Release Deep-Dive: Reviewer Tasks & Enhanced Control Setup

Watch our Product Launch Webinar for a thorough walk-through and Q&A:

Welcome to the introduction of the new features released on April 28, 2024. In the following, we would like to provide you with a comprehensive guide on the latest additions and changes, their respective use case scenarios and what we expect these features will achieve for you. 

This release consists of new functionalities in four areas of the Control Management module, which are namely Reviewer Tasks, Reminders, Scheduling and Tags. Therefore, you will find major changes in the control editor alongside an optimized interface design, or in other words, when you create new controls or update existing controls. With Reviewer Tasks, you will be able to implement standardized review procedures for controls so you are more effective in detecting deficiencies and improving your control framework continuously. Besides that, the extended features will help you to further enhance operational efficiency from an administrative perspective and improve control performance. 

Click on the section to navigate:

1. Reviewer Tasks

2. Flexible Reminders

3. Scheduling and Planning

4. Control and Assignment Tags

5. Detailed explanation of changes

 

Reviewer Tasks

What is new?

When creating a new control or updating an existing one, you are now able to create specific tasks for the reviewers using the full task design box in the same way as for tasks for the control responsible. You can build any desired workflow separately for your first and second reviewer based on a pre-defined set of tasks from radio-buttons to comment fields while having the option of setting them as mandatory, optional or conditional in relation to another task. 

Problems addressed?

With the continuous evolution of laws and regulations as well as raising internal expectations, it is no longer only the performance of the control measure that requires enforcement of more specific documentation but also their review. Previously, the control reviewer could only describe the review procedure in a free text field and upload supporting documents, based on which the final reviewer submits the decision of approving a control, or rejecting and returning it to the responsible or the previous reviewer. It is difficult for internal and external auditors to understand the review procedures and criteria that have been used for. Further, the compliance responsibles cannot guarantee that reviews are performed in a consistent and quality-assured manner across the organization.

Use cases

SOX compliance

Requirements

The Sarbanes-Oxley (SOX) Act of 2002, a US federal law that aims to prevent corporate fraud, obliges corporations to adhere to certain financial record keeping and reporting, information security and auditing practices. Public companies that operate in the USA must be SOX compliant. Being SOX compliant requires companies to implement internal controls to prevent financial data tampering. Affected companies must report regularly to the Securities and Exchange Commission (SEC) to attest the effectiveness of controls and the accuracy of financial disclosures. On an annual basis, affected companies are obliged to conduct an independent audit of their financial controls and statements. In 2023, the New York Stock Exchange counted 2,272 listed companies, of which 563 are international companies.

Inspired by the US SOX Act, the UK Government issued a white paper in May 2022 that proposes strengthening corporations' risk management and internal controls. The proposal expands the definition of Public Interest Entities (PIEs) and brings large privately owned and AIM listed companies into scope. New legislations are expected to come into force in the near term. 

Challenges

In addition to implemented internal controls, SOX Section 404 requires all annual financial reports to include a statement on the management's responsibility for establishing and maintaining an adequate internal control structure and an assessment of the effectiveness of the internal control structure in the most recent fiscal year. The assessment shall be made based on certain standards or a framework. Many companies perceive this section as the most complicated and expensive part of all SOX requirements. Management and the external auditor need to understand the company's risks and to base their conclusions on a consistent and effective assessment framework, which is put into practice in all different parts of the organization where internal controls are in place. This requires a clear definition of the assessment criteria, a robust and easy-to-use operating system and a stringent documentation that facilitates efficient reporting efforts.

Solution in Impero

Impero addresses the above challenges with the newly released Reviewer Tasks that enable a quality-assured and differentiated review design. The Internal Control managers can use specific task elements to operationalize review criteria, to oblige reviewers to judge based on these and to submit supporting comments. You can build the questionnaire exactly as you need for the respective controls without any limitations on the type and number of tasks.

With standardized review designs effectively implemented across the organization, you will benefit from the improved review quality, a more systematic and meticulous detection of weaknesses facilitating you to adhere to the SOX assessment criteria and to more quickly improve the effectiveness of your control structure and risk mitigations. The specified tasks can also be extended to a second review to further enhance the confidence level. Reviewer Tasks will help companies to reduce the cases of post hoc investigations and corrections and contribute to meet expectations of the management and auditors resulting in lowered audit costs and enhanced internal capabilities in the compliance processes.

Collaborative internal controls

The performance of internal controls requires crossfunctional collaboration aiming at a smooth and efficient flow of data and tasks. Reviewer Tasks can build processes involving individuals, teams or departments where preliminary tasks need to be performed by an initial responsible (or responsible group) and then delivered to the next responsible to complete subsequent tasks based on the submitted results, and similarly for an optional third responsible in line. This 3-step process is based on the logic of triggering the next action after the prior is completed. Since collaborative processes are widespread in internal control systems connecting HR, supply chain and business functions to finance and tax operations, Reviewer Tasks provide a significant potential of the further automating the cycle, reducing stand-alone tasks and therefore decreasing friction costs and administration capacities. 

Foreign tax declarations 

With the growing demand of companies centralizing tax management efforts, the orchestration in local entities requires reliable systems supporting efficient coordination and quality assurance. Especially, when external consultants are responsible for filings in a large number of foreign entities, Reviewer Tasks will offer a strong support for you ensure sufficient outcomes to be delivered at the right time. For example, the tax declaration process is assigned to an external consultant as the responsible, the global tax management team as the first reviewer and the same consultant again as the second reviewer. The functionality of differentiated due dates for the three steps provides an improved time management - also giving you better signals to take interventions from a monitoring perspective. You can gain higher confidence in the local enforcement facilitated by the specified tasks for your consultants and your own intermediation in a self-operating system after the initial set-up. All in all, we expect the features to make a great contribution for you to prevent due date violations and penalties. 

Set-up guide

1. Go to Control Management module.

2. Click on "Create new control" on the top right. Or enter an existing control program and open a control.

3. You see now the updated control editor page with several new functionalities. Go to the section "Tasks" by either clicking on the navigation path on top or scrolling down the page.

4. Use the elements on the right side to create your task flow or questionnaire - separately for the responsible, the reviewer and the second reviewer by switching between the tabs.

Flexible Reminders

Aiming at high control performance and on-time rates, you are now able to send out any desired number of scheduled reminders in a preferred setting, which best fits your organizational needs and the control's nature. Reminder mechanisms both before and after due date are free for you to design. For example, you might want to remind your performers one week in advance on submitting monthly internal controls. In case of annual statements or tax declarations, performers would benefit from reminders more in advance to ensure sufficient preparation time. Is there the need for setting up daily reminders to establish awareness in a hectic environment, you can now also implement it with the new features. Therefore, control responsibles will further optimize the timing of their performance and improve control results quality with earlier warnings. Administrators will significantly reduce the number of manual reminders sent on a daily basis.

Set-up guide

1. Go to Section Reminders in the control editor. 

2. Click on the free fields referring to before and after due dates. For each field, select one or multiple reminders by clicking on the number of days, e.g. 3 reminders should be sent out before due date and 5 reminders consecutively after the due date, if the control is not yet completed.

Scheduling and Planning

Finding the optimal timing aiming at both delivering financial reports and declarations to authorities on time as well as choosing the most effective completion time for performers is crucial. When dealing with complexity due to growing numbers of obligations and teams, time management is a considerable challenge that the operating team needs to tackle. The upgraded scheduling and planning tool in the control editor significantly helps to gain a quick understanding of the entire workflow from performance to final review with clear and simple visual cues presenting the timeline. You are always on top of the process with the transparency on task notifications and due dates in the accurate split by each person and scenario - no matter whether it is being used as a basic task reminder or a full 4- or 6-eyes-procedure. 

In accordance with the advanced scheduling and reviewer tasks, the new release enables setting separate due dates for control responsible, the first and second reviewer. Based on an intuitive distribution of performance time to each involved contributor, the processing time can be rationalized giving everyone sufficient time to deliver in the right quality. With increased granularity in the monitoring mechanisms, administrators are able to detect bottlenecks and dismantle barriers by intervening in a target-oriented manner. Specific due dates and performance dates for responsible, first and second reviewer are equivalently reflected in the control activity list, reports and exports. These additions are expected to significantly improve employee engagement for compliance processes based on time-specified duties and strengthened traceability. 

The entire bundle of scheduling and reminder functions is enabled for mass-updates. Given the high level of scalability, streamlining advanced due date management across processes and the organization is a desirable exercise so you can quickly gain benefits from it. 

At the same time, we made efforts in optimizing the design of the user interface - mainly through an intuitive organization of features and pronounced key settings - so your work is more smooth and efficient than before.

Set-up guide

1. Go to the section Schedule in the control editor.

2. In the tab Recurring, set up the control frequency, start date and reference period. Schedule the due date and time of the entire control including performance and review(s). Or in the tab Manual, set up due date and reference period.

3. Optional: In case you need to define irregular due dates for selected periods such as giving more time in January due to annual reporting, click on "Customize monthly schedule".

4. Go to the section Planning.

5. Distribute processing time to each the control responsible, and if applicable, to the first and second reviewer. This will be the number of days every contributor is asked or obliged to complete her/his part of the work.

Control and Assignment Tags

A new tag widget is now available for assigning control tags and assignment tags. With an increased size and an improved design for the selection, it is easier and faster to apply tags on the controls than before.

When you need to create new tags, you no longer need to go to the Tag Management module but simply do it using this widget while editing a control. 

Further, instead of only assigning one or several tags to a control or assignment, you can now also assign all tags of a tag category with one click. With that, bulk assignment of tags is enabled giving you back some time of repetitive, manual assignment. Should there be a collection of e.g. mandatory or standard tags for a specific overarching process or control program, you can simply create a tag category including all relevant tags and bulk-assign them to the control, and then only add other control-specific tags.