GRC Tuesdays: Can Internal Control be the Key to Longevity?

[T_Frenehard]

Back in the 1920s the average longevity of companies in the S&P 500 index was 67 years, compared to just 15 years in 2012, according to Professor Richard Foster from Yale.
There’s much to bet that this has reduced even more since then.

The question is then: how can you ensure that your company is here for the long run?

Internal Control Journey - From Pure Compliance to Delivering Performance

 

In most companies, internal control is still addressed in much the same way as it was many years ago, using the same business structures and approach. Shouldn’t this change to focus more on performance?

Yes, I understand that there have never been so many regulations, and considering the increase in these last few years, I assume this isn’t going to slow down any time soon. But I think companies need to be proactive rather than reactive in order to stay on top of things.

Picture this. You’re already doing internal control, so why not leverage all these controls that are assessed manually or automatically, and shape them with a more performance-orientated intent?

Easier Said Than Done, Right?

 

Actually, I believe that progressing step by step can make this journey a lot easier than you would think. Of course a big revamp will make this happen quicker, but the cost and resources required to do so might be too much in these economically challenged times.

My suggestion, therefore, is the following. During the regular internal process review, whenever creating or updating a control, try to associate it to an objective - not a control objective - a corporate objective.
Ask yourself, what company value does this control relate to: deliver constant quality of service, release reliable financial communication to stakeholders, etc.

This is the first step but not the most complex, and it’s a great step on this journey.

Once this step is achieved then comes the prioritization phase.
Select the corporate objectives that give you a competitive edge and collect all their associated controls. You will know precisely what controls can help you achieve your corporate objectives and what controls have a more regulatory focus.

The great thing now is that you can follow your performance using controls that are regularly assessed. Like key risk indicators these can feed you information on how well each department is doing, even allowing for a benchmark across divisions.

This means that you can investigate when one area is not performing as planned, and you can also focus your attention – or ask internal audit to do it – on the high performing organizational units. These indeed might have implemented processes that are more efficient and you might want to consider applying them to the rest of the group!

Combining a sound internal control process and linking it to strategy means that you’re not only ensuring that your current processes are running as designed but that you are sustainable in the short/medium term. Also, these processes are supporting your overall strategy and laying the path to a long term viability.

So, is this the key to longevity? Unfortunately, I don’t have the answer, but to me protecting the value drivers of the company seems like a good starting point.

Does such an approach resonate with you? I look forward to reading your thoughts and comments either on this blog or on Twitter @TFrenehard

Originally published on the SAP Analytics Blog