Addressing common challenges in the record-to-report process. kpmg.com

Transcription

1 Addressing common challenges in the record-to-report process kpmg.com

2 Addressing common challenges in the record-to-report process Laeeq Ahmed, managing director, KPMG Meilani Hendrawidjaja, director, KPMG Karen King, director, KPMG Bradly Straw, director, KPMG

3 Addressing common challenges in the record-to-report process 1 Executive summary Ever-expanding financial reporting and industry-specific regulations add additional complexity and burden to the close and reporting process. A list of regulations such as Sarbanes- Oxley (2002), Basel II (2004), Basel III (2013), carbon footprint reporting under the Clean Air Act (2011), and many others require organizations to disclose additional and even more complex information in a timely manner. These regulations are prompting organizations to try and reduce the time and effort over all of their reporting requirements, and at the same time provide more reliable and accurate information. For financial reporting, significant attention is focused on core processing such as transaction capture and month-end close. Numerous disparate systems and significant reliance on spreadsheets containing financial data are one of the many root causes. Ultimately, this has led to limited awareness and alignment of overall organizational strategy. Standard, out-of-the-box enterprise resource planning (ERP) systems have robust functionality to support business requirements, including financial reporting in virtually every organization and industry. ERPs are very good at the common business processes and the associated process controls. Quite often, however, these standard ERP features do not natively address all of the fine-grained controls or configurable capabilities required by organizations. These organizations typically require additional approaches, including custom development or manual compensating controls to address these requirements. Internal and external audit teams also require additional hours to confirm these controls and evaluate exceptions. Custom development on the ERP is typically a last resort by many organizations. Customizations tend to be very dependent on the implemented version of the ERP at the time. Maintenance on those customizations is typically required anytime a patch or upgrade affects the customized features. Annual maintenance of extensions and customizations is usually estimated at 20 percent of the cost of those enhancements. This estimate means that an organization buys the customization back every five years. For this reason, organizations try to implement using out-ofthe-box capabilities of the ERP as much as possible. When additional features and controls are required to address the organization s process, risk, and control requirements, management is quite often very interested if other out-of-thebox capabilities can address those requirements. Governance, risk, and compliance (GRC) technologies, such as Oracle advanced controls (OAC) have many features to address those additional process and control requirements not available in native ERP features. This paper discusses how governance GRC technologies enable organizations to overcome common ERP process challenges. GRC technologies also provide additional controls and automation for risk and compliance requirements. GRC reporting tools provide organizations, along with their internal and external audit functions, audit-ready reporting, and analysis capabilities to streamline tasks and reduce the cost of controls. By addressing common ERP process challenges and also risk and compliance requirements, GRC technologies enable organizations to support a coordinated and holistic controlled and compliant environment within the financial closing and reporting processes. GRC technologies support a holistic approach of addressing common ERP business process challenges and compliance activities by addressing issues in three dimensions: strategic, tactical, and operational. Strategic Supports enterprise requirements by providing executive monitoring capabilities in the form of dashboards and macro level analysis Tactical Supports management control by providing a centralized method of documenting business processes, policies, control objectives, and risks. Control assessments and remediation management is automated through workflows and approvals. Reports provide status and other information on risk and compliance management Operational Supports transaction level activities in the ERP by providing capabilities in the areas of: Access controls Periodic attestation and certification of system privileges Configuration management Embedded process enhancement and other preventive controls Exception reporting and trend analysis over sensitive transactions Audit-ready reporting and analytics.

4 2 Addressing common challenges in the record-to-report process KPMG s research On an annual basis, KPMG LLP (KPMG) conducts a formal, online survey of over 200 companies focusing on their close and reporting processes. KPMG gathers this information so that the firm can assist financial executives in better understanding current leading practices. Our research found that 43 percent of survey respondents indicated that they require at least 11 days completing the monthly financial close. Almost one in five respondents require 15 days or more to close. Close to half of the survey respondents are striving to focus on shortening the close time to less than seven days. Several barriers inhibit organizations from achieving that objective: Identifying and correcting root causes of issues (53 percent) Providing adequate time for analysis (52 percent) Correcting data integrity issues from source systems (37 percent) Researching and correcting issues prior to finalizing financial data for reporting is a common theme for these top survey responses. Exploring this theme even further, the survey identified several common process issues related to this theme that inhibit efficient close and reporting activities. These issues include: Data posting errors Allocation setup errors GL reconciliation process Consolidation GL maintenance Business challenges Data posting errors: Data posting errors can be the result of a number of factors including: Errors from feeder systems: Transactions posting from feeder systems might not post to the appropriate accounts, or significant transaction data points might be missing after the interface has processed. These errors can be the result of an inaccurate or incomplete setup of the feeder system process. Management would be required to research and resolve these errors before the closing process would be complete. Part of the challenge in resolving posting issues from feeder systems is helping ensure compliance with corporate policy. The resolution of posting issues might require updating the original transaction in the source system instead of making the adjustments directly in the target system. Additional time would be required to help ensure those transactions are updated according to policy prior to resubmission. Posting transactions to prior closed periods: Prior period posting of transactions can be problematic. Over the course of the period, previously unrecorded transactions might be identified and need to be entered in the period they were incurred. Period management tends to be a very manual process with limited visibility. Allocation setup errors The process of setting up general ledger allocation journal entries and running them should be a controlled process much like code development. Accounting activity requiring allocating journal entries should be well researched and planned. The use of ERP native or additional advanced controls cannot take the place of the research needed to create allocations. Good processes, augmented with native ERP and advanced controls, support accurate and well-controlled accounting. Allocation formulas should be documented, well tested, and approved through user acceptance. The schedule by which those allocations are generated should also be documented and tested. This testing will help ensure that dependent data from preceding transactions is captured and subsequent and dependent transactions are created and posted accurately. Once approved, the allocation formulas and the associated schedules should be restricted from further update. General ledger reconciliation process General ledger reconciliation can be a difficult and time consuming process. Quite often, clear ownership and responsibility for accounts has not been established. This lack of ownership can lead to unauthorized journal entries being posted to sensitive accounts making the GL reconciliation process long and difficult. When the organization makes use of suspense accounting, reconciliation issues can even be further exacerbated. Financial services organizations, in particular, make frequent use of suspense accounting. Depending on the accounting system, some suspense accounts are controlled by the system directly, whereas other accounts can accept manual journal entries. These suspense accounts can be misused if good ownership and oversight are not in place. Knowing critical suspense accounts in use and the volume of transactions affecting these accounts helps management prioritize and plan its reconciliation for an efficient close process. General ledger consolidation The consolidation process can produce unexpected results during financial reporting. The consolidation activities might highlight some unusual activity once the preliminary financial statements are generated. Possible causes of these issues could include data errors during the consolidation process, inadequate drill- down capability for detail analysis, or even adjusting entries were either unauthorized, not justified, or inaccurate. General ledger master data maintenance Organizations face challenges with general ledger master data errors and complexity due to limited data standards and incomplete understanding of master data change impacts. These challenges are further complicated by the lack of segregation between master data maintenance and daily transaction processing, allowing users to add/modify GL segment values when entering the transactions without considering the impacts to other areas of record-to-report process (e.g., FSG account range, consolidation mapping, and reconciliation effort).

5 Addressing common challenges in the record-to-report process 3 Native features with the Oracle ERPs Oracle Enterprise Resource Planning (ERP) packages have standard features that address many fundamental requirements in the record-to-report process. Native ERP features serve as the foundation for accurate financial reporting. Without these core features, organizations would not be able to rely on the information reported out of these systems. The following table identifies common ERP features relating to the record-to-report process: Native ERP feature Description Potential control challenge Data exchange Oracle ERPs support the concept of data exchanges. Additional bolt on systems including third-party hosted systems can be integrated into Oracle ERPs. The ability to integrate with these other systems requires data to be passed back and forth without error. Interface tables and application programming interfaces (APIs) are designed to help ensure that data integrity is maintained. Data integrity focuses on helping ensure that required data is present and in the correct format. Data integrity might be intact but the transaction still might be coded incorrectly or have financial mistakes. Company policy might require that problems with transactions imported from bolt-on or third-party systems be corrected back in those other systems. The process of issue resolution is a company policy decision that isn t always natively supported in the ERP. Period management The ability to post transactions to a prior closed period is typically inherently controlled by Oracle ERPs. Native ERP features typically restrict the ability to post to a prior closed period unless that period is in an open status. When prior period transactions are required after financial statements issuance, many eyes of the organization should be on these transactions for proper restatement. When period management is not well controlled, then published financial statements are at greater risk of inaccuracy. How transparent is the process for reopening a previously closed period? Is every reopening of a prior period cause for scrutiny or only under certain circumstances such as a period in a quarter where the associated statements have already been filed? Cost allocation Standard features within Oracle ERPs support the ability to allocate cost over multiple accounts automatically with a single transaction. Cost can typically be spread over multiple accounts evenly, by predetermined percentages, or even by complex formulas. When those allocations have been tested and are ready for use, management relies on their change control process to initiate and test updates. The accuracy of those allocations is only as good as the organization s change control process for those ERP configurations. How are changes to allocations identified to confirm the existence of proper change control procedures?

6 4 Addressing common challenges in the record-to-report process Native ERP feature Description Potential control challenge Suspense accounting Common ERP features, including Oracle ERPs, support the ability to use suspense accounts. Suspense accounts provide flexibility to an organization when the initial accounting treatment of transactions is difficult. An organization s control risk increases if suspense accounts are not managed effectively. For example, in retail banking, the debits and credits of automated teller machine (ATM) transactions, including associated fees, are quite often posted at different times. These types of transactions require suspense accounts to balance the entry. While providing flexibility for the business, suspense accounts introduce additional accounting complexity into the organization. How often are suspense accounts reconciled? Are they always reconciled completely? Are suspense accounts being used to temporarily obfuscate transactions? Are there any trends regarding the use of suspense accounts? (E.g., Leveraged by the same individual(s) Leveraged at certain times of the month) Chart of accounts mapping A standard feature in Oracle ERPs is the ability to map and consolidate accounts. Subledger accounts are mapped and consolidated to the general ledger. For financial reporting, an additional level of mapping and consolidation is supported by these ERPs. Quite often, organizations leverage a dedicated reporting ledger system such as Oracle Hyperion Financial Management (HFM). HFM has its own account mapping to consolidate the ERP system of record to consolidated financial statement accounts. Maintaining these account mappings within the various applications is a manual activity that is critical to accurately reporting the transactions that occur within the organization. Who s responsible for maintenance versus who can actually maintain account mapping? Were changes made to these mapping tables outside of the approved change control process and what were those changes? Chart of accounts validation Regardless of the terminology used, Oracle ERPs support the concept of validating the account combinations contained within journal entries before posting them to the general ledger. These validations are critical to help ensure that transactions reflect valid accounting activity within the organization. An organization that doesn t produce an item in a particular business unit should not have accounting activity for that item in that business unit. What updates have been made to these validation rules? Who is aware of these changes? Were those changes approved and documented as part of an approved maintenance process?

7 Addressing common challenges in the record-to-report process 5 Augmenting the standard capabilities within Oracle ERPs for record-to-report Oracle ERPs go a long way in providing fundamental capabilities and controls to support accurate financial reporting. Many times, however, management s processes for effectively leveraging these ERP capabilities fall short in realizing the additional value of their ERP investment as they originally planned. In trying to enhance an organization s ERP investment, management quite often looks toward application customization or manual workarounds to achieve these goals. One common gap found between native ERP capabilities and management s process requirements and expectations is the maintenance of master data and other configurations. While robust control and approval capabilities are natural to numerous types of transactions, these oversight controls are not always present for master data and configuration maintenance. ERPs do offer auditing capabilities to support these activities, but the auditing usually has to be built. Additionally, notifications of setup activities or certain transaction scenarios typically require customizations in the ERP to be implemented. Management quite often resorts to manual workarounds and additional monitoring activities to provide the needed control. Manual workarounds, however, are less likely to be consistently applied and require additional effort by management. Customizations can be very dependent on application versions and might require extensive IT investment to implement. A better approach to reduce both customizations and manual workarounds is to leverage out-of-the-box features of Oracle Advanced Controls (OAC). Oracle advanced controls Oracle advanced controls are well positioned to bridge the gap between standard ERP capabilities and some of management s fine-grained requirements and process assumptions. Transparency is a key concept in meeting management s expectations from their ERP investment. Transparency in the ERP is critical to support informed decisions. Additionally, the ability to distill, summarize, and highlight out-of-policy conditions, whether those conditions relate to logical access, change control, or policy compliance, provides management the extra value they require to conduct business in an well-controlled but efficient environment. How Oracle advanced controls can help Addressing common issues Data posting errors Scenario 1: The organization might have several feeder systems that import journals into the general ledger. In one system, management might need an additional review approval on those entries after they ve been imported and before they ve been posted. Management relies on ERP configurations to help ensure that those feeder entries are not auto-posted and require approval; however, management might not have good control over who can change journal sources and the posting features inside the ERP. OAC can augment standard ERP features as indicated below. OAC example reducing data posting errors from feeder systems Oracle advanced controls Typical ERP feature Access Configuration Preventive Transactional Operational reporting to indicate failed interface Reconciliation reports Subledger configurations impacting journals such as freeze and autopost Identify who has access to the interface screens or forms that manage the interfaces. Identify changes to journal source configurations and who made those changes. Alert process owner when changes to JE sources are made. Prevent the selection of certain subledger JEs for reversal processing. Create an incident for remediation when a journal from a particular source has specific attributes.

8 6 Addressing common challenges in the record-to-report process Scenario 2: A not uncommon situation in an ERP is having multiple accounting periods open both prior and future periods. Typically, more people than expected have access to manage accounting periods as well. Management needs visibility into how periods are managed and if periods OAC example of reducing data posting errors relating to proper period transactions Oracle advanced controls prior to financial statement filing have been reopened. The following features provided by OAC can further strengthen management s control over close and reporting specifically around accounting period management. Typical ERP feature Access Configuration Preventive Transactional Alert when prior period is opened Identify who has access to reopen accounting periods. Identify who has access to turn off ERP notifications. Identify what periods were reopened and by whom. Identify when ERP notification configurations were changed and send a notification. Require approvals to reopen a period if that period is beyond a certain time frame (such as an estimated time after quarter close and financials are disclosed) Create an incident for remediation when a prior period goes into Open status. Allocation setup errors Scenario 3: The organization has many allocation journals that are processed by its accounting system. Those allocation formulas are designed, tested, then they are approved for use. This particular organization has weak change and access controls over this accounting system feature. The organization subsequently has challenges relying on allocation-related journal entries and has to perform additional manual review to help ensure accuracy and completeness. Using OAC, the organization can better rely on the quality of those transactions by strengthening the reliability of the controls associated with maintaining allocation formulas and schedules. OAC example of reducing allocation setup errors by strengthening change and monitoring controls Oracle advanced controls Typical ERP feature Access Configuration Preventive Transactional Allocation formulas configuration in ERP Identify who has access to create/ modify allocation formula Segregate access between the users who can create/modify allocation formula versus manual journal entries Track changes to the allocation formulas Prevent the usage of certain accounts in the allocation formulas Provide report of allocation journals that have a debit or credit on any journal line that is over certain amounts GL reconciliation process Scenario 4: The organization, a financial institution, uses many suspense accounts in certain processes across its various systems. Suspense accounts are not used in all processes. Keeping existing suspense accounts reconciled is very important for accurate financial reporting. Where suspense OAC example of providing greater control over suspense accounts Oracle advanced controls Typical ERP feature Access Configuration Preventive Transactional accounts are not used, the associated business processes are not designed to manage those types of accounts. The unauthorized introduction and use of suspense accounts could pose significant challenges in closing and reporting in a timely manner. OAC can help control the use of suspense accounts and ultimately the reconciliation process. Configuration to enable/ disable suspense account Account transaction listing Identify who has access to create or post journals. Identify who has the ability to change suspense accounting parameters and accounts. Identify who has changed suspense accounting parameters. Identify what those new suspense accounting parameters are. On the journal entry form, enforce additional fields to allow for accurate journal classification (e.g. description fields both in header and each line) Identify who has been posting transactions to suspense accounts. Create real-time alert when there are journal entries posting to the suspense account. This alert will allow management awareness to clear the account throughout the month. Perform a trend analysis on the frequency of suspense account postings, when, amounts, and by whom. Create reports to highlight certain fraud/common errors for manual JEs so this can be investigated further (e.g., manual journals within a certain time/to certain accounts/with certain amounts).

9 Addressing common challenges in the record-to-report process 7 Scenario 5: The organization relies heavily on reporting controls, including consolidation and roll-up definitions to provide consistent financial reporting. Additionally, the organization has a history of increased and unusual activity close to the time of reporting. Management has to spend additional time identifying and then researching anomalies when they are able to find them. OAC can help strengthen the reliability of the consolidation and rollup configurations and also help management identify anomalies that are difficult to identify and resolve. OAC example of helping improve the consolidation process Oracle advanced controls Typical ERP feature Access Configuration Preventive Transactional FSG (financial system generator) report definition Consolidation mapping Identify who has access to create/modify consolidation mapping and FSG definition Segregate access between the users who can create/ modify consolidation definition versus perform journal entries. Monitor the changes to FSG and consolidation definition configurations. Control changes to the standard Oracle reports (i.e., concurrent program definition) to help ensure the integrity of the report for consolidation (e.g., trial balance). Control access on the FSG report definition to disable regular users from modifying the default column set and row set definition for the report Create exception reports to assist with the data validation (e.g., identify data anomalies) prior to submission to consolidation. Oracle advanced controls can help deliver the extra value promised by large, robust accounting systems. Even if the organization might not experience common challenges like those previously mentioned, Oracle advanced controls can still provide additional value to the organization by strengthening the organization s documented controls. Oracle advanced controls can provide additional assurance over system-based controls and even provide system controls to replace manual controls currently in place. Strengthening documented controls Oracle advanced controls can address common challenges in various processes within the ERP. Oracle advanced controls can also strengthen the organization s documented controls by providing additional visibility and enhancements over existing ERP features. Process Control objective Risk Control activity OAC solution Transaction posting to subledger Transactions are recorded completely and timely in the correct general ledger accounts Access to subledger system is inappropriate resulting in unauthorized changes to financial statements Subledger system access is reviewed by business unit management on a quarterly basis Use access controls to identify who has access to certain key subledger activities and use this information for quarterly access certification. Allocation setup Indirect cost allocations are performed completely and accurately. Allocations are incomplete and inaccurate. Changes to allocation rates are initiated by SG&A and are approved by corporate level management Use configuration controls to identify the change history over allocation configurations. Process manual journal entries Journal entries are recorded completely and accurately Accounting entries are not properly approved JEs are created by an authorized accountant. Manual journals should be reviewed and approved by peer or higher of person preparing the JEs. Approval should be received prior to posting the entry and evidenced by a dated signature or electronic form. Use configuration controls to track changes to the journal approvalrelated configurations (e.g., approval flags, approval limits, journal source attributes, posting programs) Use transaction controls to flag for manual journals made to sensitive accounts.

10 8 Addressing common challenges in the record-to-report process When to implement Oracle advanced controls Good internal control and process enhancement allows management to focus on the exceptional activities and transactions within the organization. Many times organizations implement or upgrade their accounting systems to enable better controls and realize increased process optimization. Even when no major system project is planned, management continues to ask more out of its systems to improve business practice. Advanced controls can be introduced into the organization during the following major activities: Introduction during a major systems implementation: During major systems projects, advanced controls should be embedded throughout the project from inception to operations. Advanced controls support compliant security design during acceptance testing through go-live. Advanced controls also help the organization manage its change control process from build to post-go-live operations. When enhancement requirements are identified, the project team should determine if advanced controls can provide the approach before evaluating customizations. Introduction during a systems upgrade: Quite often the organization views a significant upgrade as merely a technical exercise. Even though the upgraded applications typically provide new features and capabilities that management requires, these new features also tend to expose additional and unexpected control risk that should be addressed. Advanced controls can be used to identify where these new control challenges exist and also provide out-ofthe-box solutions to these challenges. Introduction during systems operations: Enhancing process efficiency and control effectiveness doesn t have to wait on major system changes. Efficient processes and effective control is an ongoing management activity. Access compliance, transparent change management, system maintenance, and transactional compliance testing are ongoing projects within most organizations. Oracle advanced controls applications can be introduced in part or in total to support the organization s needs. Self-assessment If you answer yes to any of these questions, you might be a good candidate for leveraging Oracle advanced controls in your business: Do you lack visibility into or monitoring of your key financial processes? Are your processes heavily manual and/or spreadsheet intensive? Do your team members have disparate and nonstandardized processes and functions? Are you focused too much on transactions with less emphasis on analytics? Are you relying too heavily on manual controls? Are you losing valuable time during close waiting on responses or document requests? Are you having issue with managing cross-validation rules, key or descriptive flexfields? A KPMG controls roadmap engagement, using the voice of key stakeholders, can help organizations build their business case for implementing advanced controls. KPMG has industry, technology, and advanced controls specialists that can help the organization clarify and quantify the pain points described in the self assessment. KPMG s resources can also help the organization uncover previously unidentified pain points within the organization that can also be used to build that business case. Summary ERPs provide organizations with robust capabilities to efficiently and effectively conduct their business. ERPs generally do not meet every business requirement for every business process without some sort of manual work around or customization. Oracle advanced controls can provide out-of-the-box approaches for many of the gaps remaining after the ERP has been implemented. If you are using an ERP or considering implementing one, have you considered the following? How can I leverage the most of my IT investment around financial reporting with less customizations? How can I address the nice-to-have requirements under my existing budget? How can I maintain a robust yet transparent control environment with my ERP investment?

11 Addressing common challenges in the record-to-report process 9

12 kpmg.com 2014 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. Printed in the U.S.A. The KPMG name, logo and cutting through complexity are registered trademarks or trademarks of KPMG International. NDPPS Not permissible for KPMG audit clients and their affiliates.