CFO. Improving the Bottom Line with Advanced Controls CONTENTS

Transcription

1 CFO Improving the Bottom Line with Advanced Controls CONTENTS EXECUTIVE SUMMARY 1 THE PROBLEM ILLUSTRATED 2 SOLUTIONS 4 PROCESS RISKS AND CONTROLS 6 CASE STUDY 9 SELF ASSESSMENT 12 WHAT DOES THE FUTURE HOLD? 13 CONCLUSION 13

2 EXECUTIVE SUMMARY Issues that contribute to cash leakage, such as duplicate vendor payments or transactions that contravene company policy, can seem insignificant individually. But mounting evidence shows that collectively these problems can have a dramatic and material effect on an organization s bottom line. This white paper examines how advanced controls can substantially improve the bottom line, the scope of the issues addressed by advanced controls, and the reasons why leading companies and experts who monitor cash leakage are increasingly looking to advanced control solutions. Cash leakage, also known as financial leakage, is the unnecessary outflows of money due to business process errors, fraud or inefficiencies. Advanced controls continuously monitor Enterprise Resource Planning (ERP) configurations and transactions to identify and resolve cash leakage and similar problems, such as cash flow issues, working capital issues and fraud. Advanced controls address three main categories of process transaction problems: Issues with a definite impact on the bottom line, such as duplicate vendor payments Issues with a potential effect on the bottom line, such as split purchase orders Issues with cash flow impacts on the bottom line, such incorrect vendor payment terms The Accounts Payable Network a 50,000-member organization that establishes best practices for accounts payable (AP) technologies and controls recommends the use of advanced controls to provide continuous monitoring as a layer over ERP controls, especially for companies with automated systems. The organization makes detailed recommendations in its report, Safeguarding Disbursements: A Technology-Enabled Approach to Overpayment Detection and Prevention. The benefits of advanced controls have been demonstrated by the bestin-class companies that are typically the first to adopt new technologies and establish best practices. Organizations that have made the most progress in shifting away from manual controls are adopting advanced control solutions and showing what a difference those controls make, says Rob Rogers, editorial vice president at Financial Operations Networks, parent organization of the Accounts Payable Network. There is a transformation that is in process, or an evolution, if you will, in accounts payable processing and order to cash, Rogers says. The benefits of advanced controls have been demonstrated by the best-in-class companies that are typically the first to adopt new technologies and establish 1

3 best practices. Those companies have shown the considerable return on investment for process automation. While all organizations can benefit from advanced controls, companies with high transaction volumes or high-value transactions stand to gain the most. Advanced controls replace manual controls and continuously monitor configurations and transactions, so most issues are immediately detected and resolved. Advanced control solutions also offer strategic insights into emerging internal trends to better manage operational risks. This paper provides examples that highlight not only the bottom line benefits of advanced controls, but also the strategic benefits for organizations. THE PROBLEM ILLUSTRATED Advanced controls address issues that affect the bottom line of an organization across virtually all business processes. A recent study of the AP function by PRGX Global Inc. illustrates the nature and extent of the problems that are addressed by advanced controls. PRGX, which has conducted audits for over 40 years to recover funds lost through cash leakage, analyzed 376 of its AP recovery audits over a fiveyear period. Although PRGX conducts global audits for organizations in all industries, this study focused on five specific industries. CASH LEAKAGE BY INDUSTRY Although the study found that organizations in all industries lost significant sums due to AP errors, five specific industries stood out because of the scale of the average loss: Industry Average Recovered Funds per AP Audit* Airline $450,000 Automotive manufacturing $1,500,000 High tech $650,000 Manufacturing (non-auto) $1,200,000 Transportation $500,000 *85 percent of the recoveries were from audits that covered a one-year period The study had three main takeaways, said Joe Collins, director of thought leadership at PRGX and author of the study: 2

4 Profit leakage is not specific to one type of industry or error type. Companies that don t use recovery audits are losing out on recovered cash. By understanding and quantifying past errors, companies can use insights from recovery audits to implement stronger controls. Recovery audits don t eliminate the need for advanced controls, nor do advanced controls eliminate the need for recovery audits. Advanced controls and recovery audits work well together. Recovery audits identify and quantify the amount of profit leakage you have and advanced controls enable your team to proactively detect more errors, Collins said. Recovery audits don t eliminate the need for advanced controls, nor do advanced controls eliminate the need for recovery audits. Besides demonstrating the immediate return-on-investment (ROI) benefits of recovery audits, the PRGX study defined the top AP problems identified in the audits. Three AP errors were shared on the Top 5 list for each industry tracked by the PRGX study: overpayments, duplicate invoice payments and paper-related duplicate payments in an electronic process. These and the other problems can be significantly reduced by using advanced controls. TOP 5 AP ERRORS BY INDUSTRY Error Airline Auto Manufacturing Industry High Tech Manufacturing Transportation Overpayment Duplicate invoice payment Duplicate payment paper related Credit memo error Process breakdown ERS receiving error ERS-related Sales tax rate Sales tax taxability Re-bill LEGEND Overpayment Duplicate invoice payment Duplicate payment paper related Credit memo error Process breakdown ERS receiving error ERS-related Sales tax rate Sales tax taxability Re-bill Overpayment unrelated to duplicate payments Payment made more than once for same invoice Duplicate payment from paper invoice in an electronic process Error with credit memo quantity or price, or other error Error related to lapse in documented processes Error caused by process breakdown at dock location Error related to evaluated receipt settlement payment Tax figured and paid on incorrect rate Tax paid for untaxed item Error related to inconsistent vendor corrective action 3

5 SOLUTIONS Organizations seeking solutions to improve their bottom line have three approaches: recovery audits, ERP controls and advanced control solutions. Used separately, each of the solutions has many advantages and taken together they provide great synergies. RECOVERY AUDITS Recovery audits review company AP transaction histories, using data mining and other techniques to identify overpayments and other problems that impact the bottom line. When specific transactions are identified, the recovery audit firm works to collect the money lost from cash leakage. One key benefit of recovery audits is that money recovered is typically from previous accounting periods. From a cash flow perspective, this can be considered found money that can be applied straight to the bottom line. Recovery audits can provide insights into cash leakage risk areas and the materiality of related errors; organizations can use this information to strategically implement advanced controls. Advanced controls automate the detection process and detect errors early enough to avoid erroneous transactions that result in cash leakage. ERP CONTROLS ERP controls are essential to the ERP systems of organizations. Among the many benefits to your business processes, ERP controls provide key controls such as purchase order approvals and three-way supplier invoice matching. By combining ERP controls with advanced controls, organizations can focus on running their operations instead of devoting substantial resources assessing whether there are significant process control issues. Another benefit is they are embedded in your ERP systems and thus function seamlessly with your business processes. To help reduce operational risk, it is important for organizations to take advantage of these ERP controls where appropriate. With more scrutiny on the bottom line, the increased complexity of business processes and a larger volume of transactions, organizations are learning that they need another tier of controls to complement or augment their ERP controls. By combining ERP controls with advanced controls, organizations can focus on running their operations instead of devoting substantial resources assessing whether there are significant process control issues. 4

6 ADVANCED CONTROLS Advanced controls augment ERP standard controls by providing an added tier of controls: they monitor ERP controls, they detect configuration changes, and they review 100% of transactions. Advanced controls automate most of the remaining manual controls. This last mile of manual controls tends to be the ones that cause the most pain to an organization, in terms of cash leakage. And advanced controls provide distinct advantages over manual controls: they provide 100 percent coverage instead of relying on audit testing, they provide timely feedback about exceptions, they utilize sophisticated rules to detect challenging issues, and they efficiently track and resolve identified issues. Advanced controls can identify and prevent problems that have a direct, significant and easily measured impact on a company s bottom line. Some examples include: For the PTP process, advanced controls ensure the integrity of vendor master records and monitor for duplicate invoices. For the OTC process, advanced controls improve credit memos processing to minimize the extent of customer account write-offs. For expenses management, advanced controls can detect when employees obscure their buying and expensing of items not authorized by company policies. While the direct, easily measured effects of advanced controls are easy to tabulate for an ROI calculation, advanced controls also produce improvements to the bottom line that are harder to measure the ROI frosting on the cake. While the direct, easily measured effects of advanced controls are easy to tabulate for an ROI calculation, advanced controls also produce improvements to the bottom line that are harder to measure the ROI frosting on the cake. Examples of these less obvious impacts include identifying split purchase orders, and identifying unreasonable customer payment terms that can lead to excessive account write-offs. Advanced controls also identify issues related to cash flow that affects the bottom line, such as incorrect vendor payment terms that result in unnecessarily early payments. In addition to helping improve the bottom line, advanced controls improve the effectiveness of processes and reduce operational risk. For example, advanced controls reduce the incidence and impact of errors by identifying them through increased coverage, find errors sooner and even prevent 5

7 When you bring in advanced controls, you can get all of those things done, and not have things slip through the cracks because of the reality of the crush of incoming transactions. them in some cases. Advanced controls also allow process controls to be quickly adapted as requirements evolve, but without having to change the underlying processes. Another advantage of using advanced controls is that they allow companies to focus their efforts on more value-added activities, such as reviewing and analyzing items that can be overlooked when trying to apply manual controls to large volumes of transactions, says Rob Rogers of the Financial Operations Network. Whether it s your vendor master file review and cleanup and check; your approval levels your invoice data; statement authorization; card reconciliations; your bank reconciliations; or bypasses in your system, he said. All of these are things that should be looked at, in some way. And frankly, the sheer volume can be overwhelming. When you bring in advanced controls, you can get all of those things done, and not have things slip through the cracks because of the reality of the crush of incoming transactions. Simply stated, advanced controls allow for much more effective and comprehensive coverage than manual controls ever could, and at a fraction of the cost. PROCESS RISKS AND CONTROLS When an organization considers business problems that affect its bottom line, those problems generally fall into three categories: Definite impacts: activities that always affect the bottom line Potential impacts: activities that may affect the bottom line Cash flow impacts: activities that may affect the bottom line due to less-than-optimal cash flow The following tables provide process risks, bottom line impacts and solutions for the PTP and OTC processes for the three categories. These two processes were chosen because they are particularly vulnerable to cash leakage. 6

8 DEFINITE IMPACTS TO THE BOTTOM LINE In this category, for the PTP process, the bottom line is typically affected either because expenses or costs of goods sold (COGS) are increased. For the OTC process, the bottom line is typically affected because revenue is decreased. PROCURE TO PAY Process Risk Bottom Line Impact ERP or Manual Control Advanced Controls Solution Invalid entry of supplier invoices Untimely payments to suppliers Inappropriate purchase transactions Single supplier invoice entered and paid multiple times Lose out on opportunity to take early payment discounts Payment for goods or services that lack a valid business purpose Prevent same invoice number from being entered for the same supplier Run payment processes based upon terms and/ or specify to always take discounts on supplier records Perform manual review of business application security Detect invoices with similar invoice numbers and similar invoice amounts for the same supplier Notify when supplier invoices with discount terms are coming due and that the payment process needs to be run Alert management about users with incompatible duties; for example, who can maintain supplier master records and enter purchase orders ORDER TO CASH Process Risk Bottom Line Impact ERP or Manual Control Advanced Controls Solution Incorrect pricing Invoices are created and recorded for a lower amount Require approval for invoice pricing changes Compare invoices to historical averages and alert management when materially different from threshold Incorrect credit memos Credit memos for higher pricing than invoice pricing; Credit memos for higher quantity than actually returned by customer Utilize automated ERP functions to compare credit memos to sales documents Alert management when policies and procedures are not followed by users Inappropriate access to write off accounts Credit memo issued but goods not returned or valid services already rendered Require account writeoff approvals if above a threshold Require additional approvals based on specified conditions; for example, require additional approval if account has recent history of write-off s 7

9 POTENTIAL IMPACTS TO THE BOTTOM LINE In this category, for the PTP process, the bottom line is typically affected either because expenses or COGS are increased. For the OTC process, the bottom line is typically affected because bad debt expenses are increased or revenue is decreased. PROCURE TO PAY Process Risk Bottom Line Impact ERP or Manual Control Advanced Controls Solution Split purchase orders (POs) to work around approval thresholds Excessive purchase of goods or services Purchase orders (POs) over a certain threshold require approvals Identify all POs that are within a rolling window (seven days, for example) from the same user and for the same supplier, then sum the group of POs and compare total to approval thresholds Unapproved suppliers, goods, and services Pay more than would have been paid using approved suppliers Have purchasing contracts in place and review maverick off contract spend Provide real time review of unique, noncompliant POs; for example, check if supplier has a contract, require additional approval if no supplier contract ORDER TO CASH Process Risk Bottom Line Impact ERP or Manual Control Advanced Controls Solution Inappropriate terms assigned to customer Excessive account writeoffs Only certain people are able to create new terms; define policies regarding terms Provide management with insight between customer account write-offs and corresponding extended terms Unreasonable sales discounts Excessive sales discounts are provided reducing revenue Enforce approvals on sales discounts given Define rules that compare sales discounts to historical averages and obtain exception approval for unusual sales discounts 8

10 CASH FLOW IMPACTS TO THE BOTTOM LINE For both the PTP and OTC processes, the bottom line is typically affected because interest expenses are increased or interest income is reduced due to lost opportunities. PROCURE TO PAY Process Risk Bottom Line Impact ERP or Manual Control Advanced Controls Solution Inappropriate access to change payment terms Invoices paid sooner than necessary per policy Require approval for changes to payment terms Define rules to review changes to payment terms and report to management when changes are made ORDER TO CASH Process Risk Bottom Line Impact ERP or Manual Control Advanced Controls Solution Incorrect credit memos Credit memo errors cause customer payment delays Review reports and follow up on credit memos not created timely Develop rules that will prevent incorrect entry of customer credit memos CASE STUDY A health services organization that recently considered advanced control solutions provides an illustration of a return-on-investment (ROI) calculation. The organization, with more than 1 million customers, examined the potential bottom-line affect of advanced controls in a detailed study late in Based in part on the ROI analysis, the company formed a plan to implement advanced controls during its ERP upgrade project and began implementation in the first quarter of In 2012, the organization was interested in increasing its focus on controlling administrative costs, in part because of healthcare reform. At the same time, it faced increased risks because of its growth through acquisitions and geographic expansion, and it was planning an ERP upgrade in

11 The organization was overly dependent on manual controls, which were inefficient and exposed the company to fraud and spending leakage. The organization faced several problems. The organization was overly dependent on manual controls, which were inefficient and exposed the company to fraud and spending leakage. The company had 40 to 60 users spending four to six weeks per year on testing, and it could take as long as three years between testing cycles for duplicate invoices. It was also difficult for the company s users to track changes to key setups and values, such as chart of accounts, Social Security numbers and other master data. The company lacked automated detection, remediation and prevention of segregation of duty (SOD) violations. And its IT staff had to spend too much of its time tracking patches and upgrades. The opportunity for benefits from implementing advanced controls was calculated in four quantifiable areas: Reduced fraud, waste and abuse Redirected external auditing fees Redirected internal auditing effort Decreased IT effort during routine upgrades The ROI analysis established baseline figures for each area and calculated improvements based on data from the company and industry averages, including figures from the Perspectives in Health Information Management journal and studies from Gartner, Forrester, Foley & Lardner, Financial Executives International and Compliance Week. The analysis concluded that advanced controls would drive benefits in three main categories for the company: Continuous monitoring of key financial controls that direct efforts to recover or prevent fraudulent transactions Reduced exposure to access security risks for fraud, waste and abuse Improved business processes and reduced effort spent on manual controls The analysis calculated a range for the possible financial benefit outcomes in each of the four quantifiable areas, with a conservative estimate, a mostlikely estimate and an optimistic estimate. The analysis showed, under the most-likely estimate, that the company would reach the break-even point by using Advanced Controls after 26 months. And after five years, the most-likely estimate showed a total net benefit of $2.4 million, using a Net Present Value calculation, which translates to a 259 percent ROI. 10

12 CASE STUDY: FIVE-YEAR QUANTIFIABLE COST AND BENEFIT OUTCOMES Item Conservative Most-likely Optimistic Recurring benefits $ 2,062,331 $ 3,130,656 $ 4,800,537 One-time benefits $ 146,484 $ 195,300 $ 244,141 Ownership costs $ (925,599) $ (925,599) $ (925,599) Net financial benefits $ 1,283,216 $ 2,400,357 $ 4,119,079 Return on Investment (ROI) 139% 259% 445% Break-even point (months) SELF ASSESSMENT If your organization is considering whether it could benefit from advanced control solutions, it makes sense to perform your own ROI analysis. But even before the analysis, answering some basic questions can help with the decision-making process. Ask yourself: How significantly is the bottom line affected by cash leakage at your organization? Does your company have the risk indicators that point to a need for advanced control solutions? The following self-assessment provides a thought-provoking guide to whether your organization might benefit from advanced control solutions. 11

13 WOULD MY ORGANIZATION BENEFIT FROM ADVANCED CONTROL SOLUTIONS? # Question Yes or No 1 Has your organization had any recent, significant ERP system changes such as a major upgrade, chart of accounts redesign or changes in ERP vendors? 2 Does your organization have multiple ERP systems? 3 Is your organization considering or planning any initiatives to streamline processes across multiple ERP systems, and/or to provide consistent metrics across ERP systems? 4 Has your organization had any recent, major process changes (e.g., integrated purchasing and payables activities, integrated human capital management and payroll activities)? 5 Do any of your organization s sub-processes have a significant percentage of manual transactions or activities? For example, are a large percent of vendor invoices entered manually? 6 Is your organization considering or planning any initiatives to improve process efficiency and effectiveness through such activities as further automation? 7 Has your organization encountered business process errors that require significant time to investigate and resolve the errors? 8 Has your organization either encountered fraud or suspected fraud related to your business processes? 9 Has your organization s auditors identified any opportunities to make significant improvements to your business processes? 10 Has your organization recently moved toward a shared-services model or moved away from a shared-services model? 11 Is your organization considering or planning any initiatives to improve cash flow or to improve working capital? 12 Is your organization considering or planning any type of upgrade to your ERP system (i.e., technical, functional, new modules, transformation)? Count the number of yes answers, then assess your organization as follows : Extremely high benefit to your organization from using advanced control solutions 8-10: Very high benefit to your organization from using advanced control solutions 5-7: High benefit to your organization from using advanced control solutions 3-4: Medium benefit to your organization from using advanced control solutions 0-2: Low benefit to your organization from using advanced control solutions Bonus Question: If you answered yes to question #12, your organization is a prime candidate for advanced control solutions. 12

14 WHAT DOES THE FUTURE HOLD? Industry experts predict that advanced control solutions will provide companies with several new capabilities in the future, as the solutions are developed further and become more sophisticated. One feature being considered is incorporating closed-loop recovery audits into the solutions, so advanced controls will not only detect incorrect payments but also provide a single, enterprise repository and related workflows to manage and track recovery projects. Future advanced control applications will likely use high-end analytics, such as big data techniques to evaluate large transaction system data sets for anomalies and suspicious correlations and machine learning concepts to create controls that learn from the data. Another area where advanced controls of the future are expected to have an impact is by integrating their automated risk monitors with enterprise risk management. Under this concept, exceptions to advanced controls would be linked to documented risks as part of the risk assessment process. In the future, advanced controls could provide digital assessments of risk to enhance an organization s annual risk assessments with more data-driven approaches. The controls could also enable external audit functions to go far beyond their traditional random sampling approaches by providing near-complete data coverage. And advanced controls of the future will probably be capable of digesting multiple types of heterogeneous data sources, increasing the accuracy of the controls in finding exceptions. CONCLUSION Process transaction issues from errors, fraud and inefficiencies cause cash leakage and similar problems. These problems can have a dramatic and material impact on the bottom line. The definite, direct impacts include duplicate vendor invoices for the PTP process, and incorrect credit memos for the OTC process. Problems with a less direct but also significant impact include split purchase orders for the PTP process and unreasonable payment terms under the OTC process. 13

15 Advanced control solutions identify these issues both those that have the direct, measurable effects on the bottom line, and the problems with a less direct impact. Advanced controls alert management to these issues, remediate the problems and close the issues after they are resolved. They provide continuous monitoring, and they provide flexible solutions that can quickly adapt as process requirements evolve. Advanced controls are not limited by the transaction volume of an organization they monitor every transaction, whether the volume is 100 or 100 million. The solution provides bottom-line benefits to all companies, and particularly those with high volumes of transactions or high value amounts per transaction. Beyond the bottom line, advanced controls also allow companies to evolve their finance functions to provide strategic insight into emerging internal trends to better manage operational risks. Recovery audits also help with cash leakage issues, identifying overpayments and related AP issues and collecting those overpayments on behalf of the client. ROI for a recovery audit is relatively simple to calculate, and leading recovery audit firms conduct audits that are paid on a contingency basis. Advanced control solutions and recovery audits are both recommended as best practices, and adopted by best-in-class organizations. As organizations consider whether to adopt advanced control solutions, they should consider their individual circumstances and whether they ve encountered the issues outlined in this white paper. They should also study the potential ROI, and weigh the experience of best-in-class companies and industry leaders that have adopted advanced controls. Improving the Bottom Line with Advanced Controls is published by CFO Publishing LLC, 51 Sleeper Street, Boston, MA August 2013 Copyright 2013 CFO Publishing LLC. All rights reserved. 14