Connecting the Dots on Risk, Analytics, and Compliance

There have been many great articles published lately about risk management, analytics, fraud, compliance and the value of internal controls. All are good reading and very informative. There is a ton of good information that can be gleaned from each of them. But the greatest value is achieved when one connects the dots between these diverse topics. Not doing so is to ignore the risks that could both help and harm your organization, analyzing data for the sake of analysis, looking for fraud -- possibly in all the wrong places, being compliant solely for the sake of compliance and evaluating internal controls only because it was in last years’ audit plan.

The fact is all these things are inextricably tied together in a cohesive set of dependencies. Organizations need to apply a coordinated approach to these issues to ensure efforts aren’t duplicated, best internal resources are brought to bear and the objective of all these activities is realized: running a better business.

This begs the question, "Where to start?" Here is one sequence of activities to consider:

1. Conduct a top-down risk assessment. Identify key risks to your organization from both a business and regulatory perspective, acknowledging both the threats and opportunities inherent in your risk appetite. One leading practice is to seek the input of both business process owners and the Internal Audit department. They both have detailed knowledge of how internal processes work and how to independently assess how well those processes are functioning. Internal Audit brings the skill set and rigor to determine the adequacy and effectiveness of internal controls -- a critical aspect of an organization’s governance structure.
2. Find the data. Determine what data you need to gather, analyze and assess to monitor your organization’s performance. Work with your IT department to gain secure access to the necessary data. Arrange for a secure location where you can safeguard your organization’s data from inappropriate disclosure, loss or manipulation.
3. Assess the overall quality of the data. Ensure that you are seeing the complete picture, blemishes and all. Data quality is a critical prerequisite to effective business analytics. Poor data quality jeopardizes the performance and efficiency of operational systems. It undermines the value of analytic and business intelligence systems upon which organizations rely to make key decisions. Decisions based on poor data can result in direct financial loss, mar customer relations and damage an organization’s credibility in the marketplace.
4. Determine what information you want from your data. Are you seeking indicators of overall business performance? Are you searching for indicators of emerging risk? Are you looking to assess the overall operating efficiency of key internal controls? Are there areas where the risk of fraud is high and of concern to management? Do you need to keep a sharp eye out for regulatory compliance? Whatever the answer to these questions, organizations need to assess what is the best technology for the type of analysis they want to perform. Additionally, organizations should consider the automation of their analytics to make it cost effective and sustainable.
5. Address people, process and technology. Recognize that whatever solution you opt for, it will involve a mix of people, process and technology. Each of these areas needs to be addressed. Technology by itself will do nothing. New processes and procedures will be introduced by working more closely as a team and by leveraging the insight that technology can help deliver. And, finally, an investment in people is needed to ensure each team member understands what he or she needs to do in either analyzing data, assessing risk or following up on the insight that analytics can produce.

   The end game with all of these topics is achieving organizational objectives and running a better business. It’s not about just being compliant or checking all the boxes on the best practice checklist. Connecting the dots between these different issues and doing so in a coordinated, managed fashion can produce excellent results. It does take effort, leadership and drive -- but what’s worth doing that doesn’t involve these elements?

Peter Millar is the Director of Technology Application at ACL Services Ltd., a provider of financial monitoring software and expertise.