PwC’s guide to making your controls landscape more effective and efficient front to back

Within the financial services industry, one of the conventional wisdoms since the global financial crisis goes like this: Regulators imposed new regulations that forced financial institutions to introduce policies, controls and other risk-management-related activities to minimise risk and be compliant. Having lived through a few of these major exercises ourselves, we know first-hand how dominant this topic has been in the past. Financial institutions instantly responded to every new regulatory requirement or major industry incident by layering on yet more controls, policies, governance and other rules – without considering the impact across the business or what was already in place.

Internal controls became the critical component of risk and regulatory projects and a major investment in themselves. Budgets were allocated generously and transferred from strategy- and business-related projects.

These days, the same institutions are going through tough cost-cutting exercises touching all aspects of the bank and its business, with risk and compliance no longer exempt. Improving the efficiency and effectiveness of controls without increasing the risk profile is now one of the greatest challenges and opportunities a financial institution has to face. The key to success is to respond to escalating regulatory demands wisely by optimising the necessary controls while reducing or at least containing costs.

The first hurdle to overcome when addressing this topic is a reticence when it comes to reducing or re-engineering control activities. Despite the high pressure to reduce the cost of controls, the cost of non-compliance is still prohibitively high in many cases. A key success factor to any control streamlining exercise is to demonstrate that you’re able to do so safely and within your risk appetite. We recommend opening the narrow focus of a division or risk taxonomy and concentrating on a broader front-to-back view of controls. The goal is to establish an efficient separation of duties, determine and invest internal control resources in top priority issues, and increase reliance on automated and system-supported controls.

We encourage everyone to dive deep into the topic right now, starting by asking…

Some key questions related to controls:

  • Does your control landscape reflect your current risk appetite?
  • How can the effectiveness and efficiency of controls be measured and made transparent?
  • Have you struck the right balance between preventive, detective and reactive controls?
  • Are there too many control layers?
  • Are controls performed by the right resources, functions and locations?
  • What controls-related activities can be automated or outsourced?

The drivers for a control review vary, but typically include improving client experience by shortening lead and lag times, and streamlining the effort that goes into controls-related activities in all parts of the organisation while remaining within risk appetite. The key is to determine the right balance between the cost of controls and the cost of being non-compliant − or in other words the cost of execution, monitoring and testing, and the frequency of events and their financial impact. The following four-step approach will give you some guidance once you’re ready to start improving your controls efficiency and effectiveness:

Objectively analyse and score the current state

The first step is to identify the controls that are currently in place and understand how they map to the underlying front-to-back process selected for review. This is not always easy, as many institutions organise their controls by other dimensions such as risk taxonomy or regulatory requirement. The controls identified are then assessed and scored based on their importance, efficiency and effectiveness. On the basis of this analysis you can identify the opportunities for improvement and state the case for change.

Design the future state and work out opportunities for improvement

One key aspect has to be considered before starting with the design: As soon as the various opportunities have been identified, the respective stakeholders should be involved to recognise the opportunities as such. Only once you have a common understanding of the opportunities does it make sense to start designing the future state and analysing the cost/benefit relation by including the current baseline and the expected benefits case. As a result, every opportunity gets its own ‘mini initiative business case’, to be considered when follow up decisions are made the opportunities are finally prioritised.

Define the necessary measures and activities

When preparing descriptions of the initiatives, you need to clearly define ownership and responsibilities right at the beginning. As every control streamlining initiative is a little project in itself, the underlying goals and KPIs for measuring the initiative’s success have to be confirmed by its owner. After this step, the activities and the corresponding timeline, as well as any change-management-related activities and communication, can be planned, and the immediate next steps initiated.

Implement the changes

Implementation should follow a roadmap that considers the prioritisation of activities and divides delivery into the short and medium term. Typically, a tight timeline will be chosen to ensure that any improvements in control efficiency and effectiveness are rapidly visible. Obviously you have to differentiate between mandatory changes or quick wins and more complex, long term improvements that contain technical adjustments or the automation of manual procedures.

Last but not least, there must be enough time to lead the people involved through the improvement- related transformation phase and ensure that they start acting according to the new standards and procedures.

In this kind of exercise it’s important to make sure that interests are aligned across divisions, the people affected are involved early on, and that everything is communicated properly. This way you’ll be able to generate demand, be in a position to replicate the approach, and establish a systematic and continuous process of improving controls efficiency and effectiveness.


Dr. Milena Danielsen
Advisory Director
+41 58 792 44 47

Alexandra Burns
Assurance Director
+41 58 792 46 28

Successful robotics initiatives need the backing of agile staff who are open to change

In the past, managing change has all too often been equated with (belated) project communications and training. More recently, however, experts have concurred that digital transformation, and ultimately its success, hinges on both the organisation and the people involved. Despite this, robotic process automation (RPA) and artificial intelligence (AI) initiatives in particular still tend to focus very much on the technology, paying little heed to how the organisation is going to keep pace. But if you want to harness the full potential of transformation in terms of saving costs and upgrading the work your people do, you have to make changes affecting your business model, organisation, culture and individual people early on.

Efforts to automate always involve far more than simply streamlining processes, boosting efficiency and lowering costs. They’re also bound up with new business models and modern organisational forms – and people who find themselves confronted with fundamental changes. You have to pay special attention to the new roles people will play, the skills they’ll need to do so, and how they’re going to deal with the new technical applications that have been introduced. Other things that change include, notably, the interfaces between people and machines (which go beyond mere repetitive tasks), the way the interaction between people and machines is orchestrated, and the value-adding interfaces between people. This is also confirmed in the recent 20th Annual Global CEO Survey conducted by PwC, in which 52% of CEOs polled said they are currently looking into the benefits of human/machine interaction and the impact of artificial intelligence on future skills and competences.

These findings suggest that front-to-end automation shapes an organisation in ways that go far beyond the kind of changes we’ve seen in the past, and compel decision makers to take a comprehensive view of this type of transformation.

  1. Interfaces: It’s not just the interfaces between employees and technology (software) that change in the wake of automated processes, but those between employees and customers as well. The goal has to be for both the customer and the employee (the internal customer) to perceive human/machine interaction as something that adds value and eliminates tasks that cost time and nerves.
  2. Roles: Once the process of value generation has been completely automated, the role of humans changes fundamentally, with new tasks created and old ones eliminated or taken care of by machines. With the focus shifting to new types of customer interaction, the employees involved need new skills and areas of responsibility. It’s one thing to be relieved of certain repetitive monotonous tasks, but they also need to be able to take on new work involving a level of skill, and often also a control function, for which they don’t necessarily have the digital agility, skills and competences.
  3. Orchestration: An organisation that automates its value creation needs to skilfully orchestrate the new or redesigned interaction between people and machines and employees and (internal) customers. These touchpoints are key to the sustained success of any automation solution. In particular, when tasks are passed on – for example from an avatar to a human colleague – this has to happen smoothly so that the customer perceives the whole thing as a satisfying interplay rather than receiving the impression that they’re getting second-class service.
  4. Networks: Automation often has to be tackled on a cross-divisional basis, requiring networking skills from everyone involved. Particularly challenging is the fact that networks are increasingly merging together, meaning that sooner or later there will have to be changes in hierarchies and structures as well.

Evolution required

The majority of Swiss companies embarking on automation projects still aren’t very advanced in terms of digital organisation. Most, for example, will pick individual processes that are suitable for automation and start out by testing prototypes, even though the underlying technology for purely repetitive processes has long since reached maturity. In the process they usually neglect the enterprise-wide impact on staff and customers and their potential for helping optimise value creation, and partnerships are generally relegated to Plan B.

An RPA business case will often claim staff savings of more than 50%, but rarely will it talk about the organisational and employee-related consequences if this potential is actually to be realised.

An interesting discussion then is whether it’s easier for the organisation to follow suit if you start with processes that were originally outsourced to low-wage countries. But even if you take this view there’s no way around the necessity of defining new roles and on this basis working out what skills and competences the remaining staff will have to bring or acquire.

Look beyond silos at the whole picture

As we’ve already discussed, companies undertaking automation have to flesh out the new forms of collaboration between people, and between people and machines. But they also have to define how sharing, collaboration and the generation of new business ideas and products across departmental boundaries – in fact across entire fields of business and hierarchical levels – are to take place.

For example it’s not sufficient to try to onboard customers by simply giving them an intuitive app for data capture. You have to assess the entire process front to back and automate every step that offers the customer an unparalleled experience, boosts efficiency and effectiveness, and eliminates unnecessary costs. This means taking whole steps in the process and redesigning, simplifying or replacing them, or creating new ones. This will fundamentally change the work packages involved.

It follows that the company will have to adapt its entire workflows and organisational structures in line with the automated structures, right down to the design of functions, roles, competences and working models.

Hello bot, goodbye Joe?

Things get really interesting when artificial intelligence is involved. At this point it’s not just about executing rule-based processes more efficiently and precisely; it’s about intelligent interaction with customers, whether they’re internal or external. The result is a wide range of different dialogue and advice services. Lively interaction between humans and artificial intelligence, for example in the form of avatars, ensures that the customer is always dealing with the counterpart best able to solve their problem.

Of course the spheres of application are endless. Recently a bank announced that an avatar with an episodic memory originally used in the back office is now also to be used for direct consultations with clients. Naturally avatars of this sort can also be used in less complex situations, for example when it comes to helping people find information more easily or fill out forms correctly. In other words, why not start out by trying things with a simple issue and then move on to more complex cases?

The voice from offstage

Employees involved in an RPA or AI project, who in most cases will be affected, ask questions. “Why does our company need this when things are working better than ever?” “Should I be going along with this?” “What’s it all good for?” “Where will it all end?” “What does this mean for me personally?” “What will my job be like in the future?” “Will they even need me?” Companies have to have clear answers to these questions. Management has to explain clearly and confidently the company’s vision, strategy and business model so that people can understand and grasp the efforts to automate and what they mean in concrete terms for the organisation and each individual person. Only if management demonstrably provides a clear road map of a shared journey into the digital future, allows the organisation to accommodate the changes, and gives staff the chance to change track, will automation efforts bear the desired fruit.

In a nutshell

Digitisation, RPA and IA projects free up vast financial and human resources. Companies have to make sure they not only address transformations of this sort at the technical level, but assess the organisational and human consequences and redesign accordingly. They can stand out by making sure their automation efforts revolve around the anticipated (internal and external) customer experiences, give social skills and networking high priority, and introduce intelligent machines as ‘equal’ colleagues. Last but not least, it’s important to ensure staff have support and guidance when it comes to relinquishing administrative work in favour of tasks that, thanks to their skill and judgement, they can perform better than machines.


Dr. Milena Danielsen
Director Advisory
Tel. +41 58 792 4447

Juliane Welz
Assistant Manager
Tel. +41 58 792 1913