams victory.

As one might imagine, Saints fans are not pleased with this. One group filed a lawsuit against the NFL in federal court, demanding that the game be replayed. Others threw their TVs into bonfires in protest. Talk radio and sports shows on ESPN have buzzed about this mess all week.

So what can we learn about effective internal controls? Lots.

Internal Control Terminology

First, the NFL has an objective: to play every game fairly, so the best team wins. There are many risks to achieving that objective: football is a complex, fast-moving game, where actions both good and bad happen all the time. Some bad actions are deliberate, others accidental.

So over the years, the NFL has introduced many internal controls to reduce the risks to achieving its objectives. Some of those controls are the rules of the game, accumulating over years of experience. Another is the training that players and coaches receive, including lessons learned about good sportsmanship long before reaching the NFL.

Those controls, however, belong more to the control environment: the overall set of expectations from the NFL about how games should be played and how players should conduct themselves on the field. Conceptually, they’re similar to an employee handbook and a list of standard operating procedures you might give to new employees, along with the training your company provides.

Referees fall into the category of control activities. COSO, the organization that wrote the Internal Control Integrated Framework that companies routinely use for compliance with the Sarbanes-Oxley Act, defines control activities as: “Actions established by policies and procedures to help ensure that management directives to mitigate risks and the achievement of objectives are carried out.”

That is what referees do. They help to ensure that NFL rules of the game are carried out correctly, to reduce the risk of on-field misconduct and to achieve the objective that every game is played fairly. They are a control activity.

That’s an important point to understand, because it frames the next logical question — one the NFL is confronting right now, and that Saints fans are clamoring about with that nutty lawsuit to replay the game. At an abstract level, it’s also a question that internal audit professionals face all the time.

What do you do when an internal control doesn’t work?

Risk Management Terminology

The question facing the NFL is what to do about such an egregious blown call. More precisely, should the NFL change the rules of how the game is played and how penalties are reviewed, to prevent more failures like this in the future?

Let’s recap. We had a risk: pass interference. We had a control: referees watching the plays. For whatever reason, that control failed. It’s quite plausible that because that play was called incorrectly, the Saints lost a game they otherwise would have won.

So that control failure led to a material adverse outcome for the game.

That’s point number one. If you’re assessing the effectiveness of an internal control, you want to ask: could the failure of this control lead to a material adverse outcome?

In this case, we can say yes. So the NFL needs to start asking more questions about how much risk it’s willing to accept, versus how much internal control it wants to impose. (Fundamentally, that’s what internal auditors think about all day long.)

First the NFL wants to consider the inherent risk of pass interference — that is, how often such misconduct would happen without any rules or referees at all. Well, the reality is that pass interference happens in football games all the time. Rarely is it as egregious as what we saw in the Saints game, but defensive players nudge, prod, and jostle receivers in every game.

So the NFL adopted rules against pass interference and put referees on the field to act as a control against that risk. Next question: how much residual risk is the NFL willing to accept, even after those controls are in place?

That’s what the NFL will need to answer in the off-season. If we decide the primary control (referees) isn’t sufficient enough to keep residual risk at acceptable levels, then what compensating control could the NFL introduce to support the referees when they screw up?

Sure, we could introduce instant-replay review for pass interference calls. The NFL already uses that compensating control for many other situations, like a touchdown call that’s difficult to see at first glance. But pass interference happens so much that instant-replay review will slow down the game.

That’s the difficult question for NFL senior executives and team owners. Do they want to introduce compensating controls that achieve the objective of fair play, but slow down business operations? Or do they want to keep operations running briskly, even if that runs the risk of alienating stakeholders (fans) when internal controls fail and a material adverse outcome happens?

I don’t know what the best answer is. Just remember, as you debate whether to lower the threshold yet again for payments to vendors without supervisory approval, or require yet another executive signature for large contracts with questionable third parties — all that internal control lingo comes from somewhere, and the challenges to playing fair are more universal than you might think.