What factors make automated control testing tools attractive for Compliance Managers?
Image Credit: Ali Rizvi
Few days back I was enjoying dinner at an exotic restaurant with a breathtaking view. As I was munching into my juicy steak, I could not stop myself from overhearing conversation of a couple at the table next to mine. The lady was complaining to her companion about how much manual work she has to repeat time and again to test and document controls at her organization. Listening to her misery, I wondered why companies wouldn’t use automated tools for controls testing and documentation. I decided to reach out to some of my friends working in internal audit and compliance departments across various industries in Greater Toronto Area to get their thoughts. My sample included people from retail, financial, consumer foods, telecommunications, pharmaceutical and utilities industry groups. The first question I asked them was if in their opinion, is there sufficient payback to invest in automated tools for controls testing and I found the results to be very interesting. 100% of the people I spoke with were in favor of investing in automated tools for controls testing. Honestly, I was predicting more like a 40% to 60% response in favor of automated tools for controls testing. I was not stopping there; I wanted to know the reasons supporting their response, so I posed a couple of more questions to my subjects.
What makes automated controls testing tools attractive to Compliance Managers?
I asked my subjects to identify and rank reasons that would make an automated controls testing tool attractive for them and they ranked their rationale in the following order:
- Integration with existing Enterprise Resource Planning (ERP) software and audit testing tools already in use.
- Ability to meet regulatory, compliance and/or external audit requirements.
- Product features such as ability to identify, detect and remediate segregation of duties conflicts; proficiency in monitoring configuration controls violations and capabilities to prevent fraud and transactional processing errors
- Ease of use.
- Cost savings that the tool will bring with reduced need for manual testing.
- Reporting options like executive dashboard views and real-time reporting with sufficient details.
What factors keep automated controls testing tools away from Compliance Managers?
In response to my third question, my subjects ranked the factors that make an automated controls testing tool unsuitable for them in the following order of priority:
- Risk of having inaccurate reporting or inability to detect control failure, i.e. the tool does not report expected results or exceptions.
- Inadequate controls in the tools to ensure security and privacy of information.
- High cost of tool that may include cost of the product, implementation cost from vendor side and in-house and maintenance costs.
- Ability of the tool to share information before it has been finalized by the tester or the compliance team.
- Concerns over job security, due to the implementation of an automated tool and reduced need for manual testing.
In short, based on the responses I received from my subjects I can summarize that most of the compliance managers are interested in investing or have already invested in automated tools for controls testing. They choose integration of the automated controls testing tool with their existing ERP and/or audit tools along with product features as the top most criteria for making an automated tool attractive for compliance managers. Risk of having inaccurate reporting or detection of control failures is the top most factor that makes the use of automated tool unacceptable for compliance managers. However, what is more interesting to note here is that a number of individuals I spoke with do not have automated tools for controls testing implemented at their organization.
My interview results are leading me to assume that most of the organizations are keen to implement automated control testing tools and this could very well be their next project, but are we really seeing this happening? My personal view is that although the organizations see automated tools for controls testing as a value add option, it is still not on top of their list of priorities. I believe that the decision makers are yet to be sold not only on the cost benefit potential, but also on the risk mitigation capabilities of such a tool.
Disclaimer: The views expressed in this article are my own and does not reflect views and approach of any entity. This information is of general nature and is not intended to address specific circumstances. No one should act on this information without professional advice after examination of particular situations.
Author: Agha A. Ali