By Michael Juergens, Tom Donohue and Clayton Smith
Introduction
End-user computing (EUC) applications (such as Microsoft Excel, Microsoft Access and others) continue to present challenges for organizations.
On the one hand, EUCs provide a great benefit by allowing users to directly manage, control and manipulate data. Unlike SAP, Oracle and other enterprise resource planning (ERP) applications that facilitate the automated and integrated flow of transactions and data, EUCs are neither ponderous nor difficult to modify. In fact, EUCs allow businesses and users to quickly deploy solutions in response to shifting market and economic conditions, industry changes or evolving regulations. They can also help plug functionality gaps for ERP systems.
Alas, those same elements that make EUCs so appealing (and vital in providing timely information) can also make them challenging to manage and control effectively. User-developed and user-controlled applications, by definition, are not subject to the same development, monitoring and reporting rigor and control as traditional applications. And often, management lacks visibility into exactly how pervasive the use of EUCs has become throughout the enterprise.
What Types of Issues Are Companies Facing?
Challenges associated with EUCs include:
- Misstated financial statements due to simple data entry or calculation errors in spreadsheets
- Regulatory and compliance violations (see Exhibit A for a list of regulations that could potentially impact EUCs)
- Operational impacts and losses due to errors
- Loss of time stemming from cumbersome manual processes and calculations that could be automated
- Data redundancy and version control
- Lack of recovery or forensic capabilities
- Higher risk of fraud
- Audit findings due to lack of control around EUCs.
These issues are not new; organizations are typically very aware of the issues they have experienced with EUCs internally, and a quick Internet search will highlight a number of high-visibility breakdowns in EUC controls resulting in restatements and/or fraud.
What Has Changed?
The promulgation of Sarbanes-Oxley and other internal control regulations around the globe heightened the awareness that EUC controls were needed. Some organizations responded proactively, putting measures in place to address the issues. Others did little, unless the issues were directly forced upon them by regulators, auditors or reporting errors that came to their attention. However, in both cases, many of these measures proved to be insufficient in resolving the set of challenges posed by EUCs. And reporting errors, audit findings and other issues continued to arise. Moreover, recent changes in the business environment continue to increase the need for EUC controls, including:
- The economic downturn curbed investment in information technology (IT), resulting in a dramatic increase in the development and use of EUCs to address business needs not being addressed by IT.
- Macroeconomic financial crises have increased the level of scrutiny by auditors and regulators around EUCs, particularly those that perform financial modeling.
- Workforce reduction has impacted the number of employees with knowledge of how the EUC functions, which makes troubleshooting, error identification and changes difficult.
- EUC technologies continue to increase in ease of use and functionality, making it easier for users to quickly deploy robust and complex EUC solutions.
The Current State
Most organizations are aware of the challenges presented by EUCs and the need to address them. As mentioned earlier, many companies have taken measures to deal with these issues. Unfortunately, these measures have often been ineffective, for a variety of reasons. Many organizations have chosen to develop and disseminate internal policies regarding the use of EUCs. But as with most policy-based solutions, there are significant challenges when it comes to enforcing and monitoring compliance.
Other organizations have attempted to address the problem through the heavy use of technology, by purchasing and implementing tools or other technical solutions that can provide controls and enforce compliance. Although these tools are helpful, and often necessary, without the corresponding organizational structure and personnel to support the functionality of the tool, these solutions tend to be underutilized and ineffective.
Another approach is to allow each business unit to address the issue independently. This often leads to inconsistent levels of control, as well as duplication of effort and inefficiencies.
The purpose of this white paper is not to throw stones at the progress that has been made. In fact, this is a fairly typical maturation of organizational capability that we have seen in various other disciplines throughout the enterprise. Business issues emerge, technology enablers become more robust, and the enterprise moves over time from a chaotic uncontrolled approach; to a repeatable approach; and, finally, to an optimized and automated approach. Our purpose is to lay out an objective model that will provide organizations with a framework for addressing issues while managing and controlling EUCs holistically, leading to an advanced state of highly effective EUCs that support business processes in an error-free manner.
The Solution
Our experience leads us to conclude that point-specific solutions are not effective. Trying to solve the EUC controls challenge by merely establishing and announcing a policy, or by throwing technology at the problem, does not provide an effective and sustainable solution. Additionally, every organization uses EUCs differently and for a variety of purposes. Consequently, there is no single cookie-cutter approach that will work for all.
That being said, a sustainable and effective approach to controlling EUCs is achievable. In order to accomplish this objective, companies should deploy a holistic enterprise-level program for managing EUCs. While the specifics of such a program will vary from organization to organization, the fundamental elements of the program are consistent across enterprises. It is our experience that companies that develop and deploy a holistic EUC management program are much more likely to accomplish their EUC management objectives in a timely, effective and efficient manner. Those that continue to pursue point-specific solutions will remain mired in inefficiency, and they will continue to be frustrated by errors and recurring issues.
Effective EUC management programs comprise elements of governance, process, people and technology. Each of these elements should be customized to meet the specific needs of the organization. A brief overview of the programmatic framework and key considerations is listed below.
Click here for an Overview of Programmatic Framework and Key Considerations
The framework above does not provide all the potential requirements that a company might need when establishing an enterprise-level programmatic approach to managing EUCs. But in our experience, programs that lack any single criterion listed above are far less effective.
As you have seen simplified above, many of these criteria have a high degree of flexibility and optional methods for deployment. Consequently, you should not minimize the amount of planning and strategizing that will be needed to define the specifics of the program within your enterprise. Also, the amount of time needed to bring EUCs under management of the program will be extensive. Most organizations find that this can be a multi-year project, which requires constant fine tuning and updating as the organization continues to evolve.
Benefits of an Enterprise EUC Program
The main objective of an enterprise EUC program is risk management. As with most risk management initiatives, the benefits (particularly those with hard dollar savings) can be difficult to quantify. However, many organizations that have deployed such programs have experienced bottom-line benefits in addition to risk mitigation, and they have developed business cases that demonstrate real return on investment (ROI). Our experience with such programs leads us to conclude that the following benefits can result:
- Reduced errors in preparation of financial statements and management reporting, resulting in faster closing processes and reduced staff time to research and remediate issues.
- Reduction in direct identified losses due to errors.
- Reduction in testing requirements and fees by auditors. Rather than needing to test each EUC or a large sample of critical EUCs, auditors can test management and program controls over EUCs, particularly when an automated tool has been deployed.
- Reduced regulatory and compliance penalties.
- Reduced training and on-boarding requirements for new employees.
- Elimination of redevelopment work needed to re-create EUCs when key employees leave, or when the EUC is lost.
- Opportunities to eliminate certain EUCs completely by identifying those that are organizationally entrenched but serve no direct business need, or that can be replaced by existing ERP functionality.
- Reduced effort to remediate errors in EUCs.
Conclusion
EUC continues to present both opportunities and challenges for organizations. Companies will continue their efforts to migrate functionality from EUCs into ERP packages or other more controlled business applications, but EUCs will not be going away anytime soon. Companies are too dependent on EUC functionality that allows them to respond quickly and effectively to dynamic market conditions. And auditors and regulators will continue to make EUCs a priority when evaluating and assessing organizations.
Consequently, companies should deploy tools and techniques to effectively manage and control the EUCs that are critical to financial reporting or operations. Progress made by organizations to date suggests that policy-based, or point-specific, solutions are ineffective in helping to mitigate the array of risks posed by EUCs. A better alternative is to design and deploy a holistic enterprise-level program that effectively comprises elements of governance, people, process and technology. Companies that do so will find that such a program contributes to overall risk management and bottom-line benefits.
Michael Juergens is the managing principal for Information Technology Internal Audit (IT IA) at Deloitte & Touche LLP. He can be reached at michaelj@deloitte.com
Tom Donohue is a senior manager in Deloitte & Touche LLP’s Audit & Enterprise Risk Services (AERS) Advisory practice. He can be reached at tdonohue@deloitte.com
Clayton Smith is a senior manager in Deloitte & Touche LLP’s Audit & Enterprise Risk Services (AERS) Advisory practice. He can be reached at claysmith@deloitte.com
As used in this document, “Deloitte” means Deloitte & Touche LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.
This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor.
Deloitte, its affiliates, and related entities shall not be responsible for any loss sustained by any person who relies on this publication.
Copyright © 2013 Deloitte Development LLC. All rights reserved.
Member of Deloitte Touche Tohmatsu Limited