Financial controls – how transparent is your control landscape?
In the last few months there have a been a number of well-known companies that have unfortunately hit the headlines for the wrong reasons – Carillion, Toys-R-Us, New Look, and more recently House of Fraser. As outsiders looking in, it’s easy to pass comment on how these companies managed to get to the position of being on the brink of collapse or indeed entering administration.
Mismanagement, Brexit and online rivals are all probable reasons that spring to mind, but how long were the warning signs there and how hard fought were the attempts to rescue the companies? Given the number of employees involved, every attempt would have been made to save the companies and livelihood of all those involved.
Early warning signs
What we can speculate is how early would the warning signs have been visible? And what financial controls were in place to detect these?
As we all know, financial controls by definition are used to manage a business to achieve a desired return on investment. They are the processes, policies and procedures that are implemented to manage finances. The key to a successful financial controls regime is accountability, responsibility and automation.
Why then do many organisations continue to use and rely on spreadsheets as a means of control? Financial statements produced on spreadsheets, operating metrics produced on spreadsheets, reconciliations and reporting produced on spreadsheets. How is this sustainable to support businesses that are vulnerable or on the flip side, businesses that are growing? In whatever direction you look, data requirements are becoming more complex and require increased granularity and that in itself means that alternatives need to be found to replace the continued use and reliance on spreadsheets.
If you ask those in senior finance positions in the city what their pain points are for a financial controls function, their lists will typically include the following:
- Scalability – as a business grows how do you keep control of costs and maximise economies of scale? Luckily we do appear to be in an economic upturn and revenues are going in the right direction, but if the answer is to increase headcount to solve financial control issues, the strategy definitely needs to be re-evaluated.
- Risk assessment – the routine oversight on the daily stream of financial data is often too onerous. Indicators are either absent, out of date or overlooked when it comes to managing financial wellbeing. While KPIs should be a leading factor in assessing the corporate risk appetite, this is not always the case.
- MI production – board reports, audit committee reports, remuneration committees, risk committees – the list of consumers of financial data and MI is voluminous. It is not tenable to have teams continually producing spreadsheet analytics, trend analysis and power point decks to furnish these meetings, and more troubling if such reports are being relied upon to make operational and strategic decisions.
- Cost of capital – prudent capital provisioning driven by regulation has been required now for quite some time, but following the financial crisis, organisations need to have a very focussed understanding of their capital. Organisations look to optimise their capital provision so as not to over commit reserve capital, as the cost of tying up money is just too high.
If you couple these pain points with over reliance on spreadsheets, you are heading for a perfect storm.
Over-reliance on spreadsheets
There is no doubt that spreadsheets are somewhat flexible and certainly a well understood tool, which is presumably why they are used to plug the gaps when core systems are not well connected. However, regulators and auditors are becoming less tolerant of spreadsheets, and there are four very good reasons as to why this is the case:
- Auditability – every data interaction should be date and time stamped against a user profile, which is very hard to do on a spreadsheet. The ability to go back to a point in time is a necessity – again challenging in particular if there are macros embedded in spreadsheets.
- Automation – spreadsheets are wide open to manual intervention and user error. Macros can help to execute actions, but are typically poorly controlled and are only understood by the writer of the macro – in other words macros are key man dependent.
- Volume – spreadsheets have volume limitations and do not perform well as volumes grow. Key financial controls on workbooks that have thousands of rows and multiple columns with complex, poorly understood macros are not sustainable, maintainable or readily auditable. They will break at some point.
- Version control – despite the reliance on share point and other shared drives, spreadsheets are prone to suffer versioning and multi-access issues. Couple that with spreadsheets being poorly backed up and existing on local hard drives, then again, the susceptibility to the lack of control is magnified.
Control versus process
It’s an obvious statement, but completing a spreadsheet is not a control – it is a process. Consideration has to be given to the internal controls that exist for the sourcing of data, validation of data, the governance of the process being undertaken, including remediation of exceptions through to final review and approval. All of these steps do not go hand in hand with the use of spreadsheets. What is required is a financial controls framework that provides the necessary transparency to evidence that controls are being adhered to, that they are being executed and that the controls are mitigating risk.
Embrace tech or get left behind?
RegTech, FinTech, automation, digitisation and technology – there has been a plethora of headlines so far in 2018 about embracing technology and being able to control the increased complexity and granularity of data required both operationally and from a regulatory perspective.
Looking at the implementation of technology projects, many of these are now in the cloud and all require detailed knowledge of the business. Information technology expertise tends to be bought in, with the real thought and influence over the project resting with senior finance executives.
Selecting systems that will deliver the desired financial control, and performing as the accountable executive for implementations are not typically topics that are taught when studying for professional exams. These are skills that have to be acquired over years of experience, and naturally some are more comfortable than others in this environment. Couple that with senior finance professionals having to be masters of their own data, and it is all too clear as to why spreadsheets cannot provide the high quality data with look through and drill down capabilities to be able to attest that operations are being conducted without unreasonable risks.
The end of the spreadsheet
The spreadsheet has served its purpose well over the years, but can it cope with the sheer volume of data that companies have to deal with or handle the intelligence that can be derived from this information? As the world continues to be more interconnected than ever, a spreadsheet with the capacity for a few million rows simply cannot compete. Some companies will continue to rely on their existing processes but as we have seen with the fallen giants of 2018, for others the writing may already be on the wall.