Login
iscover
Businesses could be doing more to ensure their policies, procedures and systems keep up with regulatory standards amid seismic transformation and digitisation, new research shows.
Newsletter
Internal controls lag in the face of transformation: KPMG
11 August 2021
•
11 minute read
You’re out of free articles for this month
To continue reading the rest of this article, please log in.
Create free account to get unlimited news articles and more!
A new poll conducted by KPMG that surveyed nearly 300 respondents from across 100 organisations — financial risk managers, accountants, internal auditors and compliance managers among them — found that nearly half had yet to automate internal controls.
Rowena Craze, KPMG’s partner in charge of governance, risk and controls advisory services, said the trend urgently needs to change.
“While some companies have already advanced to a system of artificial intelligence-enabled controls, many others urgently need to start the automation process,” Ms Craze said.
“We would advise these organisations to start by identifying where the current pain points are experienced by the business.
“Especially those that are manually labour intensive — such as collating data from multiple sources and manual reconciliations — or known control points of failure. These are potential target areas where businesses can start to assess the feasibility of automating controls.”
Beyond automation, the poll also found that internal controls continue to go undocumented, and were in some cases unclear.
==
==
More than a third of respondents described their internal controls as either basic or rudimentary, while more than two-thirds said it wasn’t clear who was responsible for their organisation’s controls standards.
Meanwhile, 85 per cent of respondents said their organisation’s internal controls were only partly documented, if at all.
Ms Craze said that even though controls transformation has attracted mounting debate, not enough has been done to usher in actionable change.
“This needs to change because if organisations are, for example, embarking on major ERP implementations or undergoing structural transformation, then internal controls need to develop in line with that business change,” Ms Craze said.
“The COVID era has also put more pressure on operating models and controls — some processes are harder to carry out virtually.”
KPMG found that organisations are often reluctant to transform their controls because of the cost — a risk of false economy. The firm suggests that the costs of control often focus on direct costs, such as execution or annual testing.
But recent modelling conducted by KPMG estimates that those costs land between $2,000 and $3,000 per control, each time it’s carried out. The modelling also factors in hidden costs, like management review costs, correction of error or remediation of control failures, and fraud risk.
Ms Craze said these costs offer enough of a case alone for control standardisation, digitisation and automation.
“One of the recommendations in the recent report from the Joint Parliamentary Inquiry into the Regulation of Auditing in Australia was that companies should be required to establish and maintain an internal controls framework for financial reporting,” Ms Craze said.
“Under this proposal — which some have described as a ‘Sarbanes-Oxley Lite’ system for corporate Australia — management would have to evaluate and report annually on the effectiveness of that framework, and external auditors would then report on management’s assessment.
“Whether or not this proposal is taken forward, it seems clear there will be more focus on controls, and our survey suggests there is much to be done in this area.”
You are not authorised to post comments.
Comments will undergo moderation before they get published.