14-15 September 2016

Lisbon, Portugal

#DeloitteSharedServices

Deloitte Shared Services, GBS & BPO Conference

Breakout 9: Internal controls - Service Centres controls and impact of Robotic Process Automation (RPA)

Ani Sen Gupta, Deloitte

The journey

Build the business case 3

Design the controls centre 8

Implement and roll out 13

Values to the business 16

Current trends and optimisation 18

Closing thoughts 20

Build the business case

The first conversation and a hypothesis

We can reduce the cost of controls while improving the efficiency and effectiveness of the internal control environment

Rationalise the

cost of control

Bring a ‘customer

service’ mentalityMaximise the return

on investment made

in the ERP system

Embed controls – good

understanding, ownership

and ‘one way’ of

performing controls

Need to know our controls

status – but need one

version of truth

Understanding the reality was key to prove the hypothesis

There is a clear case to reduce cost and improve efficiency….but we need to look at the controls operating model

Lack of agility and

reactive environment

No transparency and

consistency, need for

value add reporting

Inadequate business

focus; non-alignment

with business objectives

Efficiency & Effectiveness

Significant cost of controls –

poor automation, focus on

monitoring controls rather than

preventive and automated

controls

Manual monitoring, poor

coverage and prolonged

remediation period

Lack of synchronisation with

management monitoring,

significant administration cost

and need for efficient reporting

Lack of reliance on management and

internal audit effort, significant

duplication and need for realignment

with risk based auditing

Controls activity based cost +

administrative costs + unusual loss

Cost of Controls

A hard look at the controls operating model

We need to improve the controls operating model…we need to have a strong controls centre

Customer: need internal customer specific strategy to serve faster, better and cheaper

Services: no customer focus, need realignment with business strategy and value

Technology: no automation, no use of smart tools

Processes: lack of standardised / structured procedures and methods

Locations: an inconsistent mix of centre, regional and local; created over the years based on immediate needs

Reporting: no consistency, need ‘one version’ of truth

People: Need for more capable and technically competent resources

Organisation: lack of segregation, missing focused effort

Channels: delivery and reporting mediums are not effective

The business case

This is a great opportunity to build a cost effective rock solid second line of defence

Controls Service CentreControls improvement agenda

People:

• Increased skills level

• Better customer focus

• Streamlined structure, reduction in overall FTEs

• Reduction in operating costs

Process:

• Standardised process

• Consistent, high quality reporting with one version of truth

• Agility to fit into changing business needs

Technology:

• Greater automation

• Enhanced use of data analytics for controls monitoring

• Consistent use of ERP platform

Design the controls centre

What are the key design principles?

We need to maximise value to the business

Keep it in-house, core function

Focus on financial controls

Leverage SAP, the existing ERP platform

Increase controls’ quality and reduce controls’ cost

Standardise controls operations and monitoring

Deploy at a global scale

Establish clear ownership and responsibilities with service level agreements

What services to include?

Focus on areas with highest return under the current set up

Controls monitoring

Certification services

Compliance and ethics

Controls, compliance and ethics reporting

Access controls

• User access

• Segregation of duties and super-user privileges

• Access controls related reporting

• Controls design assessment

• Operating effectiveness testing

• Data analytics support (monitoring unusual items)

• IT configuration controls monitoring

• Anti bribery corruption

• Third party due diligence

• Acquisition controls review

• Centralise certification support to markets and regions

• Manage exceptions and controls remediation

• Periodic controls reporting – markets, regions and centre

What capabilities do we need?

Need a good mix of finance, technology and project management skillsets

Mix of team members with finance, risk and SAP technical background

Good understanding of:

- access controls

- financial risks and controls

- SAP controls

Background / skillset:

- Finance and accounting

- Audit and assurance

- Project management

Where should we have this controls service centre?

Leverage the current set up and ensure a manageable start

Part of existing shared service centre framework- New service line under Finance Services- Scope: Financial controls

1 global centre - English speaking- Not a 24/7 operation (except for emergency access)

Mix of skill set –- Matrix organization based on process/service and geography

Leverages Developing & Emerging market expertise- offshore centre

Implement the new operating model

Key challenges

Migrate to the controls service centre using the legacy framework and implement improvements as we go along

• Stop old habits

• Establish clear ownership and service level agreements

• Develop balanced performance measures

• Automate controls in parallel

• Set up the technical infrastructure

• Establish governance structure

A typical shared service centre implementation approach

Known challenges…..but a clear detailed plan to help us deliver

Clear migration plan / transition road map: transition approach

Simulation and roll out: Start with few markets and then a complete go-live

Change management: detailed impact assessment, quality retention,

Communication: top down with clear senior management support

Knowledge transfer: market specific business requirements and

Manage expectations: clarity on what the controls centre service will deliver?

Values to the business

Values to the business

Cost effective….value based….robust controls environment

Supported by a continuous improvement framework

…Increased valueReduced cost… robust controls….

Current trends and optimisation

Current trends and opportunities

Agility, strong capability and a performance driven service delivery model…ready to improve and embrace change

• Robotics: manual intervention is only required to deal with exceptions

• More automation: maximise return on investment in ERP

• Enhanced data analytics capabilities: use big data to analyse and focus on real issues

• Extend services: new speciality and high value add services

• Better embed: manage and drive ‘embed controls’ agenda (including new acquisitions)

Closing thoughts

Closing thoughts

Get on….hit the road

• Challenge the status-quo

• Embrace technology and maximise return

• Benchmark and improve

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited (“DTTL”), a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.co.uk/about for a detailed description of the legal structure of DTTL and its member firms.

Deloitte MCS Limited is a subsidiary of Deloitte LLP, the United Kingdom member firm of DTTL.

This publication has been written in general terms and therefore cannot be relied on to cover specific situations; application of the principles set out will depend upon the particular circumstances involved and we recommend that you obtain professional advice before acting or refraining from acting on any of the contents of this publication. Deloitte MCS Limited would be pleased to advise readers on how to apply the principles set out in this publication to their specific circumstances. Deloitte MCS Limited accepts no duty of care or liability for any loss occasioned to any person acting or refraining from action as a result of any material in this publication.

© 2016 Deloitte MCS Limited. All rights reserved.

Registered office: Hill House, 1 Little New Street, London EC4A 3TR, United Kingdom. Registered in England No 3311052.