Embedded into core systems:When compliance is embedded rather
than bolted on, it enforces policies at the point of access and the point
of transaction.
Simultaneous control and monitoring:A well-designed automated
control offers both control and monitoring. In effect, testing is built in.
Further, automated controls can produce reports that serve as their
own documentation. All of this makes an auditor’s job easier.Automatic evidence:Automated controls produce evidence on the fly,
in audit trails and transaction logs.
Death of the sample:Some processes benefit from having every transac-
tion analyzed, instead of just a sampling. Some precarious patterns and
trends only reveal themselves when alltransactions of a particular type
are scrutinized.Ripple effect:The operational benefits to implementing controls extend
beyond financial compliance. Companies can use the principles of gover-
nance, risk, and compliance to improve all business processes by intro-
ducing transactional, master data, and configurable controls to help
monitor processes, and then improve them.Automated internal controls are like speed cameras; they catch every single
violation of a control instead of the occasional scofflaw. And like speed cam-
eras, they reduce effort — after you install speed cameras on a highway or
residential street, police officers don’t have to sit around with radar guns
looking for cars going over the speed limit, pulling them over, and writing
tickets. Figure 7-1 illustrates the reduced effort and increased efficiency of
automated controls.Figure 7-1:
Automated
controls are
far more
efficient and
effective.