Continuous controls monitoring (CCM) has been on the radar for many companies for the last 20 years, but only recently have organizations really pushed toward meeting this goal. In a broad sense, CCM is a systemic way of verifying transactions and reducing operational, compliance and financial risks. And a key goal is to catch control failures quickly, before they cause too much damage. “If you detect errors as quickly as possible, you’ll have less revenue loss and exposure to risk,” says Janet Beckmann, CPA, data analysis practice leader at Brown Smith Wallace LLC. The impetus for initiating CCM depends on the company but usually is prompted for one of three reasons: because the company experienced loss or fraud and wants to make sure it never happens again; time-intensive processes need to be automated so the company can work more efficiently; or a proactive company has security concerns in a certain area of the business, such as payroll or accounts payable. “Companies first need to determine their key objective,” says Beckmann. “From there, a system can be put in place to help maintain optimum control and identify problems so they can be solved before causing revenue damage.” Smart Business spoke with Beckmann about the value of CCM and what organizations should consider when planning a system. What is continuous controls monitoring, and how does it work for a business? Over time, CCM has become somewhat of a generic term that means a system that verifies transactions. But, in its true sense, CCM is a system that runs live, identifies problems as they arise and alerts people immediately. For example, if a CCM system is in place and someone inputs vendor invoices, the system will signal potential duplicate payments before checks go out the door. However, CCM also means having ongoing processes that help a company better control its environment. For instance, a company may only want to run the system once each quarter or twice annually, depending on the risk assessment and the company’s goals. Regardless of what type of system is put in place, CCM protects a business from fraud and revenue leakage while enhancing the overall control environment. What are the benefits of a continuous controls monitoring system? Ultimately, CCM serves as a highly effective risk assessment tool that allows companies to track key performance indicators and quickly respond to change, rather than waiting until end-of-year financial statements to catch errors or revenue leakage. A system can reduce the risks associated with operations, compliance and finances, and can help stop revenue leakage such as overpayments, duplicate checks and other administrative errors. Also, it can facilitate fraud protection by enhancing the control environment. When employees recognize that a system is in place to watch all transactions and collect data, this raises awareness and tends to improve overall operations. Everyone is more careful because the company is committed to improving controls. Finally, CCM can improve efficiency in an organization by automating time-consuming processes. For instance, one person may spend three out of four weeks in a month working on a single reconciliation. If that process is automated through a CCM system, the employee is freed up to focus on other areas of the business. Where can a company derive the most value from a continuous controls monitoring system? That depends on the company’s objectives. If a company fears that revenue is not growing as it should, a CCM system will help track trends by time, location, product and employee to identify where expectations are not being met. Doing a trend analysis to get this information can be quite difficult, so this is where a CCM system can be very helpful. Companies that work with large quantities of data — millions of transactions, for example — may need to monitor the business in a global sense, as opposed to watching over each business unit; there is no limit on the size or quantity of data that a CCM system can handle. Also, companies with disparate systems that are not effectively linked are at a higher risk for control failure unless a CCM system is put in place. No matter what the goals of the company are, once red flags and patterns that indicate suspicious transactions are identified, the problems can be solved. What is necessary for a continuous controls monitoring system to be effective? The system must be flexible to suit a company’s needs. An off-the-shelf system can’t be truly efficient for every business. It’s worthwhile to invest in a customized system that aligns with your company’s objectives. Also, the system must be simple — the more user-friendly, the better. To take full advantage of the system, a business must have follow-up and reporting policies in place; for example, a system may be set up to produce reports that managers review. Finally, a company must determine how the system and data will be managed. Will it be outsourced, or overseen by someone in-house? It’s a good idea to consult with a professional while going through the risk identification process to pinpoint areas where a system will be most effective. Janet Beckmann, CPA, is the data analysis practice leader at Brown Smith Wallace LLC. Reach her at (314) 983-1254 or [email protected].
