ACE your controls
The automate phase of the ACE methodology first involves improving the utility of existing IT tools and systems, where applicable. As mentioned, many companies fail to get the most “bang for their buck” when it comes to existing controls-related technology.
Newer technology, such as RPA and advanced analytics, can also play a major role in improving controls automation. These tools use bots to regularly analyze and test the controls environment. Auditors then examine the results and manage only the exceptions, as needed. With this advanced technology, companies create an environment of continuous, automated testing — instead of a labor-intensive, manual one.
The overarching goal of the centralize phase is to harmonize and align the disparate, decentralized set of controls that many companies have accumulated over time. Controls at fast-growing companies, in particular, can become decentralized quickly.
When centralizing, companies identify common controls developed in multiple organizational silos and then shift them to a central execution point, such as a shared services center. As they eliminate these redundancies, companies are better able to harmonize governance, risk and compliance functions.
The eliminate phase of ACE involves identifying and removing redundant controls and those that are no longer relevant to the business. Given constant waves of new regulation, certain controls can become outdated quickly and are ideal candidates for elimination. Another trigger during this phase can be to evaluate whether existing management review controls can be tested at a precise enough level that will allow management to designate some of the transaction-level controls as “non-key.”