As a company grows, protecting its information and explaining what is happening across the organisation require more work.
In Brief
The large corporations I have worked with devoted considerable time and resources to security and internal reporting. As an organisation grows, management finds it harder to see everything directly, and there is more information to protect. Understanding that need does not remove the burden on the people requesting information and preparing reports.
The atmosphere at large corporations with market capitalisations above US$700 million was quite different from that at startups working towards an IPO. Moving between the two as an accountant, I noticed differences in how information was obtained, findings were explained and assignments were completed, even when the underlying work was similar.
Security and reporting were among the first things I noticed. At large corporations, they seemed to absorb a considerable share of the organisation’s capacity. The number of procedures can feel excessive at first, but it becomes more understandable when you consider the size of the company.
1. Information security
Large corporations hold a great deal of information that should not be disclosed outside the business. Their records contain the technologies and strategies that have given them an advantage over competitors, information about customers and business knowledge accumulated over many years. Protecting that information becomes an important part of running the company.
For an external accountant requesting information, that protection can involve additional procedures. Explaining which records are needed and actually receiving them are separate matters. Depending on the information, it may also be necessary to establish who can provide it and how much can be shared.
The startups I worked with had many immediate demands besides security. They needed to develop products, recruit people and secure funding. They might still be discovering which technology or business would drive substantial growth. What I saw was less a lack of awareness of security than too many demands on limited people and resources.
A smaller company does not necessarily hold less important information. NIST’s small business cybersecurity guide also explains the need to identify assets and determine the appropriate protection according to their sensitivity and importance to the business. The resources actually devoted to security and the level of protection required need to be considered separately. NIST Small Business Quick-Start Guide
2. The role of reporting
Internal reporting follows a similar logic. To understand whether an organisation is being managed well, executives and managers need to know what is happening in its departments. As the number of divisions and subsidiaries increases, direct conversations alone make it difficult to see the whole company.
Weekly reports and management presentations become necessary in this setting. They bring together information scattered across the organisation and arrange it in a form management can review. The people doing the work may be documenting what they already know, but for someone who was not there, those reports provide a way to understand the situation.
Preparing them takes effort. After carrying out the work, someone has to summarise progress, explain the background and prepare to answer questions. Time spent explaining the work comes on top of the time spent doing it.
At startups, management could often see the company’s main activities directly. The organisation was small and colleagues worked closely together, so separate reports were not always needed to understand what was happening. Information that would travel through documents and meetings at a large corporation could sometimes be shared through everyday conversation.
3. The purpose of procedures
These differences make it difficult to dismiss security and reporting at large corporations as unnecessary procedures. An organisation in which many people operate several businesses needs ways to protect and share information.
That does not mean every procedure continues to offer the same value. If the person preparing a report finds it difficult to explain whom it is for or what it needs to communicate, its purpose deserves attention. Different readers may need different explanations of the same issue, while some needs may already be met by existing material.
The following questions can help make that purpose more specific.
| Task | Purpose to establish | Specific question |
|---|---|---|
| Approval to release information | Sharing the information needed within an appropriate scope | Which records are needed, and who can decide how much may be shared? |
| Regular reporting | Showing management what it cannot readily see directly | What has changed since the last report, and what needs to be checked or decided? |
| Additional explanatory material | Helping someone who was not involved in the earlier discussion | What background or implications does this reader need that the existing material does not cover? |
This difference matters to accountants too. If obtaining the records and communicating the result take time, that time is part of the assignment. It is one reason why the time needed for the analysis alone is not enough to estimate the overall workload.
Key Takeaways
- Security and internal reporting at large corporations serve purposes arising from the demands of running a large organisation.
- Doing the work and explaining it to other people each take time.
- To assess whether a procedure is needed, identify the information to protect, the report’s reader and the decision that person needs to make.
Delivering information does not necessarily lead straight to a decision. In Part 2, I look at the distance between the person who understands an issue and the person who can decide what to do about it.
References
- National Institute of Standards and Technology (NIST), NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide, NIST SP 1300, February 2024, “Identify” and “Protect.