In many organizations, “we need more control” sounds reasonable. Something goes wrong, a deviation is reported, or a leader is questioned by the board – and the response becomes: add more control.
The problem is that control rarely stops where it started. New forms, extra approvals, additional reporting and local checklists appear. What was meant to create security can end up creating friction and frustration.
When the focus on control grows, many actors start their own local control initiatives. Units, teams or individuals add their own checks “just to be sure”. This often happens without coordination, and can easily lead to unnecessary or even harmful control. The result is parallel controls, duplicated work and a patchwork of measures no one has the full overview of.
Unnecessary control shows up as time spent on reporting, documenting and signing off without any real effect on outcomes. Harmful control shows up when routines and approvals slow down the work, reduce flexibility and undermine professional judgment. Employees may feel they spend more time documenting their work than doing it, while leaders drown in reports that do not improve decisions.
To avoid this, it is important to have a clear strategy for where and when control should be applied. Control should not spread by default. Before new measures are introduced, someone should always ask: What are we trying to prevent or achieve? Which concrete risk are we addressing? How will this be experienced in practice? How will we know if it has an effect?
Control should be used where it actually makes a difference. That means prioritizing areas where the risk or consequences of errors are high, where there are legal or regulatory requirements, or where there is a history of recurring deviations. Not all areas need the same level of control, and overcontrol can be just as damaging as too little control. A simple principle can be: as little as possible, as much as necessary.
It also matters who performs the control and how it is done. Control should be carried out by competent actors and supported by good systems. Those who control need to understand the subject matter and the processes they are looking at. Systems and routines should be simple, understandable and integrated into everyday work, not added on top as separate layers that no one believes in.
Without this, the control regime itself can come out of control. You get ever more requirements, more data and more reporting, without a clear sense of what is useful. The organization slows down, frustration rises, and trust is weakened.
To keep control under control, someone must take responsibility for the overall picture. That includes regularly reviewing existing controls, removing or simplifying what no longer gives value, and involving those who are actually being controlled when new measures are designed. Control should be a tool that supports good work and sound decisions – not a system that runs away from the people it was meant to help.