Following my recent presentation at a conference of finance executives, a member of the audience asked, "What is the typical cost of a program for internal control over financial processes?" He continued, "Is there a way to benchmark these costs?"
Benchmarking. An often-uttered word. One that indicates that we are serious executives -- that we are doing what it takes to optimize our programs. But how does it really work and what does it really do for us?
The concept of benchmarking is great, but before we can benchmark we need to define the outcomes that we hope to deliver. By way of example, when evaluating call center metrics, the starting point is understanding customer satisfaction (or some similar indicator). Without this top-level indicator of the outcome we hope to generate, it's impossible to evaluate other indicators such as cost. In a vacuum, spending $100 to resolve a customer problem is superior to spending $200 to resolve the same customer problem. However, the "vacuum" does not exist. If the $200 resolution delivers 95 percent satisfaction and the $100 resolution delivers 50 percent satisfaction, most executives would choose the former.
So what does that mean for us? As financial professionals, we must define the outcomes that we hope to achieve through our internal control programs, as well as indicators of success. Only then can we even begin to benchmark our costs, cycle times and other program attributes in a meaningful way. To engage in a benchmarking effort without taking the time to first establish clear outcome expectations is putting the cart before the horse -- the time and resources spent will be wasted.
Although every organization is unique and therefore pursues unique objectives, most organizations strive to achieve growth; profitability; total shareholder return; and key value drivers such as workforce productivity, quality, customer loyalty and innovation. In the same way, each of our programs for internal financial control will be unique and should strive to achieve unique objectives, but every program should deliver on these universal objectives:
1. Prevent noncompliance and weaknesses.
2. Prepare the organization to deal with noncompliance and weaknesses when (not if) they occur.
3. Protect the organization from negative consequences.
4. Detect noncompliance and weaknesses earlier rather than later.
5. Respond to noncompliance and weaknesses quickly rather than slowly.
6. Improve the program so that similar noncompliance and weaknesses are not repeatedly encountered.
7. Reduce losses due to noncompliance, including fines, penalties and investigation costs.
8. Enhance the culture so that even in the absence of controls, the workforce is inclined to do business within defined boundaries of conduct.
Now, undoubtedly, I will get a few e-mails (mostly from consultants) noting that the benefits of implementing a strong program of internal controls go beyond the outcomes listed above. Fine. Shareholders will be thrilled if our programs deliver more. But at the end of the day, if we cannot demonstrate that our programs deliver on the universal outcomes above, we need to get new day jobs.
Once we have a firm understanding of whether, and the degree to which, our programs are achieving top-level outcomes, we can discuss whether we have optimized the outlay of financial and human capital. In addition, we can thoughtfully analyze whether process improvement -- for example, reducing the cycle time to discover noncompliance of a particular type -- is worth the investment.