Smaller companies and larger organizations alike are discovering innovative ways to cut the cost of controls, increase control quality and make internal controls more attractive.
“Our control framework consists of more than 8’000 controls and we have 300+ internal control officers in place; 80% of our controls are manual, the quality is low and we have many overlaps between control frameworks: It feels like we are still in the Stone Age with our internal control system.”
As Technology Risk Partner, I often receive messages like this from clients. If you work in Finance, Risk or IT, you’ll probably sympathize.
Total (hidden) costs of control
Individual controls can be very expensive. One client recently revealed that a single (financial reporting related) IT General Control (ITGC) costs about 50’000 CHF per annum. It doesn’t take a data scientist to calculate that the costs of ITGCs alone can run into tens, even hundreds, of millions at a larger company with 100+ systems, each with 25 ITGCs. Then there’s the cost of designing, maintaining, executing, testing and auditing. And that’s just ITGCs – imagine the total cost of control if you also consider process-level controls, entity-level controls over financial reporting and requirements for additional controls in compliance, cyber security, GDPR, quality control.
Transparency key to improvement
We recognize two major focus areas for improving the control environment.
- Control rationalization
- Control automation
With transparency in the cost of control, companies can – almost without exception – build a business case for control rationalization and automation projects. To do so, they need to collect and document costs in every control category:
KPMG’s survey Governance, Risk and Compliance 2019 shows that most internal control frameworks consist primarily (>80%) of manual controls, while automated controls make up the minority. A rationalization process often reduces the total volume of controls in a first step, by eliminating 10% to 20% of obsolete, duplicate or ineffective controls. A further 20% to 25% of the manual or IT-dependent manual controls can be automated by new technologies.
Automation – or control-as-a-service
With budgets already stretched, many companies wonder how they can afford to automate.
Let’s take the example of a control framework with 800 controls, of which 80% manual. If the number of manual controls is reduced to 60% of the total population and we calculate on the basis of CHF 25’000 per control per annum, we end up with CHF 3 million per year available to replace the 160 manual controls with automated controls.
Today there are solutions available that enable control automation, either within your IT landscape or in the cloud. These solutions replace the patchwork of systems often currently in place. They combine data extraction, analysis and workflow functionality of different areas in one integrated (cloud) platform.