Consider Solutions

CFOs, senior operational managers and their organisations are struggling with the increasing and competing demands placed upon them, particularly coming out of recession. The compliance burden has grown, the business is subject to increasing cost pressure, and the demand for more and better information for management decision making requires us to do more at lower cost.

Continuous Controls Monitoring (CCM) technologies are seeing a rapidly increasing demand as an antidote to the excessive cost of control and the need to reduce risk in organizations by moving beyond sample based control testing. Whilst there is some semantic debate about whether CCM is really testing controls or data or both, the experiences in industry demonstrate that the approach rapidly highlights and helps remediate the areas of risk associated.

In today’s environment, with effective controls and compliance moving up the agenda, management are moving from an expectation that they must have a documented controls framework and compliance process to the need for more efficiency in these areas. The start of this is the rationalisation of controls to those that are genuinely critical to the business, thus reducing the overall inventory of controls to be tested.

A specific example of the need for better and more complete exception management is in the regulatory and governance requirement to identify, analyse and drive out waste, inefficiency, error and fraud in key business processes, especially where cash or valuable commodities are being managed. Whether in the purchasing cycle, financial accounting processes, sales process or inventory, identifying the ‘needles in the haystack’ drives out significant savings and process simplification for business operations.

Many organizations believe their controls are in good shape until an adverse audit finding. These can have a dramatic effect on priorities in an organization as rapid action must be taken to secure permanent resolution to issues found by external or internal audit. When these issues arise, especially in systemic failures (which are usually related to the application support for key processes, such as Finance) the human effort to address them can be enormous and require lengthy activities.

The high profile fraud settlements for major organizations around the world are a testament to the fact that regulation and stakeholder acceptance of fraud and corrupt practices has become non-existent. As with the general compliance issue, sample based approaches to testing for fraud or corrupt practices is no longer sufficient. In addition to policies, education programmes, ‘whistleblower’ mechanisms and self certification, complete, consistent and continuous automated testing of relevant financial controls, as well as payments and inventory information, is now critical.

The examples above for streamlining collaborative business processes typically require the use of a platform or set of middleware components that deal with document management and versioning, workflow, approvals, web access, email notifications and sometimes the ease of use offered by Wikis, Blogs and other social media or Web 2.0 technologies.

With the enormous quantity of business transactions across multiple business units, often served by common shared service processes, organizations have a major challenge to establish where the processes are breaking down or where the process ‘guard-rails’ are being circumvented. Whilst configurable application controls help, and business intelligence tools can assist in broad trending and analysis, there is a major need to identify the specific exceptions to business policies, operating models, controls and Key Performance Indicators (KPIs). Exception based analysis, reporting and alerting is a key mechanism to address this issue when dealing with complex, distributed organizations and high transaction and data volumes.

An urgent need for GRC technology often arises out of specific audit findings (see above) and the subsequent realization that the cost and timescales of manual approaches are untenable. There are many dimensions to the GRC landscape from executive dashboards, risk registers, controls documentation repositories, audit checklists, specific applications for standardized, repeatable processes such as financial closing or Health & Safety, through to the continuous monitoring of controls and risk indicators at the business application level and lower level IT infrastructure monitoring and intrusion prevention.

There are major challenges in improving, streamlining and better controlling the professional work processes in organisations that cannot be automated with transactional systems. These processes require analysis, decisions, approvals, judgement, teamwork and visibility of the work product throughout the cycle as well as auditability after the fact. In these processes time is typically lost due to lack of visibility of the latest work contribution delivered by colleagues, the challenge of email as a priority communication mechanism and the lack of controlled development of key documents and other work products.

Whilst transformation of key business processes, especially in the finance area, is a highly leveraged model to standardize and simplify business processes for cost optimization with centralized services, it is typically a ‘Big Bang’ multi-year project for major companies. These major projects typically involve major organizational, process and IT change.

Thanks to the respected industry analysts Gartner Group and recent reports including “Magic Quadrant for Continuous Controls Monitoring” by French Caldwell, Paul E. Proctor, dated March 23, 2010, a generally accepted definition of CCM is emerging.