Last week I attended a conference on governance, risk and compliance that was in part organized by SAP. It was an illuminating experience about which I will write more later. Sadly, the general impression I came with was one of disappointment.
Two great sessions, one covering the business value of going ‘green,’ the other dealing with corruption were poorly attended. I don’t understand why this should be so. On the one hand there is a great deal of attention being paid to green issues and we are starting to see public interest in the extent to which corruption in business impacts the lives of others. On the other hand, it is clear large companies are in the very early stages of understanding the concept of risk. Holly Roland, VP SAP global marketing made a telling point: “If you don’t have controls to track operational risk then you’re not in a position to know what risks you face,” the implication being that companies don’t have a strong grasp of the need to track risk.
In the same discussion, my colleague Vinnie Mirchandani said that he sees SAP as more closely aligned to transactions rather than the higher level risks that impact those transactions. Vinnie’s position opens up further discussion when taken in the context of recent events. Witness for example Prem Sikka’s dismay at the extent to which Big Four auditors are failing:
Why are we paying auditors millions of pounds in fees, especially as audit reports seem to have a shelf life of less than two weeks, and even auditors themselves apparently lack confidence in their own work?
Despite the rising financial gloom, auditors were silent on the subprime crisis. Now, in the middle of the credit crunch, they are found to have issued audit reports of little value.
Or what about Francine McKenna’s telling account on the lack of quality controls:
Go here for a podcast of the discussion. In it you’ll hear a panel describe how each of their umbrella firms does or doesn’t conduct inspections of affiliate firms all over the world (the Big 4 does, the next tier does or doesn’t depending and the next, next tier firms do not, depending on the local firms inspecting themselves and reporting back.)
Governance, risk and compliance can be a complex topic but if companies don’t have the support of their auditors who should – but apparently don’t – act as gatekeepers for even the most basic forms of business behaviour then to whom will industry turn?
I’ve suggested that while GRC looks complex, the broad issues are relatively simple to understand. I believe that software vendors like SAP are in a better position to start the action ball rolling than the auditors to whom they’d usually turn. That’s because they see the problems across multiple dimensions in ways that auditors cannot.
It’s clear that the Big Four have plenty of problems of their own to solve. Until they deal with their own quality credibility issues, it is difficult to see how they can hope to be seen as credible in offering GRC solutions or consultancy. SAP (and perhaps others) are not tainted in the same manner. That, combined with their ability to deploy hundreds of engineers to code the process issues makes them a solid candidate to get the job done. All they need is the confidence to find the right approach, something over which they’re currently debating internally.
loading...
loading...
