Shared Service Centers 1641



  • I’m wondering if anyone is in an organization with multiple entities that operate some processes under a shared service concept, i.e. Purchasing/Payables or Sales/Collections through something like SAP.
    We currently have each ‘entity’ do a coverage analysis and then consolidate for the entire organization. I am stuck trying to figure out the best way to do the coverage analysis for each of the entities that are impacted by the shared service centers because the entities themselves don’t execute the controls, so they may not be aware of them - however, their financials are still impacted/covered by these controls.
    Any best practices out there?



  • You could assign controls and processes across ’ locations’ as opposed to entities.
    THis would mean that all controls that are located within the same location (even if different entity), would only need to be tested once, provided the controls are uniform across the SSC.

    If other locations are the actual entities, then the testing could be referred back to the SSC if this is where the transaction takes place



  • We test controls based on location where the controls are executed. In a shared service environment, testing at that location would cover all of the subsidiaries accounted for by the shared services team. As for sample sizes, we look to whether or not a control is generic across all subsidiaries (accounts payable, for example) and test from the entire population of activity versus testing separately for each entity. Where the controls are not as generic (close process, reserve reviews) we test each subsidiary. We also take the approach that the accounts for each subsidiary are unique and cover full samples of account reconciliations for significant accounts on each subsidiary.



  • We map processes to the financial statements even if part of this process may end up in a shared service center. The process owner would still need to identify the key controls that meet that exist in the service centre and satisfy themselves that they are designed and operating effectively.
    Where multiple processes converge in the same service centre then we would to document each unique control only once and share it across more than one process document. That said this is not easy to achieve without using one of the main Sox packages.


Log in to reply