Cigna, Wells Fargo describe journey to high-tech ICFR

Technology is permeating internal control over financial reporting, and one of its pioneers says the transition is possible even without a deep background in technology.

“You don’t need to be an IT technologist to deploy robots and achieve efficiency across the finance and accounting organization,” said Mary Hoeltzel, vice president and global chief accounting officer at Cigna, at a recent Financial Executives International conference.

Her journey into greater uses of emerging technology began when she witnessed a business partner using a bot to manage his calendar. That inspired her to do some reading on her own, which prompted her to reach out to accounting and technology service providers.

“Before you knew it,” Hoeltzel said, “I had my team participating in a lot of meetings with accounting firms, and we started to talk about deploying robotic technology,” which performs tasks otherwise carried out by humans. They began experimenting with a basic pilot involving journal entries and account reconciliations. “We wanted to make sure we understood how to deploy the technology, what’s involved, and what we needed to do to train a team,” she said.

After a successful pilot, the team engaged a Big Four firm to perform a complete review of its organization and determine where it could benefit from robotics. “Now we’re moving forward with a number of different robotic-processing-type tasks into the coming year,” she said.

For Craig Schmidt, governance and oversight leader at Wells Fargo, the adoption of technology to enhance the control environment involved some key inflection points. The first experience was the “light bulb” moment, he said in a panel discussion at the FEI conference.

“The light bulb moment was seeing a demo from several of the firms and seeing what robotics process automation is capable of doing,” said Schmidt. “It set the mantra for the team: We have to eradicate all manual processes as soon as possible. This stuff is just amazing. It’s incredible.”

Then came a moment of pause, said Schmidt, which he called his “risk management moment.” If bots are deployed to eliminate manual tasks equivalent to 10 positions, for example, what’s the business continuity plan if the bot suddenly goes offline? Greater use of technology presented not only opportunities, but risks to consider as well, he said.

Companies generally are at many points along a spectrum of advancing technology, said Mike Schor, a partner at Deloitte & Touche. On the simplest end, companies are increasing their uptake of traditional analytics, like data integration or visualization, he said.

Such tools “smash information together” from different sources to tell a story that might otherwise be obscure, said Schor. “If you’re not taking advantage of those tools, that’s certainly something to explore right away,” he said.

RPA, or robotics process automation, is the more advanced technology that companies like Cigna and Wells Fargo are deploying. “It’s very real, and it’s happening in the marketplace now,” said Schor.

RPA is replacing some of the high-volume, low-value repetitive tasks typically performed by humans, like copying and pasting information, logging in to websites, sending e-mails, and downloading information, Schor said. “It’s taking menial tasks off the plate of employees, which frees them up to perform higher value tasks,” he said.

Further along the spectrum, some companies are also starting to explore cognitive intelligence, said Schor. Two that are particularly applicable to internal controls are “natural language generation” and “natural language processing,” he said, demonstrating some “thinking behaviors.”

NLG takes structured data, like the rows and columns of information on a spreadsheet, and creates unstructured data, like narrative language that can be used to produce Sarbanes-Oxley documentation. NLP performs exactly the opposite function, taking unstructured data and giving it structure. Some companies are using NLP, for example, to find and retrieve data in lease contracts to comply with the new lease accounting standard that takes effect Jan. 1 for calendar-year public companies.

Still more advanced, machine learning, augmented intelligence, and artificial intelligence can hear or see information and interpret it as humans might, said Schor. “That’s starting to come into the marketplace,” he said. “It’s on the horizon.”

Auditors are beginning to deploy similar technological advances in their audit of internal control over financial reporting, said Josh Jones, a partner at Ernst & Young. Automation and visualization tools can take a great deal of manual labor out of the audit process while also giving auditors visibility that can inform their risk assessments.

“The opportunity to smash together large data sets really provides a lot of insights into a company’s business that enable us to identify risk at a much lower level now than we ever did in the past,” said Jones. Auditors might be able to see, for example, all revenue transactions rather than just a sample. They can more easily spot outliers or inconsistencies across business units, product types, individual customers, or any number of other groupings.

In some cases, clients may be using more advanced tools than auditors, said Jones. “We have to stay on top of that,” he said. “In other cases, we may be out in front of the clients.”

Treading into new technology is not without its challenges, said Hoeltzel, some of which are easier to address than others. Getting resources proved to be one of the easier ones to navigate.

As in many companies, the finance and accounting function at Cigna competes with the commercial side of the business for resources, said Hoeltzel. “Usually the commercial side wins unless there’s a big compliance issue,” she said. With respect to deploying RPA, however, “the cost savings is so significant, it was easy for us to get the seed money to fund the program and move forward.”

Producing the necessary process documentation, however, has been more challenging, said Hoeltzel. “Auditors often ask for process documentation to see if anything has changed and to do their walkthroughs,” she said. “That documentation has to be really up to speed to make sure there aren’t any changes.”

While assuring current documentation is critical, so is assuring current information underlying the program, said Schor. It’s even more important considering how fast the bots are operating and how serious the potential failure is if simple changes are not caught and addressed, he said. “If the bank moves the balance from the top right corner of the sheet to the bottom left corner, you need to be able to quickly identify that to be sure the bot doesn’t fail,” he said.

All that aside, the biggest challenge Schor sees is simply getting started. “We need to focus on silencing our inner cynic,” he said. “Put that aside for the moment and really think about the art of the possible.”