GRC Journal - (Page 19) Governance, Risk & Compliance controls, half (52 percent) had only been able to reduce them by 20 percent or less. Commentaries on the topic included the concept of a top-down approach which focuses more on entity controls and less on process control documentation. To reduce the number of key controls, 42 percent of respondents indicated that they needed more clarity about where specifically they should focus. An additional 41 percent claimed that they need more time and resources to be effective in key control reduction. Compliance automation is coming of age as automated controls are seen as the key to greater sustainability. Financial reporting systems often involve too many manual steps and rely on inherently uncontrollable systems such as spreadsheets. Organizations need secure data environments to reduce control risks in the consolidation and reporting process. Now that compliance processes are more defined, it should pave the way for technology-based automation to be implemented in areas such as reporting, change management, documentation management, and information security solutions. Figure 2 illustrates what respondents are doing about automated controls. Two-thirds have taken some sort of steps towards automation. In a separate question, 55 percent of respondents indicated that coordination between IT and business resources was the greatest success factor for automating their controls. Enterprise Risk Management (ERM): According to respondents, two-thirds of boards or senior management teams have inquired about ERM in their companies. While this figure is somewhat anecdotal, it does point towards a growing movement to manage companies with a more formal risk assessment and mitigation strategy in place. I have observed that ERM is like personal fitness and dieting; everyone says they’re going to do it, few actually do it, and still fewer do it very well. Results of the poll seem to support this theory. Prior to defining what a valid ERM program is, 50 percent indicated that they had an ERM program in place. Once the definition was clarified by Kinman, the number dropped to 40 percent. Further, as Figure 3 illustrates, 95 percent of respondents suggest that their ERM program needs some, or substantial work to be effective. Part of the challenge appears to be related to the type of department that should run the program. Forty-two percent of companies have a dedicated risk manager, however 12 percent of ERM programs are run by the treasury department, 7 percent by the insurance department, 7 percent by controllers, and a third of companies indicated it was run by other roles. This is supported by the FIGURE 1: How far along is your company in moving from a project mind-set to a sustainable SOX program? 76% - 100% 22% 51% - 75% 26% 25% - 50% 34% 0% - 25% 18% 0% 5% 10% 15% 20% 25% 30% 35% 40% FIGURE 2: What is your company doing about automated controls? We haven’t taken any steps We have told control owners to automate when they can We have a specific plan or have started automating more key controls 0% 5% 10% 15% 20% 25% 30% 35% 32% 33% 35% 40% FIGURE 3: How would you describe your ERM program? At the right level 5% Needs some work 38% Needs substantial work 57% 0% 5% 15% 30% 45% 60% 75% 90% FIGURE 4: What are some major criteria you would use when purchasing compliance software? Flexibility to adapt to our organization Robust reporting capabilities User-friendly Tool must fit our methodology, not vice-versa Other 4% 4% 0% 10% 20% 30% BTQ 40% 35% 17% 40% 50% Q1 2007 | www.btquarterly.com Business Trends Quarterly 53 http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.