Creating a Proactive culture
- 1. 0
- 2. 1 Changing the compliance paradigm by creating a proactive culture Breakout B04 Sajeev Malaveetil, Partner, Ernst & Young LLP Andy Artz, Principal, Ernst & Young LLP Karl Fultz, Manager, Ernst & Young LLP December 4, 2017 1:30 pm – 2:45 pm 1
- 3. 2 Disclaimer This presentation is for informational purposes only and does not constitute legal advice. For legal advice on any issue, you should consult with an attorney. The views expressed by the presenters are not necessarily those of Ernst & Young LLP (EY) or other members of the global EY organization.
- 4. 3 Agenda • Contract ecosystem • Classifying proactive traits • Path to proactive • Potential traps • Defining success
- 5. 4 Contract ecosystem Debt and financing Customer contracts Joint ventures Royalties Contingent labor Suppliers IT services • Revenue driver • Controls have significant impact • Pressure to decrease compliance costs • Time, resources, skillsets and culture major compliance factors
- 6. 5 Classifying proactive traits Reactive Action by exception External oversight Legacy methods Compliance as a cost Proactive Exception seeking Self-governance Ongoing improvement Compliance as value
- 7. 6 Path to proactive • Start small • Change at the team or department level is often easier • Starting with less intrusive actions creates more buy-in • Integrating areas of overlapping controls and monitoring
- 8. 7 Path to proactive • Incentivize disclosure • Recurring self-assessments • Data analytics • Third parties can re-enforce known risks
- 9. 8 Path to proactive – integrating controls • Example: government contract controls • Both the Federal Acquisition Regulation (FAR) and “normal” financial controls attempt to achieve a strong control environment with active controls and monitoring in place • Many risks and controls from government contract requirements have overlapping traits and objectives with existing control frameworks
- 10. 9 Path to proactive Other areas of common controls Estimates at completion Export controls Service Contract Act Cybersecurity Labor qualifications Small business subcontracting Labor laws
- 11. 10 Path to proactive – incentivize disclosure • Common monitoring activities may apply risk ratings, metrics, re-audits, or mandatory remediation when errors are found • Alternative approaches • Pre-tests to identify risks or errors prior to full assessment • Provide period for self-correction • Incorporate operational and compliance components • Selective use of metrics may be useful. • Reward transparency and promote accountability
- 12. 11 Path to proactive – self assessments • Allow early identification of potential risks • Decrease internal audit and consulting costs • Increased internal audit efficiencies • Provide baseline for external consultants • Integrate operations and compliance • May reduce external oversight activity (e.g., government)
- 13. 12 Path to proactive – data analytics • Enables real-time, continuous monitoring and risk assessment • Cost effective, customizable and adaptable • Improves enterprise-wide knowledge sharing
- 14. 13 Path to proactive – third parties • Some key risks are often known by process owners • Improvement may require capital investments, additional resources, or other significant changes • Using third party input (e.g., internal audit, quality assurance, consultants, etc.) may re-enforce importance of change • Independent confirmation of potential issues • Objective solutions to remediation
- 15. 14 Potential traps Ineffective training Overuse of metrics Revised templates and forms as single solution Adding controls at the expense of operations Meetings do not always equal results Waiting for too much buy-in / seeking consensus STOP STOP STOP STOP STOP STOP
- 16. 15 Defining success • Embedding compliance requirements into control framework • Inter-organizational knowledge sharing • Improved understanding of internal and external practices and performance • Vendor improvement and optimization • Singular internal control repository • Enterprise-wide risk profile • Appropriate metrics or dashboards
- 17. 16 Contact information Sajeev Malaveetil, Partner sajeev.malaveetil@ey.com +1 703 747 1248 Andy Artz, Principal andrew.artz@ey.com +1 703 747 1480 Karl Fultz, Manager karl.fultz@ey.com +1 214 969 8121