Roughly one in every four lightweight vehicles sold in the world contains a part from Nemak, a manu facturer of highly complex components for the automotive industry, including cylinder heads, engine blocks, and transmission parts. Based in Monterrey, Mexico, Nemak sells to more than 50 customers in 16 countries and supports more than 650 vehicle platforms.

Since 1998, Nemak has operated a full suite of SAP software to run thousands of processes for the procurement of raw materials from worldwide vendors, the production and distribution of hundreds of complex machinery parts, and warehouse and inventory management, among other mission-critical processes.

Until 2016, the company depended on manual controls to ensure process compliance. This resulted in an untold number of emails, spreadsheets, and personal follow-ups to complete quarterly internal control questionnaires, annual process control self-assessments, and tests of effectiveness to satisfy auditors. The internal controls department and external auditors spent valuable time chasing down missing information or seeking clarification from finance and plant managers that could have been spent resolving non-compliance issues. Exacerbating the task, Nemak has more than 20 global legal entities that run SAP software, meaning internal controls had to contend with incongruous systems as well as a lack of transparency.

Fernando Martinez, Nemak Internal Audit Manager, explains the frustration of having to consolidate process controls from roughly two dozen sources. “We handled many spreadsheets and files, and also had to gather scanned and signed documents from the finance managers, controllers, and plant managers of each legal entity,” he says. “If at any point someone didn’t have the proper evidence for a control, we had to follow-up manually, so there was a lot of back-and-forth communication for any items that were incomplete or needed clarification.”

Shortening the Road to Compliance

Nemak’s internal control questionnaire provides a good example of the compliance challenges facing Martinez’s team. The quarterly survey consists of 17 questions for finance managers and plant managers about controls for key financial processes including accounts payable, accounts receivable, taxes, and reporting. Because all documentation existed in either an email or a spreadsheet, monitoring and follow-up necessitated first tracking down the right information. Doing so manually meant that the step-by-step process for issue resolution might not be followed the same way for all issues and was therefore harder to keep track of.

The same challenges presented themselves for annual controls self-assessments, which, like the questionnaire, were used to validate compliance. Self-assessments were sent to the control owner for each business process at each location, and the owners were required to validate and show evidence that they were performing and monitoring the control. This required a control owner to personally interact with all stakeholders in the process, multiplying the touchpoints and opportunities for error.

For Martinez and the internal controls team, managing the questionnaires and self-assessments and hunting down missing information was just a part of the overall compliance journey. After this step, internal controls had to send multiple compliance reports to corporate finance, which involved gathering and consolidating all the required information. This report creation was a crucial step, and meeting compliance became a primary driver for Nemak to automate process controls — even more so than simplifying the time-consuming manual controls.

“We needed to have a back-up system that supported all of our controls processes and that could provide easy-to-find evidence of those controls,” Martinez says. “Time-savings is a big plus of course, but it is not the only factor; transparency and compliance were key motivators.”

A Single Source of Truth

While Nemak looked closely at several governance, risk, and compliance solutions for process control, Martinez says that SAP software was always the front-runner, mainly because Nemak had such an extensive SAP environment. A demonstration that showed all of the business’s key processes could easily be configured in SAP Process Control was one of the final determining factors. “When we saw that the SAP solution fulfilled our needs and that it would offer a seamless connection to SAP ERP, we were convinced,” he says. “The IT department also saw the advantage of including the solution in our SAP license renewal, but that was secondary to the SAP Process Control solution providing the functionality we needed.”

Out-of-the-box functionality includes automation of every key process control where Nemak had previously relied on manual tasks for audit traceability. The internal control questionnaire and self-assessment surveys are now sent and completed within SAP Process Control, providing a single source of information in one repository. Approvals or rejections of a completed questionnaire and self-assessment are done within the application, providing every stakeholder with clear visibility into the status of a control. If a questionnaire is rejected for a lack of evidence that a control has been completed, a manager can create an issue directly in the application for automated follow-up.

“Dashboard reports allow internal controls to see when an issue was created and what the status is, create an action plan, and provide an estimated closing date,” Martinez says. “There are immediate notifications of any deviations, and internal controls can act very quickly and in a much shorter timeframe to close any gaps.”

Fernando Martinez, Internal Audit Manager, Nemak

A Step-By-Step Guide for Auditors

Once the internal control questionnaire and self-assessment were automated, Nemak opted to use SAP Process Control for continuous control monitoring and to enhance its test-of-effectiveness process for internal auditors. The company had previously relied on manual control review processes; internal auditors would call or email a process owner and ask for evidence of a control, and the owner would likely refer them back to the annual self-assessment. This automation provided for seamless communication and allowed auditors to retrieve more up-to-date evidence.

By automating the test-of-effectiveness process, internal auditors can proactively include any required evidence as part of a formal audit plan and load the evidence into SAP Process Control instead of letting it live in disparate spreadsheets. An automated audit plan will contain a step-by-step listing of all activities that need to be performed, leaving no ambiguity for process owners as to what evidence is required when their process is under review.

“The entire process is supported in SAP Process Control, and there is now an evidence archive. Details, results, and attachments can all be uploaded into the application so that all evidence of an internal audit trail and the activities for testing a control’s effectiveness are accessible to anyone in the internal controls department,” Martinez says. 

Nemak chose to automate purchasing controls in the initial phase of automating the test-of-effectiveness process in SAP Process Control. Purchasing remained the target area for continuous control monitoring, which the business used to set up a weekly report that lists any purchase order (PO) that hits the system without the proper release code or requisition. Automated monitoring and follow-up functionality ensures that issues are discovered and resolved before internal audit completes a test-of-effectiveness review.

“We can be much more proactive, rather than waiting for a review of that control,” says Martinez. “If an audit review only happens once a year, for example, that’s a lot of time before we’d detect if a PO didn’t have an assigned release code. Now we see this on a weekly basis.”

The Future Roadmap

Because Nemak experienced so many quick wins with automation of process controls, it did not take long for the internal controls team and process owners to gravitate toward SAP Process Control. According to Martinez, the time savings alone was a welcome relief, but the peace of mind from knowing there was a much clearer path to compliance was the defining factor in stakeholders jumping on board with the change. “No one likes to be audited or reviewed,” he says, “But once you go through end-user training and everyone sees how much easier it is to be in compliance, buy-in isn’t a problem.”

Nemak will expand its use of SAP Process Control with the automation of additional controls and eventual use of the application across every legal entity that runs SAP ERP. The 2016 rollout was limited to the locations in Mexico and the corporate office, but additional rollouts are on the horizon. “We started with simpler controls as a pilot, but we will be creating more and more controls, not only for purchasing but for other key areas,” Martinez says. “We just need to prioritize which controls will most benefit from automation or semi-automation, and to continue to roll these out not only for business units in Mexico, but in every other region we have a presence or operations.”