Technology provides the ability to continuously scan enormous amounts of information from a huge variety of sources and instantly tell us exactly what we need to know and exactly when we need to know it. More than telling us what we need to know, technology today can also tell us what we need to do and when we need to do it.
Shifting away from intermittent monitoring
Even In the early days of automobiles, continuous monitoring existed. Looking at the dashboard to the right, we see a few gauges for such things as speed, engine temperature, oil pressure, fuel level, and so on. But what about everything else a driver needs to know about the safe and reliable operation of an automobile?
- Is my tire pressure OK? Which tire has a leak?
- Are my brakes OK? When do I need new brake pads?
- Are my headlights working?
- Are my engine, electrical, and other key systems functioning properly?
- Am I on the right road to reach my destination?
- Is my car safe to drive?
To answer these questions, or in business language, to get an “opinion on the effectiveness of internal controls over the safe and reliable operation of my automobile” an automobile driver in 1919 would need to look to experts who would periodically perform manual tests of the vehicle.
To determine tire pressure, they would manually check the tire pressure. To test the brakes, they would remove the wheel and manually inspect the brakes, and so on.
The opposite of continuous control monitoring is intermittent control monitoring. And instead of using technology, the test would be manual. Automobiles would break down without warning. They were often unsafe to drive.
Safe and reliable operation
In today’s automobiles, everything we need to know about their safe and reliable operation exists within the automobile and can be monitored continuously, results displayed, and action taken.
Business processes are not as advanced. Recent research commissioned by SAP and published in the white paper Managing Risk in an Age of Complexity, suggests that only 17% of organizations are using continuous monitoring techniques.
A lost opportunity
It’s true that what gets measured gets managed. Today’s automobiles are more efficient, more reliable, and safer than ever. That’s not true for business processes.
The opportunity lost from using antiquated methods for controlling business processes is huge. Valuable assurance resources spend time performing tasks that should be automated and shifted to process owners. Unlike automobile drivers, process owners aren’t really accountable for their business processes. They can’t be responsible for controls they can’t monitor. And the concept of process performance is completely lost. We manually assess control performance, but we don’t even consider process performance.
One of my colleagues, Jan Gardiner expressed it well in her recent blog GRC Tuesdays: Do You Have CCMophobia?
So what’s the problem? How can we move beyond 1934 control automation and realize the tremendous improvement potential they offer? Please give us your ideas.