When facing a change, we tend to think just two greedy questions first:
1. What do I gain from it?
2. How do I succeed in changed situation?
Business controllers and process owners often feel they personally benefit from process control automation. With internal control development projects like access risk management, which tend to narrow down your system privileges you never even needed, response, could still be somewhat opposite. Non-negotiable compliance requirements are not always the best natural motivator.
Even automated, it is not enough to show automated controls are in place; have been scheduled and running in background, there has to be people taking care of the alerts automation results. Luckily people can interact with easy-to-use workflow steps. End users like local controllers are notified only when needed by a link to automated report in their own responsibility area. Workflow brings them with the flow to interact. Training effort and ability to adopt this is really low to convince audience: “I will succeed in changed situation!”
Big gain is time saving. Once reporting is exception based, running reports just for reporting can be forgotten. Idea is more action driven. This works vice versa – no alert, no issue. Naturally evidence is stored also for all successful data checks. Another time saving comes from efficiency: automated monitoring is providing pre-analysed control reports for which you previously spent days in worst case to get the information from different sources.
People get their thumb on top when managing what they need: business rules behind automated reports can be easily modified – no coding or configuration needed. So technology is not building hence between IT and business here.
Automated controls are not only harnessed for internal control compliance or audit requirements, moreover for pure business process reasons. If someone posts same vendor invoice twice, pricing causes an error in accounting interface, user approves own purchase order or saves master data fields incorrectly, this is picked-up next morning automatically and can be fixed. In other words: the time of being in error or risk situation is minimized.
Continuous monitoring detects exceptions out of millions of line items, when predefined business criteria are met. This brings new possibilities in detecting process risks on time. In cost & profitability management it enables to manage even small leaks or process discrepancies. This is widely praised among business controllers, who struggle with tens of different reports and data aggregates. One could easily regard this as their first Big Data project but in agile and adaptive approach! It is no longer sales PowerPoint with unknown reference.
Common challenge in process oriented organizations is how global process owner can win the authority and knowledge across countries and companies in matrix organization. Bringing set of automated process controls is one new item in process owners’ toolkit or global “offering”. With good set of centrally developed, but localized automated controls, global process owners can – as well as people from group internal controls – promote a kind of “I’m here to help you” – atmosphere when cooperating with local units. So the answer to: “What do I gain from process owner?”
Latest now the words “agile” and “adaptive” are easily accessible with SAP GRC 10.1 Process Controls. Well-designed process controls are supporting business and saving in compliance efforts. Once automated, you can’t live without them!