One of the most frequent questions that we get when it comes to mitigating controls is concerning automation of controls. Automating controls generally offers advantages, such as ensuring consistency, speeding up processes, and freeing manpower and resources. While this may seem like a quick win, the reality can be quite different, and it might make sense less frequently than one would believe.
What reasons are there for automating controls?
The most obvious reason is to optimize a process. Automation facilitates a very defined workflow, which, on the positive side, “guarantees” consistency and precision, while lowering the demand for time resources.
Another advantage of automating internal controls is the ability to analyze large amounts of data automatically without involving human resources.
Lastly, if a task is frequently conducted, this might indicate that automation is relevant as it again frees up resources. However, it’s crucial to remember that automated controls still require some manual oversight to review the results, validate and maintain the automatic control. In other words, automated controls will never mean no time resources are needed once it runs.
Why does it not always make sense?
So, it sounds good, right? Why not automate everything?
As briefly mentioned earlier, automation is efficient when precision is paramount, when the data set is large, or when the frequency of the task is high, making automation more sensible. However, there are significant downsides to automation that are often overlooked.
Firstly, automation is rarely “plug and play.” Resources are needed to configure/create a predefined automated control to ensure it matches the organization’s business and technical processes. Once a control is configured for automation, even the smallest changes in SAP-related business procedures or technical alterations may render the automation ineffective, requiring reconfiguring. In other words, automation is good for very unchanging procedures, but it can be difficult to foresee what will stay the same both technically and procedurally.
Considering that automated controls still require maintenance and are rarely ‘plug & play’, it’s evident that they do not eliminate the need for staff hours. Therefore, automating a control might not always be worthwhile as it often reduces, rather than eliminates, the need for human time investment.
It ends up being a cost/benefit analysis where you really must consider what amount of time you are honestly spending on the control you want to automate, and how much it would take to automate. For instance, if a control needs to be executed weekly but only takes 5 minutes, does that justify the effort needed to program the automation, especially if it requires two days of a specialists time?
The math shows that in this case, it would take 192 weeks (roughly 3 years and 8 months) before the automation breaks even. This example does not consider the need for alterations which can come in the form of changes in business procedures and alterations of where data is stored.
Follow us on LinkedIn and get instant access to our latest articles and posts on SAP and compliance.
