The Control That Still Exists

Some of the earliest evidence that a control is weakening may be hidden inside the very activity that appears to demonstrate that it is working.

“We have a control for that” is one of the more reassuring things an institution can say. It means a risk has been anticipated and something has been put in its path: an audit function, a procurement rule, a complaints mechanism, a safeguard, a monitoring framework, a conflict-of-interest procedure or an escalation process. The machinery is visible, documented and usually capable of being demonstrated to somebody who asks.

Yet controls do not always fail by disappearing. Sometimes they remain exactly where they were, producing reports, approvals, meetings, findings and action plans, while becoming less effective at preventing, detecting or correcting the problem they were created to address. That is a much harder weakness to see. An absent control leaves a gap. A weakening control may continue to look reassuring.

This distinction matters for climate finance because so much of integrity practice quite properly concentrates on identifying risk around projects, counterparties and transactions. We ask whether procurement can be manipulated, whether conflicts are declared, whether complaints can be raised and whether reported results can be verified. Behind all of those questions, however, sits another one that receives less attention: how do we know that the systems designed to provide those protections are themselves still working as intended?

Recent evidence from Kenya shows why the distinction matters. A 2026 U4 study examined implementation vulnerabilities in the Financing Locally-Led Climate Action program, which channels climate finance through county-level institutions. The program operates within an established governance environment that includes public financial-management systems, grievance mechanisms, participatory planning and national oversight. Yet the study found that those safeguards were constrained in practice by weaknesses including limited enforcement, low fiscal transparency and limited follow-up on audit findings. It also found that community influence could weaken after priorities had been selected, even though subsequent financial and procurement decisions remained consequential to what communities ultimately received. The study is a qualitative diagnostic based on stakeholder perceptions rather than a measure of how widespread such weaknesses are, so its value lies in what it shows about how controls behave.

What stands out in this evidence is not that the controls were missing. Many of them were there. The problem lies in the distance between the presence of a mechanism and the protection that mechanism ultimately provides. A grievance channel may exist, but its integrity value depends on whether people can use it and whether concerns can travel far enough to provoke a meaningful response. Participation may be built into project design, but that tells us little about whether community influence survives into the stages where funds are spent and implementation choices are made. An audit may identify a weakness perfectly well and still tell us nothing about whether the weakness was ever corrected.

That suggests a distinction worth making. Institutions tend to know their control inventory: the policies, functions, committees, safeguards and procedures that exist. What is harder to see is their control condition: whether those mechanisms continue to operate with enough authority, responsiveness and practical effect to provide the protection attributed to them.

When the same finding returns

The condition of a control sometimes becomes most visible after it has apparently done its job. The Audit Office of New South Wales provides a clear example. Its 2026 review of internal controls and governance across 26 of the state’s largest agencies found that repeat audit findings had risen to 42 percent of all findings, up from 33 percent the previous year. These were not newly discovered weaknesses. They were issues that had already been identified and remained unresolved, and the auditors said the increase suggested that vulnerabilities were going unaddressed. This is an audit of New South Wales government agencies, not of climate finance; it is used here only to show what a repeat finding reveals.

A first finding tells us that a system detected a problem. A repeat finding tells us something different: the institution already knew.

That difference changes the integrity question. We understandably pay attention to whether institutions are capable of seeing problems. Audits, evaluations, complaints mechanisms, monitoring systems and supervisory reviews all exist partly to produce information that would otherwise remain hidden. But producing information is not the same as converting it into institutional response. A system can be highly capable of generating warnings and considerably less capable of ensuring that those warnings change what happens next.

A climate-finance example shows the same problem from another angle. In 2023, the UK’s Independent Commission for Aid Impact reviewed the £500 million Blue Planet Fund, part of the UK’s international climate-finance effort. The Fund’s own Joint Management Board had flagged “severe” risks similar to those later identified by the reviewers, yet those risks were not discussed at the wider International Climate Finance Management or Strategy Boards. ICAI said this suggested a lack of cross-government oversight. It also found that key management processes, including monitoring, evaluation and learning systems and finalized key performance indicators, were still missing two and a half years after the Fund’s launch. The significance here is not that the risks were invisible. They had been identified. The weakness lay in what happened after they were seen.

Professional audit practice recognizes this distinction. The Global Internal Audit Standards do not treat communication of findings as the end of the process; Principle 15 expressly combines communicating engagement results with monitoring action plans. The Adaptation Fund applies similar logic. Its Management Action Tracker records, for each evaluation recommendation, management’s response, the actions agreed, who is responsible and the status of implementation.

This applies well beyond audit. A safeguard process that repeatedly identifies the same implementation weakness raises a different question from one that catches a new problem. A monitoring framework can generate accurate reports and still have limited value if adverse information does not influence implementation.

When normal practice moves away from the rule

Controls can also weaken more quietly, when the formal framework remains unchanged but operating practice gradually moves around it.

Exceptions are a normal part of institutional life. Rules cannot anticipate every emergency, and a rigid system can be as dysfunctional as a weak one. The integrity question arises when an exception designed for unusual circumstances persists long enough to become ordinary.

A 2025 audit by the Office of Inspector General at the U.S. Department of Housing and Urban Development examined procurement undertaken by New York State following Hurricane Sandy. A temporary waiver issued by the Governor in November 2012 had allowed departures from normal procurement requirements during disaster recovery. The auditors found that the waiver was still being relied upon five or more years later, including to explain contract extensions and departures from the State’s contracting requirements. They concluded that the State did not foster open competition and ensure that it obtained the best services at the best prices, and that continued use of the waiver so long after the disaster did not appear reasonable or cost effective.

This is not a climate-finance case, and it does not establish that such a pattern is widespread in climate-finance institutions. Its value is in illustrating a familiar institutional mechanism. An exception is created because circumstances genuinely require one. It proves useful. Its use continues. The formal rule remains on the books, but operational reality gradually shifts elsewhere.

That is a form of control drift. It does not require anyone to decide that standards should be weakened. The distance between formal design and actual practice can grow incrementally, one justified decision at a time.

Climate finance has particular reasons to pay attention to this possibility. Delivery often takes place under conditions that make flexibility both legitimate and necessary: emergencies, difficult implementation environments, compressed timelines, political pressure to demonstrate progress and situations in which standard procedures were not designed for the context at hand. The issue is therefore not whether exceptions should exist. It is whether institutions remain able to distinguish an exception from an emerging operating model.

Patterns matter here more than individual decisions. A single waiver may tell us very little. Repeated waivers addressing the same problem may tell us that the rule no longer fits the environment in which it is supposed to operate. A temporary arrangement that repeatedly needs extension may reveal more about the institution than the paperwork approving each extension separately.

The evidence may be hiding inside the reassurance

A control that visibly collapses is usually easy to recognize. A required review does not happen. An audit function has no staff. A procurement proceeds without approval. A complaint mechanism does not exist. There is something obvious to point to.

A weakening control is harder because it can continue producing evidence of its own operation. The report arrives. The recommendation is accepted. The committee meets. The complaint is closed. The waiver is approved. The consultation takes place. From a distance, these are all signs of a functioning system.

But some of the earliest evidence that a control is weakening may be hidden inside the very activity that appears to demonstrate that it is working: a report that arrives while the same weakness reappears, a complaint that closes while the underlying practice continues, an exception that is properly authorized but no longer appears exceptional, participation that occurs while influence fades before the most consequential decisions are made.

This is why control condition is different from control inventory. The first cannot be established simply by counting the second.

There is no validated set of early-warning indicators that allows a climate-finance institution to determine mechanically whether its integrity systems are deteriorating, and the available evidence should not be stretched to suggest otherwise. The same signal can mean different things in different circumstances. A rise in complaints might indicate worsening conduct or greater confidence in the mechanism. A longer review might indicate capacity strain or greater rigor. More exceptions might point to attempts to circumvent a rule or to a rule that genuinely requires redesign. The absence of a formula does not make these signals meaningless. It means they require interpretation, particularly when several begin to move together.

An institution that sees recurring unresolved findings, repeated exceptions, complaints that close without evident remedy, monitoring concerns that do not alter implementation or participation mechanisms whose influence fades at the point of decision may not be looking at five unrelated administrative facts. It may be seeing something about the condition of its integrity architecture.

That is a different way of reading information institutions already possess. It asks less about whether assurance activity occurred and more about what that activity reveals over time. It also avoids the instinctive response of adding another committee, another form or another layer of control whenever weakness appears. Sometimes the more useful intervention is to understand why the existing machinery is no longer producing the effect expected of it.

Climate finance already subjects projects to this kind of scrutiny. Institutions monitor implementation, disbursement, safeguards and results because a project that was sound when approved can change during delivery. We do not assume that yesterday’s assessment permanently establishes today’s condition. The same logic should apply to the systems protecting the finance itself.

A control can be appropriately designed, properly documented and demonstrably present, yet still become less effective as circumstances, incentives or institutional practice change. The real blind spot is not simply that this can happen. It is that the evidence may already be sitting inside ordinary institutional activity, disguised as proof that the system is functioning.

That leaves “we have a control for that” sounding less like the end of an integrity question and more like its beginning. What is the evidence that it still works?

References

1. Gargule, A. A. (2026). Understanding corruption risks in devolved climate finance: Implementation vulnerabilities in the ‘Financing Locally-Led Climate Action’ programme in Kenya. U4 Issue 2026:10. U4 Anti-Corruption Resource Centre, Chr. Michelsen Institute, 17 August 2026.

2. Audit Office of New South Wales (2026). Internal controls and governance 2026: Grants, consultants, purchasing cards and technology. 12 August 2026.

3. Independent Commission for Aid Impact (2023). Blue Planet Fund. Rapid review, 30 November 2023.

4. The Institute of Internal Auditors (2024). Global Internal Audit Standards. 2024 Edition.

5. Adaptation Fund Technical Evaluation Reference Group (2026). Management Action Tracker: Tracking Actions Towards Evaluation Recommendations. AFB/EFC.36-37/Inf.3, 24 March 2026.

6. U.S. Department of Housing and Urban Development, Office of Inspector General (2025). New York State Can Improve Its Disaster Recovery Procurement Processes. Report 2025-FW-1001, 4 September 2025.

About the Author

Ame I. Odaro-Adjei advises on the governance frameworks, control systems, project safeguards, and institutional arrangements that protect financial integrity and support credible climate finance delivery. Her background spans global investment banking, international development, and multilateral climate finance, including leading the compliance function of the world’s largest dedicated multilateral climate fund. She specializes in anti-money laundering, counter-terrorist financing, sanctions compliance, ethics, anti-corruption, and anti-fraud. She is a qualified attorney.