Why Old Controls Might Be Stronger Than They Appear—But Not Always
Introduction: The Hidden Wisdom of Time in Controls
In internal audit, there is often an implicit bias toward novelty. New frameworks, freshly designed controls, and recently implemented procedures are assumed to be superior. Yet, time itself can be a powerful indicator of effectiveness.
The Lindy Effect, a principle derived from observation of technology and ideas, posits that the longer a non-perishable system has existed, the longer it is likely to endure. Applied to internal controls, it suggests that controls which have stood the test of time—surviving audits, operational pressures, and organizational changes—carry implicit strength.
However, longevity is not a guarantee of invincibility. Controls can become ossified, misaligned with strategy, or superficially resilient, giving a false sense of security. For internal audit, the challenge is to differentiate between enduring strength and outdated persistence, and to balance respect for historical performance with forward-looking vigilance.
Why Older Controls Often Outperform the New
Controls that have lasted over years or decades have often proven their operational resilience. Their longevity can indicate:
- Stability: The control adapts to normal operational variability without breaking.
- Integration: It is embedded in organizational routines, accepted by staff, and supported by culture.
- Proven Effectiveness: Historical incidents, audits, and performance metrics have repeatedly validated the control’s utility.
This endurance creates confidence for boards, executives, and auditors alike. Yet, it can also foster complacency. There is a subtle temptation to assume that “if it’s worked for 10 years, it will continue to work forever”, which may blind the organization to emerging risks or environmental shifts.
When Longevity Masks Vulnerability
Despite their endurance, long-standing controls are not immune to decay. Several factors can erode their effectiveness over time:
- Operational Drift: Processes subtly change; staff develop informal workarounds.
- Strategic Misalignment: Controls may no longer align with evolving business objectives, technology platforms, or regulatory expectations.
- Complacency Bias: Confidence in a control’s history can reduce monitoring intensity, oversight, or escalation of exceptions.
- Blind Spot Risk: New risks—cyber, ESG, geopolitical—may bypass controls designed for a previous operational reality.
Internal audit must recognize that age is a signal, not proof. A control’s history provides context, but not certainty. The key is to examine both how long a control has lasted and how well it is performing today in a changing environment.
Applying the Lindy Effect in Audit Practice
Auditors can leverage the Lindy Effect to balance respect for historical controls with strategic foresight. This requires a multi-layered approach:
- Historical Analysis: Review controls’ performance over time, including exceptions, trends, and incident recurrence.
- Contextual Mapping: Assess whether the operational and strategic context has shifted since the control’s inception.
- Risk Overlay: Map emerging risks against older controls to identify potential gaps.
- Behavioral Observation: Examine whether staff have adapted processes or developed workarounds that undermine the control’s intended effect.
- Validation and Testing: Use targeted, forward-looking testing rather than relying solely on historical track records.
- Continuous Reassessment: Embed periodic review cycles that challenge assumptions about enduring effectiveness.
By integrating the Lindy lens, auditors gain a nuanced understanding of control longevity, distinguishing between true resilience and superficial durability.
Lessons from the Field
In a multinational manufacturing company, legacy inventory controls had been operational for over a decade without incident. Traditional audit reviews deemed them reliable.
However, when auditors combined historical trend analysis with behavioral observation, they discovered subtle deviations in stock reconciliation routines and informal approvals developed to cope with high turnover. The controls were long-standing but had drifted in application. By reframing the evaluation through the Lindy lens, auditors provided actionable insight, reinforcing the controls’ robustness while addressing latent weaknesses.
In another case, a regional financial institution relied heavily on long-standing loan approval workflows. While historically effective, the rise of digital channels and rapid loan processing introduced operational complexities not accounted for by the legacy control design. By applying a Lindy-informed review, audit recommended strategic enhancements that preserved core integrity while adapting to new realities.
These examples illustrate that control longevity is an asset—but only if auditors interpret it dynamically, combining history with contextual foresight.
Conclusion: Auditing Time-Tested Controls with Foresight
The Lindy Effect offers auditors a powerful lens: it rewards appreciation for enduring systems while demanding vigilance against complacency. Controls with a proven track record are valuable, but longevity alone does not guarantee effectiveness in evolving environments.
Internal audit’s role is to synthesize history, operational behavior, and emerging risk, ensuring that long-standing controls remain both resilient and relevant. In doing so, audit transcends rote compliance and becomes a strategic partner in sustaining organizational integrity over time.
Our Commitment at AfriAudit
AfriAudit is more than a newsletter. It is a continent-wide campaign to elevate internal audit from silence to influence—from compliance to contribution.
We exist to:
- Equip auditors with a modern, courageous audit mindset
- Position audit functions as value drivers, not cost centers
- Build bridges between audit professionals and executive leadership
- Restore trust in institutions through transparency and strategic oversight
We believe that when audit thinks deeply, speaks clearly, and acts bravely—organizations transform.
And Africa wins.
Let’s Build This Together
Are you a fellow auditor, board member, risk leader, or institutional head who believes that understanding time-tested controls is essential for governance?
Comment below: How does your audit team evaluate the resilience and relevance of long-standing controls?
Follow AfriAudit for weekly insights that challenge, sharpen, and inspire.
Subscribe to join the growing network of African audit transformers.
With clarity and commitment,
Titus Wambua
Chief Audit Executive | Governance Advisor | Founder, AfriAudit
Turning internal audit into a boardroom asset — one institution at a time.
