How control test automation aids asset managers

Regardless of the industry, CTA can be a powerful tool for internal and external auditors who are testing the operating effectiveness of controls to support or gather evidence about the effectiveness of internal control over financial reporting (ICFR). Manual tests of these controls often are labor-intensive and rely upon sampling, while automated tools and techniques have the potential to reduce the need for repetitive human labor while extending testing to the entire population.

Within ICFR, the uses of CTA may vary widely based on industry. Take revenue recognition, for example. A company in an industry or sector with a subscription-based business model that recognizes revenue over time may have different CTA opportunities than a company with a point-in-time revenue model based on discrete individual sales.

Asset management firms are increasingly finding benefits from implementing CTA technology for internal control over financial reporting. Replacing manual efforts with automated control testing can reduce potential errors and lead to expedited closing for monthly, quarterly and yearly periods.

 “If they close the books faster, this can, in turn, lead to an earlier audit delivery date,” Patanella said.

Outside of ICFR, CTA can be implemented for controls over operations, reporting or compliance objectives. These CTA opportunities may also vary widely based on the industry.

All controls are not created equal with respect to CTA, as automated testing can be easier to implement for some controls than for others, such as those that are objective rather than subjective. It would be more straightforward to set up an automation that compares all vendor billings and reimbursements and sends an alert if the amount of a check sent to a vendor does not equal the amount billed on the invoice. It’s more difficult to create an automated test to tell you whether the amount on the invoice is reasonable considering the services the vendor provided. The best candidates for CTA often are controls with attributes that can be clearly defined, such as tolerances, distinct values or pass-fail conditions. These may include:

• Authorizations, approvals, verifications and controls over standing data.
• Segregation of duties.
• Certain general IT controls, such as authorization, provisioning, deprovisioning, privileged access and security configuration controls.

As with most automation efforts, CTA is only as good as the information it relies on. Whole-population testing is ineffective if the population is not complete or the input data is not accurate. When the information used is complete and accurate, a CTA can be run on large volumes of transactions or activities, quickly and with more precision.

This is one of the biggest benefits of CTA programs. If an organization sends tens of thousands of checks to vendors every year, CTA may be used to test that all of the checks match the amounts on the respective invoices and were approved based on the organization’s policies or procedures in a tiny fraction of the time it would take a human to test only a sample of such transactions. CTA is generally designed to extract information directly from existing systems or applications, further reducing human effort.

Nonetheless, human involvement in the form of strong governance is essential for developing and maintaining a CTA program and related IT environment that accomplishes the desired objectives. Responsibilities and accountabilities need to be established for designing, implementing and maintaining effective governance over the IT environment — including general IT controls — that will support a CTA program.

When CTA is being implemented, validation often requires test runs, with manual testing compared to CTA results to verify accuracy and consistency. Controls may need to be modified and CTAs recalibrated several times before automation is ready to be implemented.

Another critical role for humans in CTA implementation resides in the appropriate treatment of deviations and control failure rates. Leaders need to carefully determine an acceptable failure rate for a control or control objective to appropriately evaluate the results and conclude on operating effectiveness. In some cases — for example, a security access approval — that acceptable failure rate may be zero.

Many times, though, an acceptable failure rate may be greater than zero. Consider, for example, a control that requires a manager to approve an employee’s expense reimbursement forms. If the acceptable failure rate is zero for this control attribute, what happens when a manager takes a two-week vacation? The acceptable failure rate for such a control could be set at something higher than zero, with the provision that a separate control or control attribute is implemented, such as deviations being investigated by finance to identify whether an appropriate delegate designated by the manager approved expense reimbursements when the manager was unable to do so.