Have you automated your Narrative reviews?

Are you paying employees to inventory email responses or spend hours in update meetings to accomplish tasks that can be automated? With the application of policyIQ forms, your employees can take back time that was spent on tedious tasks and focus on work that matters.

If your team is still using Word, Excel, and email to manage 302 CertificationsControl Self Assessments and Narrative Reviews, they are engaging in the frustrating task of having to inventory the responses from their inbox and then babysit and pester people to complete their work. As responses do arrive, they evaluate who they’ve heard from, who hasn’t responded, and evaluate whether/which follow-up activities are warranted. They are likely also having to pull together routine assessments regarding the status of responses to share with management and others.

Before anyone invests another minute on the effort of pulling together the Narrative Reviews for next quarter, contact us to help your team realize these benefits right away:

  • Simplified roll-out of questions/certifications each quarter
  • Easy access to real-time information for monitoring of status
  • Automation of reminders going out to outstanding respondents
  • Automated compiling of results
  • Effortless reporting for management

There are lots of products out there that will set you back $50-$500k annually that promise efficiency gains in your compliance processes. For a fraction of that cost, we’ll deliver on that promise in a matter of weeks—not months or years. Work smarter. Spend smarter. Contact us today to schedule your configuration session. 

Who wants to avoid redundant effort and rework?

RGP consultant, Jason Chiang, recently wrote:

Jason Chiang
Expert in risk management and audit

“A narrative provides mid-level detail of the transactions and internal controls within a business process and includes who, how frequent, and in what location the transactions and controls are being performed…

…Narratives should be updated as changes are implemented in the organization. The updates should follow a workflow where there is a review process for significant changes.”

For many clients, automating the process of updating compliance documentation is a critical but often overlooked part of their practices. Each year, various aspects of controls may change, such as steps of the control procedure, the control description, or control ownership.  As these critical bits of information are updated, it is important, as Mr. Chiang stated, that the associated narrative pages are also updated to reflect the latest information.

Who wants to avoid redundant effort and rework?!

If you haven’t already implemented policyIQ or you have policyIQ and you haven’t taken advantage of this feature, this is a good time to tune in and make a note: policyIQ has a “linked field” option that allows you to update control language (or other documentation) in one place and present the updated language in related documents—here’s the key: without redundant effort or rework!

Displaying all related Controls in the Narrative is probably the most common request, but you can also display Risk language in Controls, Control language in Tests, and the contract review conclusions in a management summary page, among a seemingly infinite number of options! No more hunting down related documents to make small tweaks–it’s already done!

To learn more about how reduce redundant effort and rework, contact our team at Support@policyIQ.com.

Your Risk Assessment spreadsheets are costing you!

Are your employees still manually managing Risk Assessments using spreadsheets?
If you answered yes, they are likely struggling to work with others efficiently, they are frustrated by version control issues, and they are wasting time trying to figure out who has given input and who still needs to provide information.

The data in spreadsheets is difficult to aggregate. Performing analyses within a spreadsheet is limited, and across multiple spreadsheets it is nearly impossible. There are nearly always issues with data entry and, therefore, data integrity. So, your employees are likely also spending time having to validate and track down information and they’re likely performing rework to shore up assessments and findings. For all of these reasons, spreadsheets prolong the time and expense of audits.

RGP’s policyIQ team has developed features that help you to automate questionnaires, inventories, risk ratings, capability measures, track gaps and roll-up findings. Your management and audit teams can begin collaborating on their finance, operational, fraud and enterprise risk assessments right away.  Contributors from your locations can work together in one flexible and easy to use tool with confidence in the security and accuracy of their information and analyses. Templates for various risk assessments are easy to customize. Notes and assumptions from previous assessments can be easily referenced and considered in current risk calculations.

Your auditors can remotely review the content that you choose to make available to them and only after it has completed the review process that you enforce using policyIQ.

Reach out to us to request your free trial site and to learn more about how your team can end their reliance on spreadsheets. Work smarter.

Flexible Risk Assessment Frameworks with World-class Subject Matter Expertise

When deploying a technology platform for any GRC process, many questions are considered during the procurement process.

“How long will this take to get up and running?”

“Is it customizable?”

“Is this software affordable – and what if we choose to expand the scope of our deployment?”

Within the scope of GRC, policyIQ can be used to implement nearly any type of risk assessment – and can be done quickly (with custom tailored content), all at an affordable price.  It’s a system that grows as you grow.  But as you likely know, risk assessments are an area that has a seemingly infinite number of options on how to get from A to Z.  Fraud Risk?  Financial Risk?  Third Party Risk?  And the various methodologies to achieve each can be staggering.  

Can I implement my own methodology, or am I forced to use the software’s built-in items?

You’d be surprised to find that for many software platforms, the response to this doesn’t always yield positive answers.  One of the benefits of utilizing policyIQ is that the keys are in your hand for making this decision.  We have clients from all corners of the globe that choose to use their own methodologies when leveraging our software – and are able to do so with excellent results.  Likewise, many organizations have sought subject matter expertise, looking for a proven methodology and guidance to help them get the ball rolling. 

Regardless of the approach, policyIQ’s flexible platform is fine-tuned by the client to become the go-to place for establishing a consistent and reliable risk assessment environment, year after year.

Learn more about RGP’s professional services, or have a look at policyIQ’s solutions for GRC initiatives.

Here’s the trick for crushing your stretch goals…

Declare this “time for a fresh start” and get organized!

Is everyone stirring and antsy at the thought of kids running out of school, hooting and hollering, and throwing papers in the air? Well, I’m a momma and my kiddos have been off kilter and frazzled with anticipation of summer break for at least two weeks! One of our practices that we carry out a couple of times each year—and every year at this time—is to clean out backpacks, cubbies, bookshelves, and the desks at school and at home. We organize items into the “this will be useful in the coming year” pile, “keep forever in the scrapbook” pile, “how in the world did this get in here?” laundry pile, and into the “recycle/retire to final resting place” pile. They are super anxious to run off to their friends’ houses, ride bikes, or dive into their latest Minecraft creation, but mom forces them to hit the skids until they have completed this chore.

Having a clean slate and getting organized for a fresh start in the next life chapter is one of our strategies for setting ourselves up for success. They might grumble and sulk for a short time, but they’ll thank me for these habits one day. That’s my hope, anyway.

Being disciplined about hitting the pause button and making time to lay the groundwork for future success is not just a chore for school children and moms. You’ll hear the same guidance from the policyIQ team as you embark on your goal to better manage your Governance, Risk, and Compliance initiatives.

Take time to organize content and users.

One of the most obvious benefits of policyIQ is that you can be up and running—actually using the tool in your organization—on the same day that you submit your order form. Our recommendation, though, is that you tap the breaks a bit and set up your site in a way that more likely ensures your long term success.  The fundamental questions to consider for any policyIQ implementation are:

  1. What are we planning to capture or manage in policyIQ?
  2. Who needs to have access [and what type of access do they need]?
  3. How can we organize information in a manner that is intuitive to our users?

Thinking of the overarching goal of the initiative or documentation and considering how the pieces of documentation may be broken down and related to adjoining processes will give your team the flexibility to home in on specific details for analysis while also overseeing completeness and performance at a high level. If you’re drawing your plan on a whiteboard and feel the need to branch off into several related items, that might be an indication that you could design more than one template to capture the different types of documentation.

Similarly, taking the time to create an organization chart, so to speak, that logically accommodates all of the hats that are worn by your policyIQ users will go a long way to simplifying access to policyIQ content going forward. Creating groups for Control Owners, Asia-Pac Approvers, 302 Respondents, and the Board of Directors, for example, makes it easy to ensure accuracy while minimizing maintenance as employees move into new roles within the company or new employees are brought on board.

This org chart does not have to match a traditional org chart with departments and position titles. That hierarchy might be a part of the structure. A tip that makes life much easier, when it comes to maintenance in the future, is to consider the other hats worn by your employees. Is the Business Unit Manager also a Process Owner or a Control Owner? Does she respond to 302 Sub-certification Questions? Does she lead any committees or projects? If those initiatives are managed in policyIQ (and they can be), then it will help to have the roles of all the players represented in your Groups structure. With a well-planned group structure, only the users require adjustment when there is turnover, not all of the documentation and responsibilities of the people coming and going.

Do you feel like you don’t have time…to save time??

That’s the perfect time to contact us! There is a standard policyIQ configuration for many GRC solutions and the experienced implementers on the policyIQ team have helped hundreds of companies to set up policyIQ for various solutions. We can help you to get started—or re-started—quickly. If you’re strapped for resources while the organization is trying to squeeze in a change in process or shifting from manual processes in Word, Excel, and email to a centrally accessible cloud solution with workflow management tools and you just don’t have time to really focus on the effort to save time, then let us put you in touch with a subject matter expert who can help you with the design of your Risk Management or Compliance or Audit process, or our professional consultants can lead your project team, or they can take on the lion’s share of the work to transition documentation. We can help you to assess your needs and close the gaps.

Happy Summer Break!

We hope that you enjoy some fun time with family and friends this summer. Let us know where we can support you to work more efficiently and more effectively to help free up some time.

Who has access to your critical documentation?

Think, for a moment, about your human resources policies, risk documentation, safety specs, audit issues, training materials, accounting procedures or your IT controls.

  • Do external audiences, as well as internal employees, need access?
  • And do these audiences require access to different subsets of your content?
  • Does the intended audience know exactly where and how to locate all relevant content?
  • Is the latest version of the content available to your audience?
  • What steps do you have to take to disseminate content changes to your audience?

These are among the information governance considerations that RGP systematically addresses using policyIQ.

One of the lesser known perks of policyIQ is the ease with which you can provide free, simple, secure and tailored read-only access to your audience.

In this related blog post, we described one feature of policyIQ that gives organizations an easy-to-setup and easy-to-use solution for presenting and disseminating content to your read-only users.

If you are trying to develop a plan for appropriately sharing different types of documentation with their respective audiences, get in touch with us! We enjoy brainstorming and problem-solving challenges like this!

Not all roads lead to successful IPO

Welcome guest blogger, Jason Chiang. With RGP for nearly 8 years, Mr. Chiang has more than 20 years of experience and expertise in Audit, Risk and Compliance. He has consulted with a range of companies from financial services, biotech, manufacturing, healthcare and other industries. Mr. Chiang is a Certified Public Accountant (inactive) and Certified Internal Auditor. He has served on both sides of the house as a senior audit manager and senior auditor as well as a risk manager. It is evident that he understands the motivations and hurdles facing these organizations and approaches their complex issues with integrity and professionalism.

The following article was written by Jason Chiang (with editing support from Stephenie Buehrle). The approach and recommendations are his.


Not all roads lead to successful IPO

When a company approaches their initial public offering (IPO), it enters a very different arena. Having access to public funds, that is the retirement savings of Main Street USA, the company must meet quarterly SEC filing requirements. This is a significant amount of work. An investment in the people experienced with technical accounting, SEC financial reporting, and Sarbanes Oxley Compliance (SOX) evaluations combined with an investment in systems and tools to do the work efficiently and with completeness and accuracy is crucial to meet the filing deadlines.

One cannot audit all internal controls over financial reporting (ICFR). Thus, performing a SOX risk assessment is necessary to identify the significant accounts and their relevant assertions. If you happen to be one of these companies developing a road-map to your IPO, SOX may not be the place where you want to focus significant time and financial resources, but you realize that it has to get done. Be sure that you consider, at minimum, these critical components:

Risk Assessment                                  

A risk assessment is the process of identifying significant accounts and disclosures and their respective relevant assertions as they relate to financial statements. A properly done risk assessment will allow the company work smart by focusing its internal controls evaluation on the areas where there is a possibility of a material error.

The Risk Assessment must include:

  • Quantitative factors such as account balance, frequency of transactions, dollar value of each transaction; and
  • Qualitative factors such as complexity of related transactions, subjectivity of accounting rules over related transactions, and fraud considerations.
  • As business and risks change, the risk assessment needs to be updated.

Narrative                                                                

A narrative provides mid-level detail of the transactions and internal controls within a business process and includes who, how frequent, and in what location the transactions and controls are being performed. The initial creation of narratives provides the process owners an opportunity to revisit and reflect on the current processes, and make improvements for operational efficiency or control effectiveness. It is a written document that can be read by internal employees, internal auditors, and external consultants and auditors to gain a preliminary understanding of the process. As processes change, the narrative provides a format to document the change.

What critical things must be considered regarding Narratives?

  • The narrative should be written knowing that auditors will be a primary reader and will be looking for controls that mitigate risks.
  • When describing management review processes in the narrative, articulating how the manager gains assurance of the completeness and accuracy of the supporting evidence before signing off. If the manager is using judgment, describing the factors considered.
  • Narratives should be updated as changes are implemented in the organization. The updates should follow a workflow where there is a review process for significant changes.

Control Matrix                                      

A control matrix lists the controls the company has identified to mitigate risks. The control matrix serves as evidence that identified risks are mapped to controls which are to be evaluated for management’s assessment of internal controls. The control matrix also is a primary client document auditors leverage to perform their independent test of controls.

Take care to ensure that:

  • The controls in the Controls Matrix are mapped to risks.
  • The Controls Matrix is in a format where it is sortable or reportable by controls mapped to risks for test of controls purposes, and risks are mapped to controls for an evaluation whether risks are mitigated by controls.
  • Controls in the Controls Matrix should be labeled and provided an abbreviated title (10 words max) for ease of reporting and reference purposes.

Testing                                                                      

Testing is the evaluation of design and operating effectiveness of the company’s controls. The results of testing of controls provide company management with a baseline to that might have impacts to strategic and operational decisions. For publicly held companies, testing is an SEC requirement.

Critical considerations for testing:

  • Important, if deemed necessary, to be able to re-perform the actual control performed by the employee (e.g. for 3-way match of purchase order, invoice, and shipping docs, test that an employee had performed this and has evidence of such, rather than the auditor requesting the 3 docs and testing oneself).
  • When testing management review controls, cannot just accept sign-off, but need to understand the steps and judgments used by the manager, and test accordingly.
  • The documentation of testing should allow someone else to reasonably re-perform the testing. If testing is being relied upon by external auditors, then the breadth of documentation is more important. If not, not all needs to be retained, but should be readily retrievable when needed.

Certifications                                        

Control owners certify to the CFO and CEO that controls are operating effectively on a quarterly basis, and if not operating effectively, the remedial action plans. The control owners are held directly accountable for their controls as they are certifying to the top two officers of the company.

Recommendations for certifications:

  • The number and level of person certifying to the CFO and CEO should be carefully considered. The level should be their direct reports and one level removed to maintain the efficiency and integrity of the certification. If it is a larger organization, there can also be sub-certifications up to the senior manager level.
  • The certification questions should have a combination of checklist questions, as well as, open ended questions to encourage a thoughtful process.
  • Utilizing software for tracking, follow-up, and retention purposes is advised.

Depending on the number of people involved with the inputs into the various components, one might decide that performing and capturing the work in Excel is sufficient, while others might prefer utilizing a SOX tool where there are extra protections in version control while allowing multiple users to perform inputs simultaneously in multiple locations. A SOX tool may also provide management with options for review, analysis and oversight that are not available in Excel.

To avoid unexpected setbacks, be sure to plan enough time into your IPO readiness map for SOX evaluations. The initial SOX program development and implementation is likely to require six months and can vary depending on your access to subject matter experts. Coordination and alignment of the SOX efforts and objectives among the audit committee, senior management, process owners, and internal and external auditors is paramount for a successful implementation.


If your organization is approaching your initial public offering and you’re interested in learning more about how RGP can support you with subject matter expertise and a tailored technology solution to help ensure that you are prepared for your SEC filing and financial reporting requirements, reach out to us (Information@policyIQ.com, 412.263.3330) and we’ll connect you with our RGP colleagues near you!

This Audit Trail will Reduce Organization Liability

Many organizations have pockets of well-developed and maintained policies and procedures. Leaders in various business units might have overseen the development of certification processes (“I have read and understood the policy…”, “I have not observed fraud…”). Fewer, though, are the number of organizations that have a coordinated enterprise strategy on policies.

GRC 20/20’s Michael Rasmussen had this to say about a strategy on policies:

We could write a series of posts delineating how policyIQ provides powerful technology support for a coordinated enterprise Policy Management strategy. For this post, however, let’s focus on Rasmussen’s last sentence in the paragraph above. policyIQ houses a comprehensive audit trail comprised of a number of features that allow the history of changes and versions to be examined from a variety of perspectives.

Historical Review

Version History is retained on all policyIQ content. It is possible to examine exactly what was presented in any version at any point in the content’s history. Attachments to documentation (evidence, forms, supplier documentation, etc) are also retained for historical review.

Change History is even more specific than Version history. This feature of policyIQ tracks specifically who made changes to content, what change was made, and when—dating all the way back to the inception of the documentation.

The viewing history of each page in policyIQ is also tracked. Do you want to know if that employee or the external auditor accessed the content last week as was reported? policyIQ can tell you.

Certifications

The ability to create and tailor certifications, attestations, and questionnaires and to customize how they are made available or scheduled for delivery leaves endless possibilities for organizations wishing to gather information from employees (and third parties) on their commitments, agreements, observations, performance, opinions and on and on. The “Forms” functionality in policyIQ eliminates the risk that an employee’s response will be overlooked in the sea of email.

Reporting Capability

All of these changes are made evermore valuable with the associated reporting features. Do you want to know who made changes to Accounting policies in the most recent quarter? Maybe you escalate a monthly review of any Exceptions documented on Information Security policies. Can you easily identify all procedures, projects, divisions or positions that will be impacted by the technology that you’re scheduled to replace? Yes—with policyIQ, you can.

Snapshot at a Point in Time

And if all of that wasn’t enough, policyIQ also allows organizations to schedule the capture of a complete backup of their database, called a Snapshot, containing all data at the time the Snapshot was captured.  Snapshots are a free benefit to policyIQ clients. While it is not common, it is an invaluable service to be able to present and review content as it was two years ago on that day in May, let’s say. For a small fee, clients also have the option to request an electronic extract of all content from their policyIQ site that they may provide in the event of an investigation or audit.

Safe and Direct Access

If the need presents itself, it is possible to provide investigators, auditors, litigators or other specified parties with direct access to your policyIQ site. This type of access would allow them to review documentation in the application and save on legal fees or administrative fees for copying or making information

RGP has received positive reviews for the breadth and depth of the audit trail provided in policyIQ. And while we have a number of testimonies to value that these features and services have yielded for various functions and divisions of our clients, that value is exponentially greater when applied enterprise-wide.

Maybe we’ll have to circle back to talk more about Michael Rasmussen’s related blog post and how policyIQ can help you to combine Case Management and Policy Management without sinking a huge investment of time and money into a big GRC platform. RGP has you covered with the subject matter expertise and technology there, too. Feel free to reach out to us directly if you’d like to know more or explore your options sooner than later!