Not all roads lead to successful IPO

Welcome guest blogger, Jason Chiang. With RGP for nearly 8 years, Mr. Chiang has more than 20 years of experience and expertise in Audit, Risk and Compliance. He has consulted with a range of companies from financial services, biotech, manufacturing, healthcare and other industries. Mr. Chiang is a Certified Public Accountant (inactive) and Certified Internal Auditor. He has served on both sides of the house as a senior audit manager and senior auditor as well as a risk manager. It is evident that he understands the motivations and hurdles facing these organizations and approaches their complex issues with integrity and professionalism.

The following article was written by Jason Chiang (with editing support from Stephenie Buehrle). The approach and recommendations are his.


Not all roads lead to successful IPO

When a company approaches their initial public offering (IPO), it enters a very different arena. Having access to public funds, that is the retirement savings of Main Street USA, the company must meet quarterly SEC filing requirements. This is a significant amount of work. An investment in the people experienced with technical accounting, SEC financial reporting, and Sarbanes Oxley Compliance (SOX) evaluations combined with an investment in systems and tools to do the work efficiently and with completeness and accuracy is crucial to meet the filing deadlines.

One cannot audit all internal controls over financial reporting (ICFR). Thus, performing a SOX risk assessment is necessary to identify the significant accounts and their relevant assertions. If you happen to be one of these companies developing a road-map to your IPO, SOX may not be the place where you want to focus significant time and financial resources, but you realize that it has to get done. Be sure that you consider, at minimum, these critical components:

Risk Assessment                                  

A risk assessment is the process of identifying significant accounts and disclosures and their respective relevant assertions as they relate to financial statements. A properly done risk assessment will allow the company work smart by focusing its internal controls evaluation on the areas where there is a possibility of a material error.

The Risk Assessment must include:

  • Quantitative factors such as account balance, frequency of transactions, dollar value of each transaction; and
  • Qualitative factors such as complexity of related transactions, subjectivity of accounting rules over related transactions, and fraud considerations.
  • As business and risks change, the risk assessment needs to be updated.

Narrative                                                                

A narrative provides mid-level detail of the transactions and internal controls within a business process and includes who, how frequent, and in what location the transactions and controls are being performed. The initial creation of narratives provides the process owners an opportunity to revisit and reflect on the current processes, and make improvements for operational efficiency or control effectiveness. It is a written document that can be read by internal employees, internal auditors, and external consultants and auditors to gain a preliminary understanding of the process. As processes change, the narrative provides a format to document the change.

What critical things must be considered regarding Narratives?

  • The narrative should be written knowing that auditors will be a primary reader and will be looking for controls that mitigate risks.
  • When describing management review processes in the narrative, articulating how the manager gains assurance of the completeness and accuracy of the supporting evidence before signing off. If the manager is using judgment, describing the factors considered.
  • Narratives should be updated as changes are implemented in the organization. The updates should follow a workflow where there is a review process for significant changes.

Control Matrix                                      

A control matrix lists the controls the company has identified to mitigate risks. The control matrix serves as evidence that identified risks are mapped to controls which are to be evaluated for management’s assessment of internal controls. The control matrix also is a primary client document auditors leverage to perform their independent test of controls.

Take care to ensure that:

  • The controls in the Controls Matrix are mapped to risks.
  • The Controls Matrix is in a format where it is sortable or reportable by controls mapped to risks for test of controls purposes, and risks are mapped to controls for an evaluation whether risks are mitigated by controls.
  • Controls in the Controls Matrix should be labeled and provided an abbreviated title (10 words max) for ease of reporting and reference purposes.

Testing                                                                      

Testing is the evaluation of design and operating effectiveness of the company’s controls. The results of testing of controls provide company management with a baseline to that might have impacts to strategic and operational decisions. For publicly held companies, testing is an SEC requirement.

Critical considerations for testing:

  • Important, if deemed necessary, to be able to re-perform the actual control performed by the employee (e.g. for 3-way match of purchase order, invoice, and shipping docs, test that an employee had performed this and has evidence of such, rather than the auditor requesting the 3 docs and testing oneself).
  • When testing management review controls, cannot just accept sign-off, but need to understand the steps and judgments used by the manager, and test accordingly.
  • The documentation of testing should allow someone else to reasonably re-perform the testing. If testing is being relied upon by external auditors, then the breadth of documentation is more important. If not, not all needs to be retained, but should be readily retrievable when needed.

Certifications                                        

Control owners certify to the CFO and CEO that controls are operating effectively on a quarterly basis, and if not operating effectively, the remedial action plans. The control owners are held directly accountable for their controls as they are certifying to the top two officers of the company.

Recommendations for certifications:

  • The number and level of person certifying to the CFO and CEO should be carefully considered. The level should be their direct reports and one level removed to maintain the efficiency and integrity of the certification. If it is a larger organization, there can also be sub-certifications up to the senior manager level.
  • The certification questions should have a combination of checklist questions, as well as, open ended questions to encourage a thoughtful process.
  • Utilizing software for tracking, follow-up, and retention purposes is advised.

Depending on the number of people involved with the inputs into the various components, one might decide that performing and capturing the work in Excel is sufficient, while others might prefer utilizing a SOX tool where there are extra protections in version control while allowing multiple users to perform inputs simultaneously in multiple locations. A SOX tool may also provide management with options for review, analysis and oversight that are not available in Excel.

To avoid unexpected setbacks, be sure to plan enough time into your IPO readiness map for SOX evaluations. The initial SOX program development and implementation is likely to require six months and can vary depending on your access to subject matter experts. Coordination and alignment of the SOX efforts and objectives among the audit committee, senior management, process owners, and internal and external auditors is paramount for a successful implementation.


If your organization is approaching your initial public offering and you’re interested in learning more about how RGP can support you with subject matter expertise and a tailored technology solution to help ensure that you are prepared for your SEC filing and financial reporting requirements, reach out to us (Information@policyIQ.com, 412.263.3330) and we’ll connect you with our RGP colleagues near you!

How many spreadsheets are you trying to manage for ASC 606?

RGP is hearing from Public and Private companies who are working to get a handle on their Revenue Recognition compliance efforts. As with many new initiatives, most of those tasked with the responsibility of rolling out a contract review process began with authoring the process in Excel. This particular process, more than some, requires a number of people with varying technical skills and technical accounting expertise to work through a long checklist or multiple spreadsheets full of questions and considerations. And, like many others, these teams are racked with frustration over the common ills of spreadsheet-based processes:

  • Almost as soon as the tool is put to use, the version is out of date and the data does not reconcile with other versions.
  • It is difficult to track and understand which version is the latest or the “best”.
  • Often, spreadsheets are not properly secured and suffer unintended changes.
  • Changes to data attributes in the spreadsheets can have significant impact on conclusions.
  • Sharing and communicating lessons and conclusions is a massive and disjointed effort.
  • It is difficult to roll-up the results from multiple spreadsheets for analysis and reporting to management and auditors.
  • If multiple people must work in and make adjustments to the spreadsheet, it can be remarkably challenging to trace the changes back to the appropriate party.
  • It is virtually impossible to dictate order of responsibilities and to consistently communicate and enforce an approval process.

RGP has a few remedies that can help you to treat or avoid these ills.

Private Companies –  RGP has a proven Revenue Recognition solution that can help companies from your early assessment through planning how you will fill gaps in policies and systems and can aid your team with the implementation of agreed upon solutions, controls, policies and associate training and communication.

Public Companies – Those who worked to tackle ASC 606 compliance on your own in year one can certainly still call on us to evaluate your program and to identify and guide you to address and close gaps.

All Companies can take advantage of RGP’s proprietary tool, policyIQ, to remedy the ills associated with spreadsheet based processes. Companies have the option of

  1. leveraging the flexible and configurable policyIQ to automate your own checklist or questionnaire or
  2. you can adopt the RGP solution with pre-built templates that guide the reviewers through the contract review process.

In either case, you can put your spreadsheet worries to rest and bring centralized access, version control, workflow, reporting for analysis and management review to your Revenue Recognition program.

Contact us to learn more about our technical accounting expertise, project support, and proprietary technology: support@policyIQ.com.

Suffering low morale and a disconnect between executives and those doing the work every day?


 

 

 

 

Art Weeast has helped a number of organizations to “think beyond the task of documenting policies and procedures to the intelligence of the information that is in those documents.” In other words, think of the value or purpose that the documents serve. One of his objectives, as he trains organizations on how to create valuable documentation, is to “keep what’s in it for me, from the end user’s or the employee’s perspective, in mind as you develop content”. The end user and all stakeholders might consider, “What problems and questions can this documentation solve?”

To demonstrate the application of Process Intelligence practices (as Mr. Weeast termed his work), consider three common problems:

  1. Employees and Management do not value the documentation (mainly the procedures).
  2. Work tasks are not clearly connected to executive priorities.
  3. Business Units/Departments/Functions do not collaborate on cross-functional processes, often leading to tension and decreased productivity.

With Art Weeast’s help, let’s tackle each of these problems one at a time.

The problem faced by many (maybe most) organizations: Employees and Management do not value the documentation.

Consider how you can make your documentation useful. Follow this three step process:

  1. Set a course to establish more comprehensive documentation. Rather than tracking just the steps of the procedure, frequency, who performs…think of all of the everyday business questions that come up related to the procedures. Add Roles and Responsibilities, Applications Used, Definitions, Procedure Input and Output–these fields will help you to address common problems. Read further to see how.
  2. Make it easy for process owners and your front-line doers to capture the documentation. You don’t have to complete the fields in consecutive order. Starting with the procedure, then considering what leads into the procedure and what the outcome of the procedure is before moving on to the purpose and other data is a much easier thought process.
  3. Make use of the intelligence that is inherent in your documentation to solve business problems. With updated, comprehensive procedures, you can address common problems…effectively and efficiently!

Put your information to work for you!

Another common problem: Work tasks are not clearly connected to executive priorities. 

The front line doers, on a day to day basis, do more repeatable processes than executives do. At the executive level, it is unlikely that you will see procedures. This is the root cause of the disconnect between the tasks and executive priorities. It’s no wonder that executives generally don’t feel the value of the documentation and therefore, the employees don’t feel the priority from the executives to create and maintain the documentation. So, per human nature, documentation becomes an unwelcome task to do, and usually it is tackled at the last minute with a mad rush to get it done.

The solution?

Help your organization to establish the connection between top priorities of the business and the tasks that hardworking employees carry out day after day.

A master at translating the complex into simple steps, Art Weeast developed a method for creating this connection. He calls it an Operational Map. To build your Operational Map you will:

  • Interview the Business Owner and document Primary Functions and Sub-functions from her perspective
  • Prepare List of Procedures for each Process Owner’s Area
  • Create a visual representation of Functions and their related Sub-functions
  • Map Procedures to related Sub-Function by playing “Operational Bingo” with Process Owners—you hold and call out the Procedures while she identifies the related Sub-function.
  • Validate the mapping with the Business Owner.

The result?

  • Executives come down to a level that they rarely visit—they better understand what it takes to get things done! They begin to appreciate the value—and the NECESSITY—of the documentation in a more highly regulated and complex world.
  • Process Owners (the everyday do-ers) appreciate the collaboration with executives. They sense the tone from the top and the priority becomes clear. The do-ers begin to understand the bigger picture—the risks that the organization faces and the importance of what they’re being asked to do. And they are very curious about what other departments do!

The final problem we aim to address: Breakdown in cross-functional processes.

Frustrations build in an organization when communication and collaboration breaks down or does not exist among certain parties. You can tell this is happening when you or others can easily blame someone for inadequate, inconsistent or untimely inputs into your process—or others who put disruptive demands on you to produce an output with a nearly impossible delivery date and provide inadequate information needed to meet the demand. It is natural for all of us to personalize the process under these circumstances.

The art of establishing collaboration among cross-functional parties can be reduced to four main steps. The following steps serve to “de-personalize” the process and issues, and allow parties to focus on the desired end result.

  1. Meeting: Bring functional representatives together for a collaborative process review mediated by a neutral party.
  2. Current state: Have them describe the standard process; first without the history, exceptions or problems. Then revisit the standard process with issues.
  3. Future state: What does it look like? How is it better?
  4. Transition state: Outline steps to get from where we are today to where we need to be.

Think about what’s happening here. Typically, if anyone ever does dare to address the communication breakdown among parties, what do they typically do? They work to identify the issue(s) and to problem solve against those issues. The process outlined by Mr. Weeast, an expert in operational and change management, takes an opposite approach; helping parties to very quickly begin working together effectively.

Applying these practices outlined by Art Weeast results in an efficient and effective organization that can:


Art Weeast has decades of impressive experience in enterprise-wide leadership, technology & data expertise, Lean Six Sigma methodologies, organizational change management, and in defining and refining operational processes. Art has been a client of policyIQ with three different organizations. When I met Art, I had been involved in the work of streamlining, refining, re-engineering, and automating processes for many years, myself, and—while it was my responsibility and mission to help him in any way that I could to solve his organization’s business problems using our software—I was forever changed by what he taught me!

This post was originally shared following a policyIQ-sponsored webinar in which Mr. Weeast shared his Process Intelligence practices. The policyIQ team continues to share the lessons of his Process Intelligence session year after year. If you’re interested in more information or hands-on support with applying Mr. Weeast’s methodology, reach out to us and we’ll connect you with the appropriate tools, information, and resources!

Support@policyIQ.com, 866.753.1231

Policies Provide Foundation through Changing Regulatory Environment

Regulatory environments are constantly changing, influenced by economic, political and environmental factors beyond your company’s control.  It might seem like a daily battle to deal with the push and pull of complying with changing regulations.  So how do you stay focused, prepared and sane in the world of regulatory compliance?

One critical step is to ensure that you have well documented, well communicated and well understood corporate policies.  

Policies provide the foundation, governing the way in which your employees will work and how they will meet new regulatory requirements.  When the foundation is strong, with clear policies that are followed and enforced consistently, additional external expectations and requirements are much easier to incorporate.  

Here are just a few best practices to consider:

  1. Ensure that policies are written clearly.  Avoid company jargon or acronyms that may be unclear to new employees or external regulators.

  2. Make policies easily accessible to all employees.  If you are already using policyIQ, ensure that a policyIQ link is posted or communicated regularly.

  3. Clarify whether any exceptions might be approved to the policy, and communicate the process for approval for exceptions.  If it is not clear, employees may be more likely to decide it will be easier to ask for forgiveness than permission.

  4. Document how policy violations will be addressed or how policies will be enforced.

  5. Revisit, review and revised policies regularly.  Do not allow policies to become outdated or appear to be outdated.  Even if no changes are made, regularly note that content has been reviewed, so that employees

  6. Map policies to your regulatory requirements or other compliance programs.  As regulations change, you can more easily identify any changes that must be made in your policies to address those changes.  

What other best practices would you highlight for a clear corporate policy platform?  Add yours in the comments and share ideas! Learn more about how to utilize policyIQ’s various read-only options by checking out a recent blog post by policyIQ Product Manager, Travis Whalen.

Our policies have been created…now what?

Many organizations have used policyIQ for their Policy Management needs, and each client of ours has their own unique needs and for providing transparent and accessible policies to their users, public website, auditors, or other audience type.  However, the process is largely the same, regardless of the unique needs.

In nearly all cases, the policy content is created in policyIQ, reviewed, approved, and then published.  Making that content available is where the differences come in to play.  There are a few options for doing so:

A shared, Read-only account:

Create a Read-only user account in your policyIQ site (which is free, by the way), and apply the Read-only account as a viewer only on all applicable pages in your site.  Be sure to make sure that this account also has view access to the necessary folders, as well.

Then, share the Read-only account credentials with your user base.  Once logged in, the policyIQ view this user will have is a scaled down look – just folders and policy content, in this case.  Because the very nature of the account is Read-only, there is minimal risk in sharing the credentials with a large group of people.

A shared, Read-only account accessed via policyIQ Reader:

A similar process to the one above, but with a different look to the program and no login needs.

After creating the Read-only user profile and applying the user to security where necessary, edit the user profile.  Under the “required” tab of the Edit User window, scroll to the bottom to find a unique link called “policyIQ Reader“.  This hyperlink can be placed anywhere you like: bookmarked in your browser, stored on your desktop, placed in a shared network drive, or even on your intranet.  Once a location is selected, anyone that clicks the link will gain instant, read-only access to your policyIQ site.  No login required, and the “reader” look – a straightforward, no nonsense look at content, which is displayed in the table area to the right instead of a separate window, as seen below.

pIQ_Reader

Individual Read-only accounts:

Create an individual Read-only account per-user, which allows for greater flexibility in terms of seeing policies that are applicable to certain divisions, but not others.  Perhaps your finance and accounting folks have policies and procedures that apply to them, but not to the vast majority of other employees.  Creating separate accounts for everyone ensures the user experience in the product is directly related to their role.

 Individual policies accessed from an outside source:

Some of our clients choose to have their policies accessed from their primary company website.  In this case, the policyIQ pass-through link is ideal: eliminate login needs, access individual policies, and don’t display the main policyIQ site from which the policies were created.  Instead, display only the pages themselves.

Create a primary Read-only user account, and again add it to the view security on all applicable pages.  Now, view a page of your choice that is published.  A the very bottom, the page ID sits, and contains a link.  Click the link to open a small window that contains the policyIQ Passthrough link .  Copy and paste this link to the destination of your choice.  Selecting this link from an outside source will open the policy page only, and not require a login to the system.

Next steps:

Did you know policyIQ also handles Policy Sign-offs, as well?  It’s a simple process at a minimal cost.  Add Standard Users to your site in bulk (50 to over 10,000+) to completely revamp the way your organization automates creating, approving and storing certifications and sign-offs.

Does something here sound like it might be right for you?  If so, let’s talk about it!  Scheduling a half hour with a policyIQ expert on our team is not only free of charge, but will pay dividends moving forward as the management of your processes becomes easier by the day.  Many adjustments to existing sites take minutes to change, and new sites are even simpler!  Contact us at Support@policyIQ.com or 412-263-3330 to begin.

 

ASC 606, can your contract review tool do this?

Spreadsheets, email, shared network drives…

…this is where most of our critical work starts! With the deadline to comply with the Revenue Recognition Standard now in our sights, many of your corporate accounting peers have met the harsh reality that these commonly used tools are not meeting their contract review needs. Disconnected spreadsheets do not keep their reviewers in-step with each other’s developments. They are habitually shared via insecure channels and we often find, even with the best of intensions and development, breakfreelists, formulas, and formatting within a spreadsheet can be compromised resulting in an unreliable tool. Aggregation of data for analysis and consolidation of conclusions for management review are nearly impossible feats with dozens (or, certainly, thousands) of manual spreadsheets.

For those of you who are relatively new to the policyIQ community, you might not have heard that policyIQ has been a constant in the RGP toolbox, serving to solve our clients’ problems for nearly 15 years.  We don’t make commission on software sales and are not incentivized to upsell you or to sell you a new tool or module. In fact, we work hard to make it possible to serve all areas of your business within one platform—we don’t have extra modules to sell you!

The flexibility of policyIQ to be easily customized for various initiatives has made it possible for our clients to hit the ground running in applying our web-based technology to their pressing Revenue Recognition needs.

A company may utilize policyIQ for the full contract cycle or simply as a contract repository, centralizing access and simplifying assignment of contracts to reviewers for ASC 606 analysis. In addition to guiding the reviewer through the 5 Steps outlined in ASC 606 required for each detailed review of contracts that are in scope, policyIQ also provides a place to document evidence of the reviewer’s considerations and tools to leverage that information for necessary analysis. Key conclusions from each step are automatically pulled out into a summary. Reviewers add final notes to the summary and systematically route all related content for review and approval, as desired and customized for each client.

piq_benefitsforrevrecThe ability to report on results of contract reviews in aggregate gives way to analyses not possible in spreadsheets. Look across all Performance Obligations by Revenue Stream, Geography, Business Division, Over Time vs Point in Time, Sales Channel, or Reviewer, for example. Reports also aid in the management of contract reviews—in the assessment phase and with ongoing reviews. Report on issues as they are being identified, assignment of contract reviews, progress of reviews, and impact of the standard on various divisions or revenue streams. Use reports to easily identify those contracts that warrant follow-up action.

plansforleasesWe delivered many new features in 2016 and some were developed specifically to sharpen the Revenue Recognition solution. We are wrapping up another release for spring and have an impressive road map that will go into development while the spring release is undergoing formal testing. And did you hear that upgrades are included free-of-charge?

We’re here to serve and grow with you.

Can you say that about your Revenue Recognition tool? Reach out to schedule a tour of policyIQ’s capabilities for ASC 606, compliance, audit, policy management or your other pressing information management needs!

15 minutes might save you money on your car insurance, but just 2 minutes can save you time on audit testing!

Auditors and testing teams have been asking for an even easier way to view information about the associated Control or Procedure that they are testing.  Rather than having two screens open side by side in policyIQ, auditors would prefer to see critical details about the control that they are testing right there on their test screen.

Now you can make that happen – with NO DUPLICATION OF DATA!  And it literally takes less than 2 minutes, with no additional data entry required.

linkedfields

How?  If you are a Site Administrator, you need just 2 minutes, I promise!

On your Test page template, simply add a new field and select “Linked Field” as the field type.  Select the field that should be linked from another page template, save it and VOILA!

If you’ve added the Control Description field from the Control template, for example, you’ll automatically see the Control Description displayed on a Test page for any Control that is linked to it.  If there are multiple controls linked to a single Test, you’ll see multiple Control Descriptions, identified by the page name.

This function does not apply to audit testing alone!  Consider these other ideas:

  • Pull vendor information into a Contract page.
  • Bring risk descriptions to Control pages.
  • Create Process pages that pull in linked Control Descriptions.
  • Pull project task descriptions into Action Items.
  • Bring issue details into a Remediation Plan.

Want more information?  Contact us at support@policyIQ.com.