7 Features to Boost Efficiency in Your Daily Work

In case you were out enjoying your summer and missed announcements on the latest policyIQ release, we’re here to share the highlights! The theme of policyIQ’s version 7.9 is Convenience. We rolled out 7 features that help to boost efficiency in the flow of your daily work.

  1. Navigation continues to get easier and faster! Save time by leveraging “Favorite Folders” to lift your critical work to the top of the list.
  2. Is yours one of the organizations that uses policyIQ primarily for Account Reconciliations, 302 Certifications, or Policy Sign-offs? Perhaps you’d like to have Form Management as your top navigation option? Site Administrators, you can highlight your prioritized activities that your organization engages in most by reordering items in the left navigation pane.
  3. Paste content into policyIQ from a range of other document and file types and retain your formatting with this upgraded HTML/Rich Text Editor.
  4. Perform calculations on multiple figures originating in related content (Calculated Linked Fields). This allows you to perform activities like determining cumulative risk calculations and arriving at the sum of Standalone Selling Prices for each Performance Obligation linked to the contract.  The flexibility of policyIQ to provide more custom solutions for a wide range of business initiatives just got a boost with this feature!
  5. Approvers – we’re thinking of you.
    1. Some people rely on email to keep them apprised when their attention is needed and others loathe the ever-growing number of items in their inbox. Now, policyIQ lets you decide which approvers in the approval string will be automatically notified via email when items have been submitted for their review.
    2. Prior to this release, an individual could only occupy one step in the approval process. It was not historically possible to approve, pass the content to other approvers, and then bring it back around for final approval. If a process requires the same person to step in multiple times, policyIQ now supports that process.
  6. Rolling forward just got easier! If your organization likes to leverage the previous period’s tests rather than starting from blank templates, you can accomplish roll forward in fewer steps with the ability to Remove Attachments in Bulk.
  7. Take advantage of the flexibility of policyIQ! Changes in process, regulation, org structure, or responsibilities might lead to the need for adjustments to solutions and templates. Solution designers (policyIQ administrators) will be happy to learn that it is now possible to copy fields from one template to another, making it easier to leverage the work of previous solutions for new or improved solutions.

Would you like some help taking advantage of features that were rolled out after your original configuration (from this summer’s release or past releases)? Contact us and we’ll be happy to walk you through the steps!

5 Steps to a More Efficient Internal Control Environment

Is your team overwhelmed with activities that feel unnecessary?

How confident are you that the energy spent on testing is focused on the necessary controls?

Leverage policyIQ to systematically focus on the critical controls for management and testing. More efficiently analyze which Financial Statement Assertions, relative to each of your 10K line items, are adequately controlled, which are left vulnerable and which of your relevant assertions is over-controlled! See, plainly, the gaps in your coverage and leverage the evidence to justify the reduction of waste, and plan to concentrate effort on work that matters.

This process really starts with your risk assessment. If you have not leveraged policyIQ to bring automation and reliability to your risk assessment process and want to walk through the policyIQ solution (including the just-released feature that makes cumulative risk calculations possible), reach out to schedule a free working meeting with us! After completing your risk assessment, identifying significant accounts and relevant assertions, and determining which of your processes and objectives are in scope (all steps that can be managed in policyIQ), you can begin the process of rationalizing your controls.

Next, leverage policyIQ to move through these five Control Rationalization steps:

Each step is made more efficient with policyIQ. We can support you to customize templates for the attributes that are critical and unique to your organization. The import, linking, calculations, workflow, and reporting features will allow you to more quickly examine the effectiveness and priority of your procedures. Having confidence in your Control Rationalization process and your internal control environment then allows you to come full circle to look at the bank of risks that you previously identified. You might conclude that some process risks that have consumed time and attention for years are actually not in scope. This Control Rationalization process will help you to be more effective and more efficient through each testing cycle.

Would you like to see sample templates and schedule a working meeting to get the ball rolling? Contact us and reap the benefits by your next testing cycle!

Not all roads lead to successful IPO

Welcome guest blogger, Jason Chiang. With RGP for nearly 8 years, Mr. Chiang has more than 20 years of experience and expertise in Audit, Risk and Compliance. He has consulted with a range of companies from financial services, biotech, manufacturing, healthcare and other industries. Mr. Chiang is a Certified Public Accountant (inactive) and Certified Internal Auditor. He has served on both sides of the house as a senior audit manager and senior auditor as well as a risk manager. It is evident that he understands the motivations and hurdles facing these organizations and approaches their complex issues with integrity and professionalism.

The following article was written by Jason Chiang (with editing support from Stephenie Buehrle). The approach and recommendations are his.


Not all roads lead to successful IPO

When a company approaches their initial public offering (IPO), it enters a very different arena. Having access to public funds, that is the retirement savings of Main Street USA, the company must meet quarterly SEC filing requirements. This is a significant amount of work. An investment in the people experienced with technical accounting, SEC financial reporting, and Sarbanes Oxley Compliance (SOX) evaluations combined with an investment in systems and tools to do the work efficiently and with completeness and accuracy is crucial to meet the filing deadlines.

One cannot audit all internal controls over financial reporting (ICFR). Thus, performing a SOX risk assessment is necessary to identify the significant accounts and their relevant assertions. If you happen to be one of these companies developing a road-map to your IPO, SOX may not be the place where you want to focus significant time and financial resources, but you realize that it has to get done. Be sure that you consider, at minimum, these critical components:

Risk Assessment                                  

A risk assessment is the process of identifying significant accounts and disclosures and their respective relevant assertions as they relate to financial statements. A properly done risk assessment will allow the company work smart by focusing its internal controls evaluation on the areas where there is a possibility of a material error.

The Risk Assessment must include:

  • Quantitative factors such as account balance, frequency of transactions, dollar value of each transaction; and
  • Qualitative factors such as complexity of related transactions, subjectivity of accounting rules over related transactions, and fraud considerations.
  • As business and risks change, the risk assessment needs to be updated.

Narrative                                                                

A narrative provides mid-level detail of the transactions and internal controls within a business process and includes who, how frequent, and in what location the transactions and controls are being performed. The initial creation of narratives provides the process owners an opportunity to revisit and reflect on the current processes, and make improvements for operational efficiency or control effectiveness. It is a written document that can be read by internal employees, internal auditors, and external consultants and auditors to gain a preliminary understanding of the process. As processes change, the narrative provides a format to document the change.

What critical things must be considered regarding Narratives?

  • The narrative should be written knowing that auditors will be a primary reader and will be looking for controls that mitigate risks.
  • When describing management review processes in the narrative, articulating how the manager gains assurance of the completeness and accuracy of the supporting evidence before signing off. If the manager is using judgment, describing the factors considered.
  • Narratives should be updated as changes are implemented in the organization. The updates should follow a workflow where there is a review process for significant changes.

Control Matrix                                      

A control matrix lists the controls the company has identified to mitigate risks. The control matrix serves as evidence that identified risks are mapped to controls which are to be evaluated for management’s assessment of internal controls. The control matrix also is a primary client document auditors leverage to perform their independent test of controls.

Take care to ensure that:

  • The controls in the Controls Matrix are mapped to risks.
  • The Controls Matrix is in a format where it is sortable or reportable by controls mapped to risks for test of controls purposes, and risks are mapped to controls for an evaluation whether risks are mitigated by controls.
  • Controls in the Controls Matrix should be labeled and provided an abbreviated title (10 words max) for ease of reporting and reference purposes.

Testing                                                                      

Testing is the evaluation of design and operating effectiveness of the company’s controls. The results of testing of controls provide company management with a baseline to that might have impacts to strategic and operational decisions. For publicly held companies, testing is an SEC requirement.

Critical considerations for testing:

  • Important, if deemed necessary, to be able to re-perform the actual control performed by the employee (e.g. for 3-way match of purchase order, invoice, and shipping docs, test that an employee had performed this and has evidence of such, rather than the auditor requesting the 3 docs and testing oneself).
  • When testing management review controls, cannot just accept sign-off, but need to understand the steps and judgments used by the manager, and test accordingly.
  • The documentation of testing should allow someone else to reasonably re-perform the testing. If testing is being relied upon by external auditors, then the breadth of documentation is more important. If not, not all needs to be retained, but should be readily retrievable when needed.

Certifications                                        

Control owners certify to the CFO and CEO that controls are operating effectively on a quarterly basis, and if not operating effectively, the remedial action plans. The control owners are held directly accountable for their controls as they are certifying to the top two officers of the company.

Recommendations for certifications:

  • The number and level of person certifying to the CFO and CEO should be carefully considered. The level should be their direct reports and one level removed to maintain the efficiency and integrity of the certification. If it is a larger organization, there can also be sub-certifications up to the senior manager level.
  • The certification questions should have a combination of checklist questions, as well as, open ended questions to encourage a thoughtful process.
  • Utilizing software for tracking, follow-up, and retention purposes is advised.

Depending on the number of people involved with the inputs into the various components, one might decide that performing and capturing the work in Excel is sufficient, while others might prefer utilizing a SOX tool where there are extra protections in version control while allowing multiple users to perform inputs simultaneously in multiple locations. A SOX tool may also provide management with options for review, analysis and oversight that are not available in Excel.

To avoid unexpected setbacks, be sure to plan enough time into your IPO readiness map for SOX evaluations. The initial SOX program development and implementation is likely to require six months and can vary depending on your access to subject matter experts. Coordination and alignment of the SOX efforts and objectives among the audit committee, senior management, process owners, and internal and external auditors is paramount for a successful implementation.


If your organization is approaching your initial public offering and you’re interested in learning more about how RGP can support you with subject matter expertise and a tailored technology solution to help ensure that you are prepared for your SEC filing and financial reporting requirements, reach out to us (Information@policyIQ.com, 412.263.3330) and we’ll connect you with our RGP colleagues near you!

RGP engaged with audit professionals in Orlando


The policyIQ team joined our RGP colleagues at the Institute of Internal Auditors’ 2017 General Audit Management (GAM) Conference in Orlando, Florida on March 20th-22nd. Once again, this was a great event packed with learning and networking opportunities!

Representatives from RGP included:

The conference was attended by more than a thousand audit professionals and we were only able to speak to about 200 of them. If we didn’t get to have a conversation with you, here’s what might have transpired had we connected:


The conference sessions inspired some great discussions!

We carried on the conversations started by the keynote speakers and others. We talked about the hats that auditors are asked to wear, the importance of the internal audit function and profession, and the value of independence, maintaining integrity and having the courage to do the right thing against, sometimes, great personal risk. With integrity being among the core values at RGP and 20+ years’ experience serving as a professional services firm in this field, we are charged by discussions in this vein and by the opportunity to encourage our clients and peers in the audit profession.

We talked about how the times have changed. Once upon a time, we recognized that not all companies were performing regular risk assessments and we were encouraging them to get started with annual risk assessments. In the last few years, we see that the demands of business, technology, competition, culture and so many more are requiring companies to be more nimble and to both assess and respond to risk on a continuous basis. We participated in discussions around what it takes to be prepared and resilient in these times and how RGP’s Data Solutions practice can help companies to better collect, manage, secure and leverage their data.

Cyber security was a hot topic again this year! We discussed the struggles that some companies experience in identifying and developing the necessary expertise to address the present and growing need to address cyber security. We heard that companies are looking across various functions to address their security concerns. RGP’s maturity in integrated solutions, leveraging expertise across information security, audit, data solutions, process improvement (and more) allows us to be responsive, provide a high quality service and to tailor comprehensive solutions to each client’s needs.


We shared our story…how RGP and policyIQ stand out from the pack.

Another theme in our conversations with other professionals at GAM: how RGP is different. There’s certainly no shortage of consulting firms and technology providers at these things, right? The vendor hall can be a little bit intimidating for the introverts among us. At the RGP booth and throughout the conference, we worked to jump quickly to how we at RGP and our GRC Technology are different from most others.

Our consultants have 10-20 years’ experience. They are true subject matter experts who can lead your initiative or project and work alongside your team with valuable knowledge to share and teach. Rather than the checklist approach, our consultants build tailored solutions and collaborative partnerships. Remember the mention of integrity being a core value? We have a track record of long-term, trusted partnerships, evidenced by a 100% retention rate of our top 50 clients.

RGP also has 70+ offices around the globe—these are our offices, not affiliates. This means our people, our culture, and our standards; therefore, we deliver consistently high quality results worldwide.

And our GRC technology, policyIQ, packs a powerful punch in a nimble and affordable, centrally accessible platform. We serve companies from risk assessment through compliance initiatives, testing, reporting of findings and remediation like many other enterprise GRC tools. We also provide solutions for ASC 606 contract review, lease data capture, contract administration, policy management, automation of evidence request and collection, 302 certifications, legal and data room, support for integration with mergers and acquisitions, account reconciliation management and many more ALL IN ONE TOOL. It’s a matter of security configuration (part of the information governance planning that we guide you through as a matter of course at no additional charge). People find it amazing that they can do so much in one easy to use tool.

What’s more, a solution or initiative can be implemented in policyIQ in 4-6 weeks—not months or years, like most other products. And policyIQ is so easy to setup and use that NO IT RESOURCES ARE REQUIRED. We like to include and engage IT in the early conversations because a company can better leverage policyIQ for various departments and initiatives when the IT department includes it among their suite of solutions for their stakeholders. (Pssst—it saves time and money for IT departments, too!)


Next year, we’re going to have the biggest booth and the loudest parties!

Just kidding. You know, I often start off feeling a little bit small at these huge conferences. We don’t have the biggest booth or the most extravagant events to woo attendees to come and visit with us. (Although we heard from a bunch of folks that we did have the best swag this year with our super cool phone charger pens.)

Still, every year, I leave energized!

We deliver excellence! We have amazing clients and valuable partnerships and we build on them every year. I don’t have to feel pressure to be bigger and flashier to land sales. The truth of who we are and what we have to offer at RGP holds tremendous value, builds solid relationships and is a great story to share.

If we didn’t get to shake hands at GAM or elsewhere, yet, and you’d like to hear the good news first-hand, please reach out to any of us. We’d love to buy you a cup of coffee and learn about your business issues that we’ll help to remedy.

 

 

Talking about Audit Efficiency in Atlanta (TAC 2016)

RGP and the policyIQ team were honored to be invited to speak at the Atlanta chapter of the Institute of Internal Auditors (IIA)’s conference, held on Friday, September 16.

policyIQ’s Managing Director, Chris Burd, tackled the topic of “Ways that Technology Can Expedite Internal Audit’s Daily Work”.  With attendance for the session well over 200, the topic was clearly one that generated a lot of interest.

An unscientific “show of hands” poll of the audience found that only about half of the attendees currently utilize a software application that is designed for Internal Audit or Governance, Risk and Compliance programs.  For those not utilizing an application, the session generated a number of ideas and stressed the value of having a tool to expedite and streamline the process.

For those that do use an internal audit application, however, the conversation also allowed the attendees to ask and offer suggestions to others of ways to improve their current audit work.  The discussion followed the following steps in the Audit Cycle:

auditcycle

Two specific areas that were called out as areas of interest by the attendees were the work of Evidence Collection and that of Issue Tracking.

Evidence Collection

In evidence collection, we talked about ways to automate the evidence collection process, as well as some of the challenges of doing so.   While a fully automated evidence collection process is the ideal end goal, the discussion touched on making sure that you also provide the right amount of training and oversight to those individuals participating in the process, to alleviate stress of a new process and minimize the risk of invalid evidence submission.

Issue Management

The topic of issue management focused primarily on the idea that issues are most effectively managed when they can be easily linked to the audit testing, controls, processes, or risks from which they originated.  Having a central system to manage risk assessments, internal controls and procedures, audit testing and issues allows for this flow of information.

 Looking for Technology that is Simple to Use and Implement!

As a sponsor, RGP was also able to meet with attendees as they stopped by to say hello.  Folks that stopped by to talk about technology almost invariably said the same thing – they wanted to find software that was easy to use and easy to implement.  Long and costly implementations caused many to simply continue doing things in the same Microsoft Office tools that they have always used.

Do you want to learn more about how to make your internal audit team more efficient and effective?  Contact us today and we’d be happy to meet to talk about some of the specific ideas and how policyIQ can meet those needs!