Future of Controls

Challenges and trends in Risk & Internal Controls in the Swiss Market

Challenges and trends in Risk & Internal Controls in the Swiss MarketDeloitte conducted interviews with over 70 senior executives on their internal control environment, current operating model and vision for the future. The survey included 22 public and private sector organisations, listed and unlisted companies representing the full range of Swiss regions, industries, and company sizes.

Our research shows Swiss organizations lack confidence in their risk and control environments, struggle to measure cost of controls and haven't captured control automation opportunities.

Future of Controls interview series

Our new Future of Controls interview series shares innovation experiences with other Swiss risk and control leaders, to inspire them exploring opportunities in their own organization. The experts share challenges and best practices in risk and controls innovation, discuss business value, and their vision to strengthening the Future of Controls leaders’ community.

Interview

Deloitte: How do you perceive the latest challenges and opportunities in the area of risk and controls?

Gopinath: Business risks and challenges are bigger than ever, but so too are the opportunities in the risk and controls space. I would say a key challenge for internal auditors is to gain the trust of the business management, by continually engaging with them and providing meaningful and timely assurance and advice. This challenge gets harder with the rapid and continuing emergence of new risks and chronic talent shortage, which creates a natural need and opportunity for us to put together innovative solutions.
 

Deloitte: Can you share an example of innovation in risk and controls and how it adds value for the business?

Gopinath: It is often a challenge to keep up with risks and engage with the business in depth, especially for teams with constant capacity constraints. Certain key activities such as periodic risk assessments, recertification of controls, communication of issues and insights from various automated tests of controls, could be launched digitally and integrated into the business through various collaboration tools and platforms. Obviously, such a set-up would require a lot of ground work in defining risks and the lifecycle of controls and workflows, making business data available for continuous testing, writing testing software, issuing risk response templates and, more importantly, investing time with the business in familiarising them with this digitalised approach. Such continuous assurance has resulted in the realisation of significant value through improvements in risk controls for our business.
 

Deloitte: In your opinion, how important is the alignment of internal controls with business priorities when driving transformation in controls?

Gopinath: Alignment with business priorities is crucial and quite fundamental for us. Misalignment between controls and the business could easily lead to lack of interest from the business, and could be disastrous for us if left unaddressed. It takes continuous effort to hit that resonant frequency of communicating and collaborating with business, and planned efforts should be an integral part of the engagement approach.

Deloitte: How do you convince leadership of the impact of innovation in control initiatives and get their buy-in?

Gopinath: There is always a proof of concept stage when embarking on innovation in an internal controls journey. Whether the concept is novel and has originated in-house or whether it has been proved already elsewhere in the industry, convincing business leaders about the value of such innovative concepts and winning buy-in from management on the potential impact of transformation initiatives is part of the innovation journey.
 

Deloitte: What is your view on innovation in internal audit? What advice would you offer to fellow risk and control professionals who are at the start of their innovation journey?

Gopinath: While there is pressure to implement emerging technologies in practice, the use of innovation must have a clear purpose, and should be very specific to your business operating model. It works better when you agree with the business upfront, and work together with business managers on identifying and solving problems that matter to them. For solving complex and bigger problems, it may help to start with a minimum viable approach, starting small and building up gradually, in order to realise positive results more quickly and build up trust with the business over time.

How Deloitte can help

There are three key levers that help increase the maturity of the internal controls environment and achieve the Future of Controls vision:

Where to start your Future of Controls journey?

The Future of Controls assessment allows you to measure the current and targeted maturity, setting out key journey activities. It includes measuring cost of controls and unrealized value to build the business case.

Where would you locate your company in the graph below?

A typical Future of Controls journey

The Future of Controls journey will vary from organisation to organisation based on the maturity of the controls environment, the level of regulatory compliance pressure they endure, and the specific industry trends they need to manage. However, irrespective of the level of maturity and transformation, the vision, mission, goals, and key levers we discuss can help organisations customise a controls road map that fits their specific business goals. To that extent, we have outlined a typical six-step road map for a successful Future of Controls journey.

To further explore the key themes and trends, and for more information about how Deloitte can help you succeed with your Future of Controls journey, please contact us.

Follow us

Our FoC campaign focuses on promoting continuous exchange and learning across organizations, and the FoC events are a good place to do that as they include case studies, deep-dive on specific topics with debate activities, and sector-wide roundtables.

Following successful webinar and on-site workshops in our Zurich and Geneva offices, we want to keep encouraging open discussion around internal controls, risk and compliance related topics and have created a LinkedIn group where leaders in risk and controls can communicate, share their experiences and challenges, and network with their peers.