Is your control environment costing too much? Find the balance between cost and risk to improve control efficiency

Of special interest to Chief finance officer

5Insights for executives

“I feel constrained,” the CFO of a global consumer products company explained. “My control environment is overcontrolled. It’s costing me money and it’s so darned complex that it makes any adjustments to changes in the competitive landscape slow and cumbersome. As part of the significant investment we are making in SAP, there has to be an untapped opportunity to automate and radically simplify the control environment. I want to explore that.”

Our consumer products CFO is one of many global executives questioning the effectiveness of their company’s internal controls. Increased reporting requirements, first under regulations such as the Sarbanes-Oxley Act (SOX) and now under the Dodd-Frank Act in the US and IASB regulations in Europe, have forced internal controls functions to do much more. In the wake of the global recession, these functions are being asked do it with less. Regulators globally are demanding greater accountability, while investors and shareholders are seeking improved performance.

2 | 5 Insights for executives

What’s the issue?In response to increasing stakeholder pressures, leading organizations are driving new efficiencies in their management and financial reporting operations to lower expenses and gain competitive advantage — all in an effort to increase shareholder value.

In the early SOX and regulatory compliance days, organizations were more focused on compliance. Risk was an afterthought. Today, organizations understand the value derived from building control and reporting systems that address compliance and risk needs.

Major investments in enterprise resource planning (ERP) and operating model infrastructure have failed to deliver agility and speed in ERP compliance and reporting. Organizations still struggle to create optimal control environments that balance cost with risk. Many fail to take advantage of the opportunity to create an effective and cost-efficient risk and controls environment — even when the potential cost savings would surpass the cost of control. The result is an inability to increase shareholder value.

Why now?The typical control and compliance environment reflects layer upon layer of controls created to meet the needs of multiple stakeholders. It is complex, inflexible and expensive. Leading organizations demand agility and efficiency to support rather than hinder their growth aspirations.

Organizations have typically made adjustments and adopted certain tactics to improve performance. However, in some cases these adjustments have created new challenges that impact the risk landscape and the controls that are needed. These include:

• Mergers, acquisitions and divestitures that have not fully been integrated from a management reporting and operations perspective

• Financial operations that have been excluded from cost-savings efforts because the cost reductions could not be quantified and therefore the impact of such efforts could not be measured

• Organizations that have existing ERP systems have not fully leveraged them to respond to the new risk landscape

• Fundamental organizational changes such as off-shoring or shared services or changes in personnel that have introduced inefficiencies or weaknesses in the effectiveness of existing controls

• Misstatements in financial reporting that have arisen from an inadequate control environment

• IT systems — especially if disparate or de-centralized — that have not been successfully assessed for new business risks, or that have not implemented appropriate controls when adapting to organizational changes

• SOX controls rationalization that has met with limited success.

35 Insights for executives |

How does it affect you?Our experience shows that when most organizations undergo significant change, the realignment of internal controls either lags behind or fails to align completely. Over time, this can lead to:

• Duplication of internal controls, overcontrolled or under-controlled areas

• Material impact on other business processes

• Outdated, inefficient practices

• Underutilization of application controls

• Inconsistent practices across the enterprise

• Time-consuming assurance audits and long financial close cycles

As well, CFOs face competing pressures:1. Keep the company safe by ensuring that its controls environment is

robust and meets the expanding requirements of stakeholders. 2. Stimulate growth, particularly in developing markets, by being more

agile and cost-effective.

However, overly cumbersome business processes are not delivering the agility that organizations require in the changing business climate.

Audit committee

Riskcommittee

Other committees

Other committees

Duplication of risk and control activity

Board/senior management oversightAudit

committeeRisk

committeeOther

committees

Internalaudit

Riskmanagement Compliance Internal

controlInformationtechnology

Legal andregulatory

Externalaudit

4 | 5 Insights for executives

What’s the fix?Implementing a single, overarching controls strategy — one that is designed specifically to be more effective for your current business state and future strategies — can re-shape the control environment so that it is flexible, more supportive and more cost-effective.

During the discovery phase, the use of diagnostic tools can flush out the key areas of focus and the opportunities for improvement. For many organizations, three opportunities typically arise:

1. Reducing the cost of controls and eliminating duplication using a zero-based controls approachIndustry-leading organizations have looked beyond their internal control structure as a compliance effort and instead looked at controls through a different lens.

Leading organizations are now looking at their ERP systems to determine how to reduce duplication and its resulting costs, extend the value and get a better return on their investment. They do this by automating and leveraging controls that will help the organization achieve strategic competitive advantage. Controls that hinder the organization’s ability to be nimble and to adjust to changes in the competitive landscape will lock finance resources and costs into non-value-adding activities.

By ensuring a positive return on investment, these organizations have been able to reallocate resources that were used for compliance purposes to forward-looking competitive purposes instead — thereby increasing shareholder value.

2. Speeding up the financial close processSignificant reductions in the financial close timeline have also been achieved when leading organizations look at and address the gaps and barriers in the current management and financial reporting processes and their critical path(s).

By removing the barriers that impede controls and processes, senior management can achieve greater control efficiencies that could, for example, reduce the record to report cycle by two weeks.

3. Reducing the costs associated with the external audit by looking through the audit lensOrganizations that have undertaken a controls transformation to improve not only their controls, but also the processes that the controls support, have experienced reduced efforts by external audit. In turn, these companies have realized an overall sustained cost savings.

The automation of controls can also reduce duplication and align the right controls to support the risk appetite, enabling external auditors to significantly reduce the level of control testing by testing only the right controls!

Move to efficient control mechanisms

Lowest cost of control Highest cost of control

Automated controlsSeg. of duties, standard and routine

SOX/ SEC OCA

Internal audit - in-country

Corporate audit

External audit

55 Insights for executives |

What’s the bottom line?By improving your processes and controls, your organization can achieve:

• Fewer controls, lower costs, and a single controls framework, thus enhancing shareholder value

• Better aligned risk coverage, including the identification of stronger, more pervasive controls

• The identification and standardization of efficient and effective controls

• A more effective and efficient risk-based assessment process

• Better use of technology to prevent control issues and give assurance over the control environment

• A more efficient and sustained compliance process

• Improved alignment between the IT, business and Internal Audit functions

As regulators’ demands for increased accountability continue to rise and calls from investors and shareholders for improved performance grow louder, now is the time to make your control environment as efficient and effective as possible.

6 | 5 Insights for executives

Want to learn more?

For related thought leadership, visit www.ey.com

The answers in this issue are supplied by:

Robert F. Cullen IIIAmericas Advisory Internal Controls LeaderErnst & Young LLP+1 612 343 1000robert.cullen@ey.com

75 Insights for executives |

We want to hear from you!Please let us know if there are subjects you would like 5: insights for executives to cover.

You can contact us at: fiveseries.team@ey.com

EY | Assurance | Tax | Transactions | Advisory

About EYEY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.

Ernst & Young LLP is a client-serving member firm of Ernst & Young Global Limited operating in the US.

About EY’s Advisory Services Improving business performance while managing risk is an increasingly complex business challenge. Whether your focus is on broad business transformation or more specifically on achieving growth, optimizing or protecting your business having the right advisors on your side can make all the difference. Our 30,000 advisory professionals form one of the broadest global advisory networks of any professional organization, delivering seasoned multidisciplinary teams that work with our clients to deliver a powerful and exceptional client service. We use proven, integrated methodologies to help you solve your most challenging business problems, deliver a strong performance in complex market conditions and build sustainable stakeholder confidence for the longer term. We understand that you need services that are adapted to your industry issues, so we bring our broad sector experience and deep subject matter knowledge to bear in a proactive and objective way. Above all, we are committed to measuring the gains and identifying where your strategy and change initiatives are delivering the value your business needs.

© 2013 Ernst & Young LLP. All Rights Reserved.

SCORE No. BT0339ED None

This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice.

ey.com/5