Software for internal control systems: developed with expertise in internal control systems

Torsten is the Managing Director and a partner at Energiesozietät and brings many years’ experience in the field of compliance management. He explains that his company has decided to work with hsp in order to expand the software capabilities available to date and to implement a fully integrated system for the internal control system. Paul emphasises the importance of the ICS and the Tax Compliance Management System (TCMS) and how they differ from the traditional approach, which often focuses solely on tax processes. For Torsten, the integration of process management and tax-related issues represents an important step towards improving the efficiency and effectiveness of compliance management.

Torsten addresses a question posed to him by Paul as to whether an internal control system can be modelled using Excel. The answer: to a limited extent and within certain bounds, but not ideally. For an ICS professional, it is more important to have a centralised system through which everything can be managed and monitored. Torsten cites this as the main reason why Energiesozietät decided to work with hsp.

Tax lawyers usually rely on the commercial balance sheet. In most cases, there are audited annual accounts, which means that the preliminary processes under commercial law have been audited and, consequently, the internal control system (ICS) has also been audited. With specialised software, it is possible to decide how deeply one delves into the ICS and GoBD issues. Some clients want more depth, others less, says Torsten. Previously, the preliminary processes were not scrutinised. This is now possible.

Paul would like to know what the difference is between the Internal Control System and the Tax Compliance Management System (TCMS). Torsten explains that the ICS is an integral part of the TCMS and forms the basis for the effective operation of a TCMS. All matters relating to the GoBD are addressed by the ICS. Put simply, an ICS assigns risks and their probabilities of occurrence to business transactions and establishes control measures with corresponding responsibilities assigned to specific individuals. Checks are carried out at regular intervals to determine whether the risks have materialised – and, if they have, corrective action is taken. Under the TCMS, the risks and their frequencies of occurrence are recorded, and the potential loss and probability of occurrence are calculated.

In this context, the term ‘gross-net method’ is often used. The gross method involves assessing how high the risk is if no control measures or principles are put in place to counteract it. Once these measures are in place, a residual risk – or net risk – remains. The next step is to assess whether the net risk is low enough to be acceptable or not.

Energiesozietät provides hsp with standard risks that Opti.Tax users can link to business transactions within their own company or at a client’s firm. Torsten explains that the standard risks provided by his firm are sector-neutral. These are based on the general practical guidance on TCMS issued by the IDW, which was deliberately kept broad in scope. A rigid system was deliberately not implemented, as companies vary greatly.

Accordingly, the standard risks are designed to be general in nature and applicable to as many sectors as possible. Within the software, the risks can be selected and customised to meet the specific needs of the organisation. Unlike the standard risks, no fixed control measures are specified; instead, expectations are set out. These are recommendations that should be regarded as minimum standards. Every company can and should make individual adjustments in order to manage the specific risks effectively.

Two days before the programme, Torsten suggested providing a requirements specification in addition to the software. Paul wants to know why consultants need such a specification. Torsten replies by using the umbrella term ‘pragmatism’. His aim is not to create a theoretical construct, but a tool that helps a company move forward in its day-to-day business. That is why he first collects the documents from the company and gathers information:

The answers to these and other questions are being compiled to lay the foundations for the project. Existing information can already be entered into Opti.Tax at this stage. The software thus serves as a central platform where all elements of the internal control system can be expanded or scaled back. For example, it may be the case that certain control measures are no longer required at all.

Paul raises the subject of sustainability reporting and the European Sustainability Reporting Standards (ESRS). In future, environmental considerations must be incorporated into corporate governance alongside financial considerations. Should companies broaden their thinking on internal control systems to include sustainability? Torsten agrees and emphasises that his focus is on an integrated system. Tax, business management and other matters are managed within Opti.Tax. It is a question of data management and the interlinking of legal areas.

For Torsten, sustainability is not primarily a tax issue, but it is a tax issue as well. So the topic must be integrated with the other components. Torsten sees the fact that all these components are interlinked in Opti.Tax as a major advantage of the software solution. Another strength of Opti.Tax lies in its interfaces. This enables the software to integrate seamlessly with upstream systems such as SAP, retrieving data and feeding it back. According to Torsten, this is not the case with many other software solutions.

In future, financial considerations will not be the only factor when it comes to business success – both agree on this. It is not just shareholders, but stakeholders too who are increasingly expecting sustainable business practices. How am I perceived as an employer? All of this will play an ever-greater role in the future. Companies should start addressing these issues now, says Torsten, rather than waiting until it is too late.

Paul explains why, from an hsp perspective, we step back from the process. Anyone who is aware of the risk may not necessarily be able to, or will not necessarily, eliminate it. However, if I spot a weakness in the process, I automatically work backwards to identify the risk. Torsten agrees and notes that processes should not only be documented, but also put into practice. To put them into practice, they must be continuously monitored – something that simply isn’t possible with Excel. He is therefore very enthusiastic about the approach in Opti.Tax of linking process steps to individual risks. This is one of the new features due to be released soon.