Automation Is Not Assurance: How to Strengthen Controls in an Automated Environment

Home » Insights » Automation Is Not Assurance: How to Strengthen Controls in an Automated Environment

Manufacturers are wise to take advantage of connected equipment, production automation, warehouse management systems, sensors, robotics, artificial intelligence and real-time analytics. All offer meaningful opportunities to increase capacity, improve quality and respond to continuing workforce and supply-chain challenges.

They also enable critical financial data – production quantities, labor hours, machine utilization, scrap, yield, inventory movements and shipment information – to pass automatically through multiple systems before reaching the general ledger. Information generated outside the accounting department may be used to determine inventory quantities and costs, drive revenue recognition, allocate overhead or support management forecasts.

The implications for financial reporting are significant.

Where finance personnel once manually created or reviewed most accounting records, financial results now increasingly depend on operational systems, automated interfaces and data generated far from the finance department. Operational data has become financial reporting data – and the reliability of financial statements now hinges on the controls surrounding the systems that create, process and transfer it.

For chief financial officers (CFOs) and controllers, the question is no longer simply whether technology improves operations. A single implementation error, inappropriate system access or uncontrolled change can affect hundreds of transactions before anyone notices – resulting in misstated inventory or revenue, inaccurate margins, audit adjustments or business decisions based on flawed data.

Controls over automation are not solely an IT issue. Now, they are a core component of the financial reporting control environment and an essential element of managing financial, operational and reputational risk.

Connecting the Factory Floor to the Financial Statements

In a typical automated manufacturing environment, data flows through multiple systems before reaching the financial statements:

Machine, sensor or operator input → manufacturing execution system → warehouse management system → ERP subledger → general ledger → financial statements

At each step, data integrity matters. Rather than requiring the CFO to validate every automated transaction, proper controls – source validation, system reconciliations, access restrictions, change management testing and audit trails – demonstrate that data is complete, accurate and appropriately authorized, providing management a sound basis for relying on automated information.

Automation reduces manual processes, but a single poor configuration can generate pervasive errors across thousands of transactions. Finance, operations and IT must be involved early in system design and user acceptance testing – before problems become entrenched in system flow.

Start at the Source

A CFO’s ability to rely on automated information begins with understanding where financial data originates and how it reaches the financial statements. Management should map how financially significant information moves from the warehouse, production line and third-party systems to the general ledger.

Key questions to address:

• Where is the data collected and by which system or individual?
• Which systems process, modify or transfer it?
• Which reports ultimately drive finance decisions?
• Who reviews the information and what audit trail is retained?

Common warning signs:

• Finance cannot explain how a key report is produced.
• Reports are manipulated manually outside the system without a documented process.
• System changes occur without the accounting department’s knowledge or approval.
• No designated data owner is accountable for reliability.

Focus on Reports that Drive Decision-Making

The reports that influence key business decisions or support the audited financial statements deserve management’s closest attention. The risks extend well beyond year-end; business decisions based on incomplete or inaccurate information can have serious and lasting consequences.

Key questions to address:

• Do reports reflect the correct facilities, transactions, dates and parameters?
• Is the underlying process that captures source data reliable?
• Can users alter data or report logic without authorization?
• Are manual adjustments subject to review and approval?

Effective controls over critical reports give CFOs confidence to accurately evaluate profit margins, set appropriate pricing, manage working capital, assess inventory levels, forecast cash flows and determine whether a location or product line is truly performing as expected – or simply appearing to do so.

Reconcile Automated Interfaces

Automated interfaces often run with little accounting involvement, making failures easy to miss. Because the process is automated, an error may also be repeated consistently or at a larger scale, creating a pervasive financial reporting issue rather than an isolated one. Management should know what moves between systems and what happens when a transaction fails.

A well-designed interface control process includes:

• Reconciling counts, quantities or dollar totals between systems on a regular cadence.
• Investigating rejected, duplicate or missing transactions and completing a root cause analysis, when applicable, to understand and prevent recurrence.
• Reviewing and approving manual corrections.
• Retaining evidence that discrepancies were identified and resolved.

Still Essential: Segregation of Duties and User Access Reviews

Automation does not eliminate the need for access controls and segregation of duties – it heightens it. As operating and enterprise systems become more connected, employees outside finance may influence information that directly affects revenue, inventory, cost of sales and other financial statement accounts. Inappropriate access or insufficient segregation of duties creates both financial reporting and fraud risks that can be difficult to detect precisely because they are embedded in automated processes.

Management should consider:

• Who can change production records, inventory, reports or interfaces?
• Can transactions be recorded without proper approval?
• Are shared accounts or unmonitored privileged users present?
• Are manual overrides separately identified and reviewed?

For smaller manufacturers unable to fully separate duties, compensating controls – independent reconciliations, exception reporting or governance-level oversight – can provide an effective alternative.

Minimize Downstream Risk of System Changes

Manufacturing systems can change throughout the year – and while a change may succeed operationally, it can silently disrupt financial reporting. A system modification that improves warehouse throughput, for example, may unintentionally alter how quantities, costs or transaction dates are transmitted to the enterprise resource planning (ERP) system.

Involving the finance department in significant system changes before they go live helps identify potential accounting consequences before they affect reporting output.

Changes that should involve finance:

• System implementations, upgrades and data conversions.
• New facilities, warehouses or product lines.
• Changes to bills of materials, standard costs or overhead allocations.
• New automated entries, custom reports, AI models or predictive analytics.

An effective change management process includes:

• Documentation of the change, its purpose and accounting impact.
• Approval from operations, IT and finance.
• Testing in a non-production environment with user acceptance sign-off.
• Reconciliation of results before and after implementation.

Securing Spreadsheets and Manual Workarounds

Even the most automated manufacturers often rely on offline spreadsheets for some of their most significant accounting calculations – inventory reserves, warranty estimates and current expected credit loss (CECL) models among them. These spreadsheets may serve as an important bridge between system data and the financial statements, but they also introduce risks: formula errors, uncontrolled changes, outdated data, hard-coded adjustments and version-control problems.

Management should identify critical spreadsheets and establish controls over:

• Access and editing rights.
• Formula protection.
• Version control.
• Independent review.
• Retention of supporting evidence.

When a spreadsheet becomes a recurring and financially significant part of a process, management should also evaluate whether that calculation belongs in a more controlled, auditable application.

Reduce Disruption through Audit Readiness

Finance teams that determine in advance what documentation supports the financial statements experience less year-end disruption. Depending on the company’s environment and the auditor’s risk assessment, relevant documentation may include:

• Process narratives and data-flow diagrams.
• A listing of financially significant systems.
• Evidence supporting the completeness and accuracy of critical reports.
• User access listings and review evidence.
• Exception reports and documented resolution.
• Service organization control (SOC) reports for relevant third parties.

Turning Reliable Data into Better Business Decisions

The value of strong controls over automated information extends well beyond satisfying an auditor. When a CFO understands how critical information is generated and trusts the controls supporting it, that confidence pays dividends throughout the year.

It means fewer unexpected accounting adjustments, more efficient investigation of discrepancies, a smoother financial close and audit process along with better information for forecasting and decision-making. It also frees finance teams to spend less time validating whether data is correct and more time using it to understand performance and support the business.

The goal is not to layer controls onto every automated process. It is to identify the information that matters most and establish sufficient oversight for management to rely on it – with confidence.

Contact Us

PKF O’Connor Davies works with privately held and middle-market manufacturers and distributors on financial statement audits, reviews, internal control considerations and other accounting and assurance matters.

To explore how changes in systems, automation and operational data may affect your financial reporting environment, please contact your client service team or:

Donny Butler, CPA, CISA
Partner
dbutler@pkfod.com | 781.937.5137

Victoria Swift, CPA
Director
vswift@pkfod.com | 781.937.5338