EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
How EY can Help
-
Discover how EY's risk consulting team can help your organization embrace disruption and turn risk into a competitive advantage.
Read more -
Discover EY's technology sector insights & services and learn how our teams can help your business improve organizational and operational effectiveness.
Read more
Excellence in Process and Controls
Operational risk refers to the risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events. The semiconductor industry is highly complex and sensitive to operational risks due to its reliance on precision manufacturing, sophisticated technology and the global nature of its supply chains. The many single-to-limited source dependencies mean that individual risks could become choke points in the entire supply chain that could cause shortages in the supply of critical materials and components. For example, material contamination has struck several of the large chip manufacturers in the past few years, causing entire production batches to be worthless. The automotive chip supply in 2021 was hit when electricity outages due to a winter storm halted production at one competitor, while another competitor experienced a factory fire. The number of incidents is likely to increase as the sector grows and companies are looking to include alternative suppliers, while the potential costs of failure increase as the feature sizes get smaller and the technologies become more sophisticated.
To manage these risks, companies must refine their business processes and controls to support exponential growth without relying on additional human resources. Across industries, we often see that companies are not maintaining and continuously reviewing their process and controls design against best practice. During periods of increased demand, companies often add human resources to scale up, while control incidents increase due to human error.
Companies in the semiconductor sector should now invest in the evaluation of their processes and controls to identify opportunities for simplification, standardization and automation, preparing their capabilities for handling larger volumes without adding human resources.
There are currently two other regulatory drivers which companies should leverage:
- The inclusion of provisions relating to the risk management statement in the Dutch Corporate Governance Code. The statement should provide insight into how an organization manages its operational processes and prepares for potential challenges, so that it can achieve its objectives.
- The EU Corporate Sustainability Reporting Directive (CSRD) requires Audit Committees to monitor the internal quality control and risk management systems regarding sustainability reporting. Many companies are aiming to complete the design of this control framework, initially aiming at limited assurance while targeting reasonable assurance towards 2028 when the EU likely requires this level of assurance from the external auditors. However, the limited versus reasonable assurance debate applies to the opinion of the external auditors. Company directors are already being held accountable for the reliability of both financial and non-financial information disclosed in the annual report. Any material misstatement will lead to reputational damage, legal consequences and loss of investor confidence. Hence, companies should manage this reputational risk by aiming for an internal controls framework that provides reasonable assurance to protect its company directors now, rather than meeting a compliance requirement towards the external auditors in 2028.
While building on the momentum of these two additional drivers companies should also take the opportunity to integrate internal control efforts. Many companies still have separate control frameworks for SOX404, operational controls and most recently for controls over ESG reporting. This siloed approach originated from the time when SOX404 controls were introduced, implying that they have a single purpose.
However, we now recognize that many controls serve multiple objectives. For example, materials inventory tracking and reconciliations are critical for revenue recognition (SOX404) but also to meet industry-specific regulations, such as the Restriction of Hazardous Substances (RoHS) and Registration, Evaluation, Authorisation, and Restriction of Chemicals (REACH). Additionally, these controls aid operational purposes in effective production planning and scheduling, which is critical in the semiconductor industry where production cycles are complex and time-sensitive.