Member News

A few years ago, a global online travel platform acquired a technology business. It came with an immature control environment.

Documentation of its key systems was thin, and in places it did not exist. There was no clear record of who was given access when they joined, what changed when they moved roles, or what was removed when they left. And the business was about to face its first annual controls audit as part of a US-listed group.

We were brought in to help rebuild the control environment. The new controls were signed off by internal and external audit, and the new process for managing access needed fewer people to run than the old one.

But the lesson stayed with me. The acquisition changed the business overnight. The controls did not change with it until someone made them.

That experience made me think about a question that applies well beyond acquisitions. When a business changes, do its controls change with it?

Why this matters here

In my first article for the Chamber, I wrote about the gap I see between knowing governance matters and acting on it. The natural follow-up question is: when is the right moment to act?

My answer is whenever your business changes.

The problem is rarely that a business has no controls. More often, the controls were designed for the business as it existed yesterday.

Controls are built for a business at a point in time: its people, its systems, its suppliers and its processes. They do not update themselves. So a new finance system, an acquisition, an outsourced process or a new market each quietly opens a gap between how the business now works and how it is controlled. AI goes further still: it can change who, or what, performs a control.

None of that is a criticism. Change is what successful businesses do, and the UAE is one of the most dynamic markets in which I have worked. That is exactly why the question matters.

Three changes happening now

VAT supplier checks. Since 1 October, VAT-registered businesses must, above certain thresholds, verify their suppliers and the supplies they receive before recovering input tax. They must also keep a documented policy naming who is responsible. On paper that is a tax change. In practice, it reaches into procurement, accounts payable, approvals and record-keeping. The question is not "are we aware of it?" but "what needs to change in how we operate?"

E-Invoicing. Larger businesses must be live from January 2027 and the rest from July 2027. Larger businesses also need to have appointed an Accredited Service Provider by 30 October. Most will treat it as a systems project. But once invoices flow automatically, the checks people used to do by eye have to be built into the process instead.

New systems. When a financial market infrastructure firm merged two ERP systems into one, the questions that mattered were not technical. Who could now approve what? Were duties still separated? Did data arrive complete and accurate? Asking during the project, rather than after it, is what surfaced the gaps. The same applies whenever an automated control replaces a manual one: someone still needs to know how it works, who owns it and how it is monitored.

Keeping up does not always mean adding controls. On a UK bank programme that grew from £1 billion to more than £8 billion, we cut the key controls from around 300 to 60. The aim is controls that fit the business as it now is.

A simple test

The next time your business makes a significant change, ask five questions:

1. What process has changed?
2. What risks have changed?
3. Which controls need to change, and which can go?
4. Who owns them now?
5. What evidence will show they work?

If you cannot answer the last two, the change is not finished.

The businesses that stay in control

Successful businesses change constantly. The ones that stay in control treat every change as a moment to ask how the business is controlled, not only what it does. Ask early enough, and you avoid redesigning the business twice.

If your business has made a significant change this year, tell me what it was. I will send back the three controls I would check first. No pitch and no obligation. Email me at [email protected] or find me at the next BCCD event.

Zeshan Raja, Founder, ZRC International

Twenty-five years of governance, risk and controls delivery across UK financial services, retail, banking and technology. Now building in Dubai.