CFO.Com and Oracle - Improving Bottom Line with Advanced Controls

CONTENTS

EXECUTIVE SUMMARY 1THE PROBLEM ILLUSTRATED 2SOLUTIONS 4PROCESS RISKS AND CONTROLS 6CASE STUDY 9SELF ASSESSMENT 12WHAT DOES THE FUTURE HOLD? 13CONCLUSION 13

CFO

Improving the Bottom Line with Advanced Controls

1

CFO

IMPROVING THE BOTTOM LINE WITH ADVANCED CONTROLS

EXECUTIVE SUMMARY Issues that contribute to cash leakage, such as duplicate vendor payments or transactions that contravene company policy, can seem insignificant individually. But mounting evidence shows that collectively these problems can have a dramatic and material effect on an organization’s bottom line.

This white paper examines how advanced controls can substantially improve the bottom line, the scope of the issues addressed by advanced controls, and the reasons why leading companies and experts who monitor cash leakage are increasingly looking to advanced control solutions.

Cash leakage, also known as financial leakage, is the unnecessary outflows of money due to business process errors, fraud or inefficiencies. Advanced controls continuously monitor Enterprise Resource Planning (ERP) configurations and transactions to identify and resolve cash leakage and similar problems, such as cash flow issues, working capital issues and fraud.

Advanced controls address three main categories of process transaction problems:

• Issues with a definite impact on the bottom line, such as duplicate vendor payments

• Issues with a potential effect on the bottom line, such as split purchase orders

• Issues with cash flow impacts on the bottom line, such incorrect vendor payment terms

The Accounts Payable Network—a 50,000-member organization that establishes best practices for accounts payable (AP) technologies and controls—recommends the use of advanced controls to provide continuous monitoring as a layer over ERP controls, especially for companies with automated systems. The organization makes detailed recommendations in its report, “Safeguarding Disbursements: A Technology-Enabled Approach to Overpayment Detection and Prevention.”

Organizations that have made the most progress in shifting away from manual controls are adopting advanced control solutions and showing what a difference those controls make, says Rob Rogers, editorial vice president at Financial Operations Networks, parent organization of the Accounts Payable Network.

“There is a transformation that is in process, or an evolution, if you will, in accounts payable processing and order to cash,” Rogers says. “The benefits of advanced controls have been demonstrated by the best-in-class companies that are typically the first to adopt new technologies and establish

“The benefits of advanced controls have been demonstrated by the best-in-class companies that are typically the first to adopt new technologies and establish best practices.”

2

CFO


CASH LEAKAGE BY INDUSTRY

Industry Average Recovered Funds per AP Audit*

Airline $450,000

Automotive manufacturing $1,500,000

High tech $650,000

Manufacturing (non-auto) $1,200,000

Transportation $500,000

*85 percent of the recoveries were from audits that covered a one-year period

best practices. Those companies have shown the considerable return on investment for process automation.”

While all organizations can benefit from advanced controls, companies with high transaction volumes or high-value transactions stand to gain the most. Advanced controls replace manual controls and continuously monitor configurations and transactions, so most issues are immediately detected and resolved.

Advanced control solutions also offer strategic insights into emerging internal trends to better manage operational risks. This paper provides examples that highlight not only the bottom line benefits of advanced controls, but also the strategic benefits for organizations.

Advanced controls address issues that affect the bottom line of an organization across virtually all business processes. A recent study of the AP function by PRGX Global Inc. illustrates the nature and extent of the problems that are addressed by advanced controls.

PRGX, which has conducted audits for over 40 years to recover funds lost through cash leakage, analyzed 376 of its AP recovery audits over a five-year period. Although PRGX conducts global audits for organizations in all industries, this study focused on five specific industries.

Although the study found that organizations in all industries lost significant sums due to AP errors, five specific industries stood out because of the scale of the average loss:

THE PROBLEM ILLUSTRATED

The study had three main takeaways, said Joe Collins, director of thought leadership at PRGX and author of the study:

3

CFO


TOP 5 AP ERRORS BY INDUSTRY

Error AirlineAuto

ManufacturingIndustry High

Tech Manufacturing Transportation

Overpayment • • • • •Duplicate invoice payment • • • • •Duplicate payment—paper related • • • • •Credit memo error • Process breakdown • • •ERS receiving error •ERS-related •Sales tax—rate •Sales tax—taxability •Re-bill • •

LEGEND

Overpayment Overpayment unrelated to duplicate payments

Duplicate invoice payment Payment made more than once for same invoice

Duplicate payment—paper related Duplicate payment from paper invoice in an electronic process

Credit memo error Error with credit memo quantity or price, or other error

Process breakdown Error related to lapse in documented processes

ERS receiving error Error caused by process breakdown at dock location

ERS-related Error related to evaluated receipt settlement payment

Sales tax —rate Tax figured and paid on incorrect rate

Sales tax—taxability Tax paid for untaxed item

Re-bill Error related to inconsistent vendor corrective action

• Profit leakage is not specific to one type of industry or error type.• Companies that don’t use recovery audits are losing out on recovered

cash.• By understanding and quantifying past errors, companies can use

insights from recovery audits to implement stronger controls.

“Advanced controls and recovery audits work well together. Recovery audits identify and quantify the amount of profit leakage you have and advanced controls enable your team to proactively detect more errors,” Collins said. “Recovery audits don’t eliminate the need for advanced controls, nor do advanced controls eliminate the need for recovery audits.”

Besides demonstrating the immediate return-on-investment (ROI) benefits of recovery audits, the PRGX study defined the top AP problems identified in the audits. Three AP errors were shared on the “Top 5” list for each industry tracked by the PRGX study: overpayments, duplicate invoice payments and paper-related duplicate payments in an electronic process. These and the other problems can be significantly reduced by using advanced controls.

“Recovery audits don’t eliminate the need for advanced controls, nor do advanced controls eliminate the need for recovery audits.”

4

CFO


Organizations seeking solutions to improve their bottom line have three approaches: recovery audits, ERP controls and advanced control solutions. Used separately, each of the solutions has many advantages and taken together they provide great synergies.

RECOVERY AUDITS

Recovery audits review company AP transaction histories, using data mining and other techniques to identify overpayments and other problems that impact the bottom line. When specific transactions are identified, the recovery audit firm works to collect the money lost from cash leakage.

One key benefit of recovery audits is that money recovered is typically from previous accounting periods. From a cash flow perspective, this can be considered “found money” that can be applied straight to the bottom line.

Recovery audits can provide insights into cash leakage risk areas and the materiality of related errors; organizations can use this information to strategically implement advanced controls. Advanced controls automate the detection process and detect errors early enough to avoid erroneous transactions that result in cash leakage.

ERP CONTROLS

ERP controls are essential to the ERP systems of organizations. Among the many benefits to your business processes, ERP controls provide key controls such as purchase order approvals and three-way supplier invoice matching.

Another benefit is they are embedded in your ERP systems and thus function seamlessly with your business processes. To help reduce operational risk, it is important for organizations to take advantage of these ERP controls where appropriate.

With more scrutiny on the bottom line, the increased complexity of business processes and a larger volume of transactions, organizations are learning that they need another tier of controls to complement or augment their ERP controls. By combining ERP controls with advanced controls, organizations can focus on running their operations instead of devoting substantial resources assessing whether there are significant process control issues.

SOLUTIONS

By combining ERP controls with advanced controls, organizations can focus on running their operations instead of devoting substantial resources assessing whether there are significant process control issues.

5

CFO


ADVANCED CONTROLS

Advanced controls augment ERP standard controls by providing an added tier of controls: they monitor ERP controls, they detect configuration changes, and they review 100% of transactions.

Advanced controls automate most of the remaining manual controls. This “last mile” of manual controls tends to be the ones that cause the most pain to an organization, in terms of cash leakage. And advanced controls provide distinct advantages over manual controls: they provide 100 percent coverage instead of relying on audit testing, they provide timely feedback about exceptions, they utilize sophisticated rules to detect challenging issues, and they efficiently track and resolve identified issues.

Advanced controls can identify and prevent problems that have a direct, significant and easily measured impact on a company’s bottom line. Some examples include:

• For the PTP process, advanced controls ensure the integrity of vendor master records and monitor for duplicate invoices.

• For the OTC process, advanced controls improve credit memos processing to minimize the extent of customer account write-offs.

• For expenses management, advanced controls can detect when employees obscure their buying and expensing of items not authorized by company policies.

While the direct, easily measured effects of advanced controls are easy to tabulate for an ROI calculation, advanced controls also produce improvements to the bottom line that are harder to measure—the ROI frosting on the cake. Examples of these less obvious impacts include identifying split purchase orders, and identifying unreasonable customer payment terms that can lead to excessive account write-offs.

Advanced controls also identify issues related to cash flow that affects the bottom line, such as incorrect vendor payment terms that result in unnecessarily early payments.

In addition to helping improve the bottom line, advanced controls improve the effectiveness of processes and reduce operational risk. For example, advanced controls reduce the incidence and impact of errors by identifying them through increased coverage, find errors sooner and even prevent

“While the direct, easily measured effects of advanced controls are easy to tabulate for an ROI calculation, advanced controls also produce improvements to the bottom line that are harder to measure—the ROI frosting on the cake.”

6

CFO


them in some cases. Advanced controls also allow process controls to be quickly adapted as requirements evolve, but without having to change the underlying processes.

Another advantage of using advanced controls is that they allow companies to focus their efforts on more value-added activities, such as reviewing and analyzing items that can be overlooked when trying to apply manual controls to large volumes of transactions, says Rob Rogers of the Financial Operations Network.

“Whether it’s your vendor master file review and cleanup and check; your approval levels—your invoice data; statement authorization; card reconciliations; your bank reconciliations; or bypasses in your system,” he said. “All of these are things that should be looked at, in some way. And frankly, the sheer volume can be overwhelming. When you bring in advanced controls, you can get all of those things done, and not have things slip through the cracks because of the reality of the crush of incoming transactions.”

Simply stated, advanced controls allow for much more effective and comprehensive coverage than manual controls ever could, and at a fraction of the cost.

When an organization considers business problems that affect its bottom line, those problems generally fall into three categories:

• Definite impacts: activities that always affect the bottom line• Potential impacts: activities that may affect the bottom line• Cash flow impacts: activities that may affect the bottom line due to

less-than-optimal cash flow

The following tables provide process risks, bottom line impacts and solutions for the PTP and OTC processes for the three categories. These two processes were chosen because they are particularly vulnerable to cash leakage.

“When you bring in advanced controls, you can get all of those things done, and not have things slip through the cracks because of the reality of the crush of incoming transactions.”

PROCESS RISKS AND CONTROLS

7

CFO


Process Risk Bottom Line Impact ERP or Manual Control Advanced Controls Solution

Invalid entry of supplier invoices

Single supplier invoice entered and paid multiple times

Prevent same invoice number from being entered for the same supplier

Detect invoices with similar invoice numbers and similar invoice amounts for the same supplier

Untimely payments to suppliers

Lose out on opportunity to take early payment discounts

Run payment processes based upon terms and/or specify to always take discounts on supplier records

Notify when supplier invoices with discount terms are coming due and that the payment process needs to be run

Inappropriate purchase transactions

Payment for goods or services that lack a valid business purpose

Perform manual review of business application security

Alert management about users with incompatible duties; for example, who can maintain supplier master records and enter purchase orders

PROCURE TO PAY

ORDER TO CASH


Incorrect pricing Invoices are created and recorded for a lower amount

Require approval for invoice pricing changes

Compare invoices to historical averages and alert management when materially different from threshold

Incorrect credit memos

Credit memos for higher pricing than invoice pricing;

Credit memos for higher quantity than actually returned by customer

Utilize automated ERP functions to compare credit memos to sales documents

Alert management when policies and procedures are not followed by users

Inappropriate access to write off accounts

Credit memo issued but goods not returned or valid services already rendered

Require account write-off approvals if above a threshold

Require additional approvals based on specified conditions; for example, require additional approval if account has recent history of write-off’s

DEFINITE IMPACTS TO THE BOTTOM LINE

In this category, for the PTP process, the bottom line is typically affected either because expenses or costs of goods sold (COGS) are increased. For the OTC process, the bottom line is typically affected because revenue is decreased.

8

CFO


POTENTIAL IMPACTS TO THE BOTTOM LINE

In this category, for the PTP process, the bottom line is typically affected either because expenses or COGS are increased. For the OTC process, the bottom line is typically affected because bad debt expenses are increased or revenue is decreased.

PROCURE TO PAY


Split purchase orders (POs) to work around approval thresholds

Excessive purchase of goods or services

Purchase orders (POs) over a certain threshold require approvals

Identify all POs that are within a rolling window (seven days, for example) from the same user and for the same supplier, then sum the group of POs and compare total to approval thresholds

Unapproved suppliers, goods, and services

Pay more than would have been paid using approved suppliers

Have purchasing contracts in place and review maverick ‘off contract spend’

Provide real time review of unique, non-compliant POs; for example, check if supplier has a contract, require additional approval if no supplier contract

ORDER TO CASH


Inappropriate terms assigned to customer

Excessive account write-offs

Only certain people are able to create new terms; define policies regarding terms

Provide management with insight between customer account write-offs and corresponding extended terms

Unreasonable sales discounts

Excessive sales discounts are provided reducing revenue

Enforce approvals on sales discounts given

Define rules that compare sales discounts to historical averages and obtain excep-tion approval for unusual sales discounts

9

CFO


CASH FLOW IMPACTS TO THE BOTTOM LINE

For both the PTP and OTC processes, the bottom line is typically affected because interest expenses are increased or interest income is reduced due to lost opportunities.


Inappropriate access to change payment terms

Invoices paid sooner than necessary per policy

Require approval for changes to payment terms

Define rules to review changes to payment terms and report to management when changes are made

PROCURE TO PAY

ORDER TO CASH


Incorrect credit memos

Credit memo errors cause customer payment delays

Review reports and follow up on credit memos not created timely

Develop rules that will prevent incorrect entry of customer credit memos

CASE STUDY A health services organization that recently considered advanced control solutions provides an illustration of a return-on-investment (ROI) calculation. The organization, with more than 1 million customers, examined the potential bottom-line affect of advanced controls in a detailed study late in 2012. Based in part on the ROI analysis, the company formed a plan to implement advanced controls during its ERP upgrade project and began implementation in the first quarter of 2013.

In 2012, the organization was interested in increasing its focus on controlling administrative costs, in part because of healthcare reform. At the same time, it faced increased risks because of its growth through acquisitions and geographic expansion, and it was planning an ERP upgrade in 2013.

10

CFO


“The organization was overly dependent on manual controls, which were inefficient and exposed the company to fraud and spending leakage.”

The organization faced several problems. The organization was overly dependent on manual controls, which were inefficient and exposed the company to fraud and spending leakage. The company had 40 to 60 users spending four to six weeks per year on testing, and it could take as long as three years between testing cycles for duplicate invoices. It was also difficult for the company’s users to track changes to key setups and values, such as chart of accounts, Social Security numbers and other master data. The company lacked automated detection, remediation and prevention of segregation of duty (SOD) violations. And its IT staff had to spend too much of its time tracking patches and upgrades.

The opportunity for benefits from implementing advanced controls was calculated in four quantifiable areas:

• Reduced fraud, waste and abuse• Redirected external auditing fees• Redirected internal auditing effort• Decreased IT effort during routine upgrades

The ROI analysis established baseline figures for each area and calculated improvements based on data from the company and industry averages, including figures from the Perspectives in Health Information Management journal and studies from Gartner, Forrester, Foley & Lardner, Financial Executives International and Compliance Week.

The analysis concluded that advanced controls would drive benefits in three main categories for the company:

• Continuous monitoring of key financial controls that direct efforts to recover or prevent fraudulent transactions

• Reduced exposure to access security risks for fraud, waste and abuse

• Improved business processes and reduced effort spent on manual controls

The analysis calculated a range for the possible financial benefit outcomes in each of the four quantifiable areas, with a conservative estimate, a most-likely estimate and an optimistic estimate. The analysis showed, under the most-likely estimate, that the company would reach the break-even point by using Advanced Controls after 26 months. And after five years, the most-likely estimate showed a total net benefit of $2.4 million, using a Net Present Value calculation, which translates to a 259 percent ROI.

11

CFO


Item Conservative Most-likely Optimistic

Recurring benefits $ 2,062,331 $ 3,130,656 $ 4,800,537

One-time benefits $ 146,484 $ 195,300 $ 244,141

Ownership costs $ (925,599) $ (925,599) $ (925,599)

Net financial benefits $ 1,283,216 $ 2,400,357 $ 4,119,079

Return on Investment (ROI) 139% 259% 445%

Break-even point (months) 33 26 20

CASE STUDY: FIVE-YEAR QUANTIFIABLE COST AND BENEFIT OUTCOMES

If your organization is considering whether it could benefit from advanced control solutions, it makes sense to perform your own ROI analysis. But even before the analysis, answering some basic questions can help with the decision-making process. Ask yourself: How significantly is the bottom line affected by cash leakage at your organization? Does your company have the risk indicators that point to a need for advanced control solutions?

The following self-assessment provides a thought-provoking guide to whether your organization might benefit from advanced control solutions.

SELF ASSESSMENT

12

CFO


# Question Yes or No

1 Has your organization had any recent, significant ERP system changes such as a major upgrade, chart of accounts redesign or changes in ERP vendors?

2 Does your organization have multiple ERP systems?

3 Is your organization considering or planning any initiatives to streamline processes across multi-ple ERP systems, and/or to provide consistent metrics across ERP systems?

4 Has your organization had any recent, major process changes (e.g., integrated purchasing and payables activities, integrated human capital management and payroll activities)?

5 Do any of your organization’s sub-processes have a significant percentage of manual transac-tions or activities? For example, are a large percent of vendor invoices entered manually?

6 Is your organization considering or planning any initiatives to improve process efficiency and effectiveness through such activities as further automation?

7 Has your organization encountered business process errors that require significant time to inves-tigate and resolve the errors?

8 Has your organization either encountered fraud or suspected fraud related to your business processes?

9 Has your organization’s auditors identified any opportunities to make significant improvements to your business processes?

10 Has your organization recently moved toward a shared-services model or moved away from a shared-services model?

11 Is your organization considering or planning any initiatives to improve cash flow or to improve working capital?

12 Is your organization considering or planning any type of upgrade to your ERP system (i.e., techni-cal, functional, new modules, transformation)?

Count the number of “yes” answers, then assess your organization as follows.

11-12: Extremely high benefit to your organization from using advanced control solutions8-10: Very high benefit to your organization from using advanced control solutions 5-7: High benefit to your organization from using advanced control solutions3-4: Medium benefit to your organization from using advanced control solutions0-2: Low benefit to your organization from using advanced control solutions Bonus Question: If you answered yes to question #12, your organization is a prime candidate for advanced control solutions.

WOULD MY ORGANIZATION BENEFIT FROM ADVANCED CONTROL SOLUTIONS?

13

CFO


Industry experts predict that advanced control solutions will provide companies with several new capabilities in the future, as the solutions are developed further and become more sophisticated.

One feature being considered is incorporating closed-loop recovery audits into the solutions, so advanced controls will not only detect incorrect payments but also provide a single, enterprise repository and related workflows to manage and track recovery projects.

Future advanced control applications will likely use high-end analytics, such as “big data” techniques to evaluate large transaction system data sets for anomalies and suspicious correlations and “machine learning” concepts to create controls that learn from the data.

Another area where advanced controls of the future are expected to have an impact is by integrating their automated risk monitors with enterprise risk management. Under this concept, exceptions to advanced controls would be linked to documented risks as part of the risk assessment process.

In the future, advanced controls could provide digital assessments of risk to enhance an organization’s annual risk assessments with more data-driven approaches. The controls could also enable external audit functions to go far beyond their traditional random sampling approaches by providing near-complete data coverage.

And advanced controls of the future will probably be capable of digesting multiple types of heterogeneous data sources, increasing the accuracy of the controls in finding exceptions.

Process transaction issues—from errors, fraud and inefficiencies—cause cash leakage and similar problems. These problems can have a dramatic and material impact on the bottom line. The definite, direct impacts include duplicate vendor invoices for the PTP process, and incorrect credit memos for the OTC process. Problems with a less direct but also significant impact include split purchase orders for the PTP process and unreasonable payment terms under the OTC process.

WHAT DOES THE FUTURE HOLD?

CONCLUSION

14

CFO


Advanced control solutions identify these issues—both those that have the direct, measurable effects on the bottom line, and the problems with a less direct impact. Advanced controls alert management to these issues, remediate the problems and close the issues after they are resolved. They provide continuous monitoring, and they provide flexible solutions that can quickly adapt as process requirements evolve.

Advanced controls are not limited by the transaction volume of an organization—they monitor every transaction, whether the volume is 100 or 100 million. The solution provides bottom-line benefits to all companies, and particularly those with high volumes of transactions or high value amounts per transaction. Beyond the bottom line, advanced controls also allow companies to evolve their finance functions to provide strategic insight into emerging internal trends to better manage operational risks.

Recovery audits also help with cash leakage issues, identifying overpayments and related AP issues and collecting those overpayments on behalf of the client. ROI for a recovery audit is relatively simple to calculate, and leading recovery audit firms conduct audits that are paid on a contingency basis.

Advanced control solutions and recovery audits are both recommended as best practices, and adopted by best-in-class organizations. As organizations consider whether to adopt advanced control solutions, they should consider their individual circumstances and whether they’ve encountered the issues outlined in this white paper. They should also study the potential ROI, and weigh the experience of best-in-class companies and industry leaders that have adopted advanced controls.

Improving the Bottom Line with Advanced Controls is published by CFO Publishing LLC, 51 Sleeper Street, Boston, MA 02210.

August 2013

Copyright © 2013 CFO Publishing LLC. All rights reserved.