It's the culture: Why financial controls may not always be key