SHARED SERVICES An Enabler for Managing Risk Steve Tracy, Principal Consultant, ISG www.isg-one.com
INTRODUCTION During the last few years, companies have become increasingly focused on the need for effective risk management. While the recent economic crisis and several high-profile corporate failures have certainly intensified this interest, companies are also compelled by such factors as increased complexity, new technologies, globalization, and the rapid pace of change. Moreover, regulatory agencies around the world are actively engaged in developing and enacting regulatory requirements for improved risk management. Companies need proven solutions to better manage risk; one such solution is the implementation and leverage of shared services. While typically driven by other criteria, shared services can also help companies better manage risk. In this paper we will look at shared services as an enabler for improved risk management. SHARED SERVICES STEVE TRACY 1
RISK MANAGEMENT AND INTERNAL CONTROL Risk management requires identifying, detecting, assessing, prioritizing, and monitoring risks, as well as taking appropriate actions to control, mitigate, and address the impact of risks. At the heart of managing risk is internal control, defined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) as a process designed to provide reasonable assurance regarding the achievement of objectives in effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations. In other words, internal control reasonably assures that an organization can meet its objectives. Any improvement to internal control will help the organization to better manage risk, which improves the likelihood that the organization will achieve its objectives. Internal control consists of an integrated system of policies, procedures, and activities that are designed to: Reduce the risk of error Protect assets Assure the effective and efficient use of resources Ensure the reliability of financial reporting Comply with applicable laws and regulations A good system of internal control accomplishes these objectives and does so as efficiently as possible. By implementing shared services, an organization can improve its ability to achieve its internal control objectives while improving the efficiency of its internal control process. SHARED SERVICES Shared services is a key aspect of a company s services delivery model, involving the leverage of a service or group of services for the benefit of multiple organizational units in the company, with shared responsibility for the results. Traditionally thought of in a finance and accounting context, shared services today is also applied to a wide variety of other business functions, including human resources, information technology, procurement, supply chain, facilities, communications, and legal. Shared services can take a variety of forms: it can be regional or global, single or multi-functional, colocated or virtual, and onshore or offshore. Generally thought of as internal to the company served, shared services can include outsourcing, as well as the retained organization managing one or more outsourcing contracts. Shared services can incorporate a variety of delivery models, where the specific delivery model for any service is dependent on the nature of the activities included. The main delivery models are: Centers of Scale: These are standardized services processing high-volume, routine transactions. Examples include accounts payable, payroll, purchase order processing, and cash application. Centers of Expertise: These services leverage deep knowledge and specialized experience. Examples include treasury, risk management, external reporting, sourcing, benefits administration, and application development. Business Partners: These services require a high degree of communication and coordination, are decision-intensive, and require local/unique knowledge. Examples include internal financial reporting, profitability analysis, business analysis, and in-business human resources support. Through the levers of consolidation, standardization, process improvement, automation, and a new leadership model, shared services can defragment operations, eliminate duplication, streamline service delivery, improve service, leverage knowledge, and save money. SHARED SERVICES LEVERS AND IMPROVED INTERNAL CONTROL Now let s take a look at how shared services, through the levers introduced above, can improve an organization s system of internal control and, therefore, its ability to manage risk. CONSOLIDATION Frequently a key driver for the implementation of shared services, consolidation can yield a number of internal control benefits. By performing a process in a smaller number of physical locations, it is inherently easier to monitor and manage the process and reduce fraud. The consolidation of people into fewer locations contributes to improved knowledge sharing and simplifies the delivery of training, resulting in more timely, consistent, and effective training and improved competency of personnel. Finally, consolidation enables greater focus: on the in-scope processes in shared services and on the remaining processes outside of shared services. This improved focus facilitates improvements in the efficiency of process execution as well as process monitoring, testing, and auditing. SHARED SERVICES STEVE TRACY 2
Another key benefit of consolidation from an internal control perspective is the ability to better segregate duties, an important preventive control wherein tasks are divided among multiple employees in order to reduce the risk of error or fraud. Segregation of duties can be difficult to achieve in an environment in which a process is fragmented due to personnel constraints, but through consolidation a shared services organization is in a much better position to implement this control. STANDARDIZATION Almost any shared services initiative will include an effort to standardize processes, usually accompanied by documentation of those processes. In many cases, supporting technology will also be standardized either upon implementation or over time. Standardization contributes to both the effectiveness and efficiency of internal control by reducing the number of controls, improving the organization s awareness and understanding of the controls, reducing variation, and eliminating duplication. In addition, standardizing technology for example migrating to a common ERP system for shared services reduces the number of system setups, interfaces, security profiles, and manual workarounds, all of which streamline control design and testing. Standardization also facilitates implementation of higher-quality IT systems, leads to enhanced data quality, and reduces opportunity for error. PROCESS IMPROVEMENT In addition to standardizing processes, shared services improves processes through simplification and best practice sharing. Reducing complexity improves control by reducing the opportunity for error, reducing the number of required controls, and increasing the reliability of control execution. And by utilizing best practices, shared services can leverage the most effective and efficient controls across the entire organization rather than in just one part. AUTOMATION Shared services also leads to improved automation, in part due to the benefits of consolidation, standardization, and process improvement, and in part due to the better return on investment in technology driven by increased scope and scale. Automation in turn improves internal control by reducing the number of manual controls, which are more subject to inconsistent execution and error, and are more costly to audit and test. LEADERSHIP MODEL There are several internal control benefits that arise from the establishment of a new leadership model for the activities migrated to shared services. It is easier to build a culture of sound internal control for the processes in shared services due to leadership s process focus and ownership. Shared services leadership is in an excellent position to take a more integrated view of risk across the organization, foster knowledge sharing, and improve transparency. Leadership can also better-manage talent in a shared services model, improving competence, balancing workload, and reducing knowledge/skill gaps to reduce risk. With fewer management teams, audit and control testing costs are reduced. Finally, shared services can leverage its position to support improved business continuity planning for in-scope activities. CONSIDERATIONS Despite the considerable benefits in improving the management of risk offered by shared services, it is not a panacea. A shared services model is not easy to implement, and if done so poorly, it can not only fail to deliver the expected benefits, it can actually worsen internal control and increase risk exposure. Therefore, it is critical to also manage risk during implementation by taking the following actions: Craft a thorough implementation strategy and plan Consider risk throughout design and implementation Implement sound governance Ensure that responsibility and accountability for success are shared with the business units Properly managed, the implementation complexities can be overcome, and the promise of shared services can be realized. SHARED SERVICES STEVE TRACY 3
CONCLUSION With the heightened focus on improved risk management in recent years, it is vital for companies to take appropriate actions to improve internal control. Shared services, a well-established service delivery model that has been around since the 1980s, offers important capabilities to address this need. Done right, shared services can be an important tool companies can use to lessen their risk exposure. We have seen how the shared services levers of consolidation, standardization, process improvement, automation, and a new leadership model can also drive significant improvements in internal control. These improvements include a more robust control environment, better segregation of duties, strengthened knowledge/expertise, greater use of automated controls, better integration, reduction in the number of controls, and increase in the reliability of controls. In short, internal control is more efficient and effective. But shared services can be hard to implement. It is important to understand the implementation challenges and build the right practices into your implementation approach so you can realize these benefits. If you are looking for ways to better manage risk and haven t yet implemented shared services, give it some consideration. And if you have already started on the journey to shared services, take some time to evaluate whether you are maximizing its value for improved internal control. SHARED SERVICES STEVE TRACY 4
LOOKING FOR A STRATEGIC PARTNER? Your operational excellence is our business. CONTACT US Visit the AccessISG Sourcing Portal for more sourcing information, insight and tools. Click the envelope to contact us or go to http://info.isg-one.com/contactus. Information Services Group (ISG) (NASDAQ: III) is a leading technology insights, market intelligence and advisory services company, serving more than 500 clients around the world to help them achieve operational excellence. ISG supports private and public sector organizations to transform and optimize their operational environments through research, benchmarking, consulting and managed services, with a focus on information technology, business process transformation, program management services and enterprise resource planning. Clients look to ISG for unique insights and innovative solutions for leveraging technology, the deepest data source in the industry, and more than five decades of experience and global leadership in information and advisory services. Based in Stamford, Conn., the company has more than 850 employees and operates in 21 countries. For additional information, visit www.isg-one.com. 010313 Copyright 2013 Information Services Group All Rights Reserved