Professional Documents
Culture Documents
Internal Controls Survey Report 2018
Internal Controls Survey Report 2018
Internal
Controls
Survey
kpmg.com
Table of
contents
2018 Internal Controls Survey 2
Key takeaways 3
Detailed findings 4
Strategies 4
Areas of improvement 5
ICOFR documentation 8
ICOFR testing 13
Survey demographics 20
Contact us 22
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International.
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International.
Key takeaways
Organizations continue to focus on controls rationalization and
minimizing testing costs.
The focus on both of these areas increased from 2017 to 2018, with 60% or more of
surveyed organizations including these in their 2018 ICOFR program strategy. Rather
than primarily focusing on rationalizing the number of controls, organizations should
also focus on identifying the right key controls and documenting them with the
appropriate precision, detail and depth.
Organizations may not be fully leveraging the flexibility available under the
Securities and Exchange Commission’s (SEC’s) interpretive guidance.
More than 40% of organizations do not modify their testing approach based on their
external auditor’s reliance model. These organizations appear to be following the same
guidance that the Public Company Accounting Oversight Board (PCAOB) provides
to define the procedures required of external auditors. Instead, they may be able to
further use the SEC’s interpretive guidance to focus more on their own objectives
through the flexibility on documentation and control testing requirements.
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International. 2018 Internal Controls Survey 3
Detailed findings
Strategies
Strategy for 2018 ICOFR program:*
If organizations considered these three elements together, organizations may find more
impactful controls optimization results, impacting both control selection and the testing strategy.
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International.
Areas of improvement
Top five areas that are “fine as is” or need only minor tweaks:*
Improve system
Improve communication Improve communication Take control of the scoping to align with key Increase external
with audit committee with external auditors ICOFR program overall business processes auditor reliance
71%
Reduce control performer cost/effort
44%
Reduce control testing cost/effort The top area for improvement
continues to be increasing
42% control automation. This was
an area of improvement for 51%
Improve quality of control evidence of organizations in 2017 and
rose to 71% in 2018. This may
41% be due to the increasing focus
on and availability of robotic
Reduce key control count process automation and
related technologies.
37%
*Respondents ranked multiple statements
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International. 2018 Internal Controls Survey 5
Detailed findings
State of the ICOFR program
ICOFR program maturity level: 0%
Less than
Developing: Controls 3 years 36% 64%
identification and stabilization
0%
Evolving: Improved risk
assessment and scoping, 3-5 years 88% 13%
and rationalized controls
(optimization of current control
environment)
More than
Maturing: Improved 5 years 8% 34% 58%
business processes that
have reduced the cost
of control performance,
reduced risk, and added As expected, organizations that have been SOX 404 compliant
value to the business longer tended to describe their ICOFR program as more mature.
Frequency with which issues identified through ICOFR testing are used to make changes to the process:
To enhance the control To change the process so controls To make a process more efficient
environment and reduce risk are more meaningful to the business regarding control performance
(not just performed for SOX) (i.e., increase automated controls)
Organizations are not consistently using the ICOFR testing results to reflect
on the process and then change the processes in order to reduce risk,
improve controls, or improve efficiency.
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International.
Average responses for agreement with the following statements regarding ICOFR programs:
(1 = strongly disagree and 5 = strongly agree)
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International. 2018 Internal Controls Survey 7
Detailed findings
ICOFR documentation
Forms of documentation regularly maintained for the ICOFR program:*
Risk and control matrix Process narratives Process flowcharts None of the above
61% or organizations
10% of organizations 44% of organizations
maintain / include
10% regularly maintain
only the risk and 44% maintain both
process narratives 61% both key and non-key
controls in their risk
control matrix. and flowcharts.
and control matrix.
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International.
Average number of key ICOFR controls by process:*
Entity-Level Financial Fixed IT General HR & Inventory Order-to- Procure-to- Tax Treasury
Controls Reporting Assets Controls Payroll Management Cash Pay
Key controls that are manual (i.e., not automated) Key controls that are automated (i.e., IT application controls)
Processes with the highest percentage of automated controls were: IT general controls (39%),
procure-to-pay (37%) and order-to-cash (33%).
Number of systems and applications (including the Enterprise Resource Planning system) that are
in scope for ICOFR testing:
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International. 2018 Internal Controls Survey 9
Detailed findings
ICOFR documentation
Average number of key ICOFR controls and automation percentages:
334 485
The Financial Services industry
The average total key control count had the highest average total
across all industries was 334. key control count at 485.
The average number of key controls increases as the company size (based on annual revenue) increases.
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International.
2018 Internal Controls Survey 11
Detailed findings
Technology supporting the ICOFR program
Whether a specific technology solution, excluding
Word, Excel, SharePoint, etc., was used to support
ICOFR program documentation and testing: How long the technology solution has been in use:
54% 46%
Yes No
Larger organizations ($10 billion Less than one year 1-2 years
65% or more in annual revenue) were
most likely to use a specific
technology solution (65%). 3-5 years More than 5 years
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International.
ICOFR testing
Who performs ICOFR testing:*
15% 14% 5%
Control owner executes test scripts to test the Control owner certifies that their controls are
operating effectiveness of their controls operating effectively, in lieu of independent testing
For organizations where ICOFR testing is performed How use of an external provider for support with
by Internal Audit, the proportion of total Internal Audit ICOFR program changed from 2017 to 2018:
hours related to ICOFR:
41% of organizations spend more than 50% of their total Internal Audit hours on
ICOFR. For larger organizations (greater than $10 billion in revenue), only 14% spent
more than 50% of their total Internal Audit hours on ICOFR.
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International. 2018 Internal Controls Survey 13
Detailed findings
ICOFR program costs
Cost changes from 2017 to 2018 in regards to:
23% 14% 6%
Our organization and our external Our organization and our external Our external auditor has more controls in
auditor have the same number of auditor have approximately the same scope for testing than our organization
controls in scope for testing and the number of controls in scope for testing;
controls are the same however, the controls vary
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International. 2018 Internal Controls Survey 15
Detailed findings
External auditor coordination
Extent to which the external auditor relies on ICOFR activities:
Moderate
Test of effectiveness (i.e., control testing) 2% Fully, to the extent possible
Able to quantify savings achieved as a result of Most common metrics used to quantify and/or
external auditor reliance, if applicable: monitor savings from external auditor reliance:*
31% Yes
2nd Total hours saved
69% No
3rd Percent reduction
in fees
Percent reduction
4th in hours
The percentage increased from 23% in 2017 to
31% in 2018. Other impacts from reliance, such
as minimizing requests to control owners, may be 5th Other
more difficult to quantify.
*Respondents could select multiple responses
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International.
Approach modifications based on external auditor’s
reliance model:*
We modify our
rollforward approach
We self-assess in
areas of non-reliance
Other
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member
firm of the KPMG network of independent member firms affiliated with KPMG
International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 2018 Internal Controls Survey 17
The KPMG name and logo are registered trademarks of KPMG International.
Detailed findings
Technology use in controls
Whether key controls include continuous
monitoring controls: Whether key controls include continuous auditing controls:
53% No 68% No
12% Don’t know 17% Don’t know
Within the testing activities, D&A is primarily used in Organizations are increasing their use of D&A within
selecting samples for testing. 37% of organizations the performance of control activities (up from 22% in
had plans to increase the use of D&A to assist with 2017). 33% of organizations had plans to increase the
compliance activities (testing or reporting on controls). use of D&A to perform control activities.
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International.
Current use of robotic process automation (RPA) or other intelligent automation:
To perform a control activity: To assist with compliance activities (testing or reporting on controls):
85% 91%
8% 7% 4% 5%
Yes No Don’t know Yes No Don’t know
57% 61%
24% 19% 20% 19%
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International. 2018 Internal Controls Survey 19
Survey
demographics
Number of years organizations are SOX 404 compliant:
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S.
member firm of the KPMG network of independent member firms
affiliated with KPMG International Cooperative (“KPMG International”),
a Swiss entity. All rights reserved. The KPMG name and logo are
registered trademarks of KPMG International.
Organization’s total annual revenue for the most recent fiscal year:
1% 2%
Less than $100 million $100 – $499 million $500 million – $1.4 billion $1.5 – $9.9 billion $10 billion or more Don’t know
2%
9% 12% 32% 41% 4%
Less than $100 million $100 – $499 million $500 million – $1.4 billion $1.5 – $9.9 billion $10 billion or more Don’t know
Primary industry:
Technology Energy, Natural Consumer Goods Industrial Banking & Financial Insurance
Resources & Manufacturing Capital Markets Services
Chemicals
6% 6% 8%
4% 2% 1% 1% 1%
Healthcare Media & Building, Retail Alternative Asset Life Sciences Other
Telecommunications Construction & Investments Management
Real Estate
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.
All rights reserved. The KPMG name and logo are registered trademarks of KPMG International. 2018 Internal Controls Survey 21
About KPMG LLP
Our Risk Assurance Services are designed to enhance the Our professionals have extensive experience working with
efficiency and effectiveness of internal audit functions, global companies ranging from FORTUNE 500 companies
enterprise risk management programs, reviews of third to pre-IPO start-ups. We go beyond today’s challenges to
party relationships and risk and controls management. Our anticipate the potential long- and short-term consequences of
professionals can augment and enhance an organization’s shifting business and technology. With a worldwide presence,
existing risk management capabilities through the use of KPMG continues to build on our member firms’ successes,
experienced risk and controls professionals, supplemented by thanks to our clear vision, values, and our people in 153
multidisciplinary skills from each of our Advisory service lines. countries. We have the knowledge and experience to help
clients navigate the global landscape.
KPMG’s Advisory professionals combine technical, market and
business skills that allow them to deliver objective advice and
guidance that helps Advisory’s clients grow their businesses,
improve their performance, and manage risk more effectively.
Contact us
For additional information, please contact any of the following:
kpmg.com/socialmedia
The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to
provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the
future. No one should act upon such information without appropriate professional advice after a thorough examination of the particular situation.
© 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG
International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. [Printed in the U.S.]
The KPMG name and logo are registered trademarks or trademarks of KPMG International.