Command over controls

Following a series of mergers and acquisitions, this consumer goods major needed to realign its global internal controls environment to its changed risk profile. It faced a number of challenges, including:

• A fragmented and manual control framework that focused only on SOX compliance and didn’t address end-to-end risks effectively
• Inefficient SOX testing, with many different providers testing the same controls
• A decentralized internal controls organization that duplicated the effort between control monitoring and management, which increased the cost of control monitoring
• Poor awareness of internal controls and ownership from control owners

The firm saw a greater opportunity here. By taking a broader initiative in finance, it could resolve its fragmented internal controls environment. It could also get an integrated, standardized controls framework that improved risk coverage and reduced compliance costs. That called for a new operating model, with process automation for better governance and transparency.

Genpact worked with the company to develop a customized roadmap for the solution design and migration methodology. The aim was to gradually consolidate key F&A functions into a single shared service, and create a template for future consolidation. To make the center operational, we established it in a building where we were already running operations for several global clients, which ensured that we would develop an even closer partnership. Our knowledge of the local market and talent also helped us to quickly recruit the people we needed to run the center.

Genpact designed, transformed, and ran a GCH to strengthen compliance and reduce overall costs. A center of excellence (CoE) applied Genpact’s Lean DigitalSM methodology to get the most out of the solution. Lean DigitalSM focuses on end-users’ needs with design thinking, digital technologies, and Lean principles underpinned by domain expertise. This unique approach means clients can respond to changes in business requirements through incremental and iterative sprints and feedback loops.

Genpact and the client established the GCH in just eight months. The project involved:

• Designing a comprehensive, integrated controls framework covering financial, operational, and compliance risks. The framework provided a common risk and control language for global operations
• Redesigning the roles and responsibilities of the global internal controls group, both in local markets and in the CoE
• Redesigning the SOX program, by optimizing the control framework to include risk-based global scoping, standardized test scripts, remote testing of controls, and better documentation
• Migrating SOX testing to the GCH
• Designing and implementing digital control monitoring solutions, such as controls self-assessment (CSA) and continuous controls monitoring (CCM)
• Setting up dashboards for near-real-time visibility across all work streams, which enabled stronger governance
• Creating and implementing change management initiatives, including internal controls team training around the world, for faster adoption of the new controls framework

The integrated controls framework, controls self-assessment, and continuous controls monitoring solutions were among over 150 unique design deliverables that Genpact’s 20-member design team and 50 end users co-developed. The solution helped the company exceed SOX compliance and provide better coverage of all financial, operational, and compliance risks (see Figure 1).

We applied digital tools and analytics to incorporate surveys and remediation tracking. With well-defined key performance indicators and service level agreements, the management team also had real-time visibility into the impact of its GCH activities.

We made sure stakeholders were fully engaged in the design of the CoE. It was critical have buy-in from relevant leadership and operational teams during this transformation because of the sensitive nature of risk management. Our change management initiatives introduced the concept and sought support from stakeholders. The goal was to make the GCH’s impact transparent and to ensure that it aligned with corporate objectives. We organized training sessions on new processes and technologies so that everyone, including the company’s outsourcing partners, understood management’s vision.

The GCH helped the client build robust internal controls so business teams could identify risks and act to resolve them in real time. Here’s what else the company got in this initial phase:

• Vastly improved control management. The firm can now track key control issues globally and resolve root causes quickly because internal controls, internal audit, and business process excellence teams are collaborating more effectively
• Increased ownership of controls by process owners through the CSA program, and real-time identification of control gaps and fraud indicators through CCM
• Less audit fatigue among control owners since we integrated internal controls and internal audits
• Dynamic dashboards and metrics improve governance of — and transparency into — the controls environment
• A big cut in external audit costs because auditors trust CoE work
• A jump from 15% to 42% in controls automation with possible further improvement
• Rationalized testing of SOX controls by 18%, with another 27% expected in the following year; overall rationalization of 45% expected
• Up to 50% reduction in costs. The GCH has 35 full-time and peak load members who have helped the client reap benefits through cost arbitrage and greater productivity