The future of internal controls The future of internal controls

Amid growing uncertainty and regulatory pressure, there is a sharp focus on risk management and controls. It has now become imperative for firms to have a strong and effective internal controls environment to drive value and provide a solid foundation to support growth.

Controls are going to have a significant impact on all functions in an organisation, particularly for corporate business services (CBS). The three key reasons why controls are becoming more important:

• Regulatory pressure: The most fundamental reform of the UK corporate governance landscape will happen in the next few years. The government published white paper ‘Restoring Trust in Audit and Corporate Governance’ will transform the way organisations talk about trust and controls. Coupled with the regulation around climate reporting and ESG, organisations will face a range of risks they have never seen before and will be expected to significantly bolster their control environments.

• Increased risk awareness: Financial services organisations had their watershed moment with the financial crisis in 2008, which accelerated a more focused risk and controls mindset. The same has not been the case for corporate organisations. In these businesses, risk tends to be bundled together with legal or finance or with an internal audit and risk function. With COVID-19 and increased regulatory pressure, risk has become a boardroom level conversation, and with that also the need for stronger, better controls. This is no longer something that can be viewed as a tick box exercise.

• Investment in technology: Digital transformation and the increased use of technology, in many instances accelerated by the pandemic, have created new risks which need to be controlled and managed including around new cloud based ERP system, robotics and artificial intelligence. And we all know, with emerging technology lies greater risk; businesses need to focus on to making their internal controls more efficient, automated and secure.

All of this change can result in control fatigue which, if not managed carefully, can drive an increase in non-compliance. Business will face new risks, a new regulator and therefore will have to create new processes and controls to manage risk.

Better control means better service. CBS organisations house the core skills required to enable the change needed to drive better control. CBS functions are well placed to drive the standardisation, simplification, automation and optimisation required to enable improved financial control and the related reporting of risks and key issues.

CBS functions will need to become quicker in addressing emerging risks from new regulations and technologies. It’s about moving away from manual – often spreadsheet based – solutions towards leveraging digital technologies and automations available to enable and support regulatory compliance and controls. Organisations should move towards using technology to generate insights.

It’s also about taking ownership and accountability for managing and delivering control activity. One of the biggest challenges facing UK corporates over the next few years with incoming UK SOx legislation is about helping individuals to understand the value of controls and compliance. Compliance is often seen as an exercise that needs to be done with limited clarity on why it’s important.

1. With more regulation and more scrutiny on the way, there will be more controls for CBS organisations to operate going forward.

2. One of the key learning from US SOx, implemented over 15 years ago, was the need to think about how to standardise, simplify and automate before starting to add more controls to address regulation coming down the line.

3. Lastly, this is not just about governance and controls – nor indeed the underlying processes – successful change is underpinned by a supporting cultural journey. It is important that your teams understand why there is more focus on controls, why there is a higher standard than before; it’s important to help them to understand why they performing a control, not just what they need to do differently.

More advanced businesses that have undertaken a controls maturity assessment understand the value and insights that effective controls management/framework offers.

Contact us to talk about how we can support you with an initial assessment to help you to plan your next steps as you progress on your controls improvement journey.

If you have any questions on the above or want to discuss how we can help you, please reach out to us. You can also visit our UK SOx insights hub to hear more on what we are doing to simplify and improve internal controls.