GRC effectiveness in ERP implementations

The risks of waiting to address GRC requirements are clear. But how early in the ERP system implementation process is early enough to begin thinking about governance, risk, and controls? A controls mindset should underly the project from the outset.

ERP leading practices call for a close collaboration between company IT and business leaders. The old days—when IT ran the show with minimal consultation with businesses—should be relegated to the dustbin of ERP history. Again, finance and accounting staff, along with system controls, must be included from the beginning and at every phase of the ERP project. If the company lacks staff who understand both the systems and internal controls, consider including external resources with those capabilities as well.

Another potential key to success for any ERP system implementation is striving towards governance, risk, and control requirements as primary focuses of the system design phase. Addressing GRC requirements in the design phase should include determining how system controls will support accounting and compliance standards, such as the implementation of ASC Topic 606, Revenue Recognition.

The design phase should also focus on an effective way to standardize business processes and the system’s data structure. This phase should also address how central processes, such as procurement, expense, and capital expenditure procedures that have direct impact on accounting records, should be designed to support compliance with the relevant accounting and reporting standards.

The design and implementation of external financial reporting controls should not be an afterthought. Internal controls over financial reporting (ICFR) should have a workstream from the beginning of the project. The idea of increasing efficiency in the financial reporting and disclosures process needs to be part of the initial planning and design phases so missed opportunity is unlikely.

Business process redesign is essential to an effective implementation of GRC processes. GRC implementation should be an opportunity for true transformation of current processes. It is common, however, for long-standing institutional practices to cloud underlying regulatory requirements. As a result, legacy practices are frequently reimplemented in new systems in the name of compliance.

Moving inadequate legacy processes to the new ERP environment will produce substandard results. That’s why it’s important to take the opportunity to modernize the control structure. As you modernize, consider opportunities to automate manual processes and calculations that may mitigate risks, including financial, operational, regulatory, and strategic risks.

Governance, risk, and control process implementation typically focuses on the new financial and reporting environment. But let’s not forget that GRC needs to apply equally to the implementation process as well as the end system. This means understanding that there are controls around implementation itself as well as accounting and reporting operations. It is important to pay attention to both control environments. Controls around the implementation process should include managing the cutover of data, reconciling complete and accurate production against source data from the old system.