Scope of internal controls expands due to pandemic but mindset and technology need boosting

_{76% of the respondents perceive internal controls as valuable but feel that not all levels in the organisation are proactively participating in the internal control journey}

_{87% of organisations are expanding their monitoring of internal controls as a result of the COVID-19 crisis, and 38% expect a change in mindset about internal controls due to the pandemic}

_{Digital transformation in internal controls is lagging; 30% of respondents declare they are not using any digital tools, and 54% are unsure whether they will do so in future}

Tuesday 26 January 2021 - Organisations all run on processes: people, software and machines interacting in a series of steps to complete essential tasks; for example, ordering, receiving and paying for materials. Monitoring how well these processes run - internal controls - contributes to the success of the whole organisation, and helps maintain transparency and trust with employees, clients and stakeholders. With this in mind, PwC’s Internal Controls Survey polled roughly 40 large public and private sector companies with operations in Belgium about their internal controls, focusing on mindset, maturity, risk assessment, control design, monitoring, reporting and digital enablement.

Why internal controls?

The importance of internal controls has increased as many company structures have become more complex. An internal control system ensures that the organisation’s assets are being used efficiently and accurately. Putting the right controls in place enables organisations to gain valuable insights into the proper functioning of their business processes (for instance, is an invoice linked to an approved purchase order and goods receipt?). It also helps everyone in the company as well as external stakeholders develop a better understanding of the organisation and its activities.

Despite their importance, not everyone within the organisation gives top priority to these controls. 76% of the respondents perceive internal controls as valuable but feel that not all levels in the organisation are proactively participating in the internal controls journey. It remains a challenge to make the added value of their tasks clear to internal control owners, and to go beyond box ticking -  “checking because my boss asked me to” - to illustrate how their activity contributes to the trust factor and ultimately the resilience of the organisation. There is a definite need for support in the form of training and persuasive communication; 16% of respondents also considered gamification as an efficient way of reinforcing an internal controls mindset.

Impact of COVID-19

The biggest impact of COVID-19 has been on the scope of internal controls: 87% of respondents are performing additional monitoring in at least one area, and 95% consider there are additional operating, security and financial risks that need to be mitigated. 38% believe that the crisis will result in a change in mindset as regards internal controls, and some organisations consider the pandemic as an opportunity to change the way internal controls operate. Small steps are being taken towards a future-proof internal control function, with attention being given to digital opportunities to support internal control efficiency and effectiveness.

“COVID-19 continues to have an impact on businesses across the world, not just on results, but also on how processes are run and monitored. The new reality of running a business remotely, potentially understaffed or missing key individuals, changes the way internal controls are performed,” explains Wim Rymen, Partner at PwC Belgium and expert in internal controls. “Manual paper-based controls no longer work - either the controls need to be digitised, or a workaround needs to be defined. An ongoing review of the organisation’s internal control environment is imperative to avoid a drop in effectiveness.”

Digital transformation of internal controls

In today’s environment with large numbers of complex business processes, internal control systems aren’t always covering risks in an efficient manner. Although current internal control systems often have a proven value, their relevance and efficiency can be boosted when used in combination with a data-driven approach. The most commonly used digital tools to support internal control activities are data analytics and data visualisation, robotic process automation (RPA) and process mining. The main reasons to use these are to improve monitoring and detection controls, and to better understand the impact of (deficient) controls. However, 30% of respondents do not use any of the digital tools available, and strikingly 54% of the companies surveyed are not sure whether they plan to develop and use these digital techniques going forward.

Today’s complex IT landscape often makes it difficult to measure and maintain process quality. Factors that slow down the uptake of digital tools can be related to cost, lack of knowhow or the perception that the maturity of internal controls and the accompanying mindset is not sufficient. “Using new technologies to boost the efficiency of internal controls is a good approach; there’s a need to invest in expertise in this field, and build capabilities in-house,” states Wim Rymen, Partner at PwC Belgium and expert in internal controls. “But it’s important to remember the ‘golden triangle’ connecting controls, technology and people. It’s key to get all stakeholders on board - especially the internal control owners so they understand the added value of what they’re doing, and genuinely see the link between internal control and protecting the organisation’s resilience and reputation. Understanding the people dimension, upfront analysis, training and support are all absolutely essential. You can digitally enable your control systems, but if you don’t get the human element right, you won’t get very far.”

About PwC Belgium’s Internal Controls survey

The goal of the Internal Controls survey was to provide quantitative insights into the way Belgian organisations are dealing with internal controls and measuring how COVID-19 impacts their internal control function. Furthermore, the survey wanted to obtain qualitative insights about the state of the organisation’s internal control culture. The PwC Belgium Internal Controls Survey focused on the internal control mindset and maturity, risk assessment, control design, monitoring, reporting and digital enablement. 37 large public and private sector companies with operations in Belgium in a wide variety of industries were surveyed. The respondents all have responsibilities in the internal control domain. Some demographic details of the respondents:

• 68% were from companies with over EUR 150 million in revenue
• 52% of the organisations have over 5,000 employees
• 72% have ERP systems
• 57% of respondents were from companies listed on a stock exchange

Read the full Internal Controls Survey report.

Contact

Erik Oosthuizen

[email protected]
​0474 56 42 76

www.pwc.com