Enterprise control: building confidence and securing value through strengthened internal controls

13 February, 2023

It has never been more important for organisations to have a control environment that provides the confidence to respond quickly and demonstrate resilience. We face more diverse, fast-moving and unpredictable risks than ever before—from climate change, economic uncertainty and societal inequality to cyber threats and systemic global disruption. And the constantly evolving regulatory landscape adds further complexity. Having a right-sized and business-aligned control environment that is data-led helps provide the panoramic insight and agility needed to face these challenges with confidence.

Against a backdrop of more diverse, fast-moving and unpredictable risks, the time is ripe to move from traditional compliance-based approaches to control to an approach that allows organisations to look panoramically across the entire system of governance and control. Optimising controls reduces the cost of compliance, improves effectiveness and enables faster and more confident decision-making.

This revised approach allows organisations to balance the need for transformation and creating new opportunities for growth with the provision of assurance to build trust and confidence among stakeholders, investors and customers.

Why now is the time to rethink your approach to control

The need for greater resilience
Regulatory change
Transformation
Stakeholder expectations

The need for greater resilience

Significant disruption is testing the resilience strategies of business. Geopolitical uncertainty and other unforeseen crises require greater agility and control within organisations and throughout the supply chain.

Regulatory change

The regulatory landscape continues to evolve, adding further complexity and new compliance challenges for organisations in areas such as environmental, social and governance (ESG).

Transformation

The need for organisations to innovate and adapt to changing market conditions, customer behaviour and regulation is driving a faster pace of change.

Stakeholder expectations

Investor decisions increasingly consider whether the organisation meaningfully contributes to society through its strategy, values and purpose. Hence the importance of ESG and other reported non-financial information and the scrutiny over the assurance in place to ensure quality and accuracy.

What does the future control environment look like?

The traditional control environment has evolved over time, navigating changes in operating models and corporate transactions. This often results in multiple technologies that are not integrated or streamlined, and heavy reliance on manual processes and workarounds. By contrast, a modern internal control environment requires a fundamental shift in thinking to reimagine compliance-based approaches in favour of insight-driven and data-led strategies.

Enterprise control ensures that the wider control system, including those over third parties, is future-proofed. It is about aligning controls to the interconnected system of governance, risk management, compliance and assurance so that they work together cohesively.

Five key enterprise control archetypes

While each organisation will need to adapt its control environment to its unique circumstances, we have identified five examples of control environment archetypes that illustrate where an organisation may prioritise its controls focus.

Any organisation embarking on a control journey. Generally small but fast-growing, they may face a moment of required maturity, such as entering a new market or becoming a more public-facing company. They seek a licence to operate in their sector or segment, which requires them to adhere to external laws and internal rules. Reporting and disclosure are front of mind.

Already has formalised controls but due to increased organisational complexity and the passage of time, they have become unwieldy and inefficient. A key objective is the optimisation of controls to increase efficiency and/or reduce costs.

Has had formalised controls for some time but is primarily concerned that the control environment does not appropriately address the organisation’s current and emerging risks. They may have experienced a big failure in controls to address these risks and ensure that the system is fit for purpose.

In the throes of business transformation and is acutely aware of the additional risk and opportunity this presents. They wish to ensure that future processes incorporate proportionate control design to avoid being a significant point of failure or remediation cost further down the line. Transformation provides the opportunity to take a fresh look at the control environment and controls optimisation.

Sees the opportunity for governance and control to provide significant business benefits through a sensing and predictive system that allows them to change direction faster. Instead of looking at each part in isolation, the entire system of governance, risk, control and resilience is considered.

How to achieve enterprise control

The main task for leaders is to create a vision for control and how to get there. This includes determining which attributes are most important for delivering the overall objectives of the control programme.

In an era of continual disruption, with new and emerging risk types, the future control environment must adapt to meet the challenge by providing panoramic insight and agility. One size does not fit all. However, some similar traits or archetypes are common within organisations.

What next?

This is a journey. Sequencing is key and don’t underestimate the value of establishing an early vision with change points.

Integrate data and technology design into the development—both from the perspective of building better control and in terms of the workflow and collaboration tool(s) needed to run and monitor the control effectiveness cycle.

Remember that none of this can be maintained without the right skills and capacity, and that building a ‘controls conscience’ and moral imperative is key to unlocking lasting cultural change.