2024 Articles - Suits the C-Suite | SGV & Co. | EY

30 December 2024

Aaron C. Escartin

Enhancing payroll management with AI

IN BRIEF: AI-driven payroll solutions streamline complex international payroll operations, reducing errors and enhancing efficiency.Automating payroll processes with AI improves accuracy, compliance, and employee satisfaction.AI-powered chatbots provide quick, accurate responses to payroll inquiries, simplifying workloads and enhancing the employee experience. PULL QUOTE: "AI is revolutionizing payroll management by providing real-time insights, reducing errors, and enhancing employee satisfaction." Managing payroll for a global workforce presents a myriad of challenges due to constantly evolving political, legal, social, and economic factors. These changes impact regulatory requirements and reporting, making it difficult to navigate diverse labor laws, tax regulations, data privacy standards, and payment procedures. Consequently, the dynamic conditions increase employee inquiries, complicating payroll management. Companies need efficient, accurate, and cost-effective methods to address these inquiries, enhancing employee satisfaction and trust.The challenges of global payroll managementPayroll errors and delayed responses can lead to fines, damage organizational reputation, and frustrate employees, affecting costs and related functions like recruitment and retention. While preventing errors is crucial, traditional methods for handling these challenges are often costly and ineffective. Businesses are ready for an innovation – a solution that offers something greater than the sum of its parts. Finding a time-efficient, cost-effective, innovative, and globally adaptable solution that can grow with the organization demands taking stock of the entire system and adding something more: an ecosystem approach.How AI can helpArtificial intelligence (AI) presents a significant opportunity to transform payroll functions and enhance efficiency. By automating data collection and analysis, AI can identify trends and anomalies, providing real-time insights into payroll performance. This technology can help monitor payroll metrics, track progress against targets, and identify areas where additional investment or action is needed. By leveraging AI, companies can improve the accuracy and reliability of their payroll processes while freeing up time and resources for more strategic activities.Case study: AI-driven payroll solutionsMany organizations face the challenge of managing complex international payroll operations. One company needed a quick and accurate communication platform with their employees that would answer country- and employee-specific payroll questions within a broader global payroll operations environment. Weighing the desired outcomes and challenges, the company implemented an AI-driven payroll chatbot. This chatbot addressed employee payroll questions efficiently and accurately, providing accessible answers to employee questions easily and quickly. The cloud-enabled development of a large language model helped create a payroll chatbot capable of answering complex employee questions. The chatbot solved the company’s payroll needs in a way that was efficient for them as the employer, but it was also incredibly effective and beneficial for their employees. After the initial launch of a pilot version, the company scaled it to an enterprise-ready payroll chatbot that answered complex payroll questions by using an underlying large language model and vast compliance data. This solution helped reduce the burden on the employer while personalizing the employee experience.In very real terms, there were improvements across the board in providing accurate answers to queries, employee satisfaction, and first call resolution. There was also an overwhelming decrease in cost to serve. This is just one example of how AI can help accelerate and improve payroll management while simplifying the workload.An integrated global payroll solution Taking control and driving efficiency with an integrated global payroll solution involves transforming global payrolls through a unified managed services approach, integrating domestic, mobile, and global payroll services. A centralized, modular platform handles the complexities of an international workforce, connecting legal, advisory, and compliance knowledge for an integrated payroll experience.In today's fast-paced world, where talent is the key resource, managing the payroll of an increasingly international workforce has become very complex and time-consuming. The rapid pace of regulatory compliance, labor and privacy law changes, managing the life experience of employees, and the scarcity of payroll talent are just a few of the hurdles that organizations face. Traditional payroll models struggle to keep up with modern business demands and new ways of working. The risks of non-compliance, data privacy issues, and the high costs and inefficiency of managing multiple vendors are significant challenges.Taking initiative involves governance, oversight, and control. It means having single process ownership across employee entitlement, compliance requirements, and pay distribution. This approach provides a unified view of data, reduces duplication, ensures consistent decisions and reporting, and offers a holistic view of talent and compliance, enabling organizations to plan. Driving efficiency requires providing direct access to all subject-matter-experts and enabling effective risk management across the entire employee population. It helps reduce cost and labor leakage that occurs with disparate vendors, duplication of effort, gaps in essential knowledge and process, and inadequate business controls. Additionally, it improves in-house technology and data assets. Planning enhances the employee experience through advanced technology, streamlined processes, and easy access to on-the-ground knowledge. It also reduces the cost of developing and modifying technology.The future of payrollA next-generation payroll managed service approach combines global reach and deep capabilities, consistent multi-service integration, and direct access to teams across the globe. Across payroll, labor and employment law, and mobility, teams can work together collaboratively to meet workforce compliance needs wherever they are. Global processes, technology, and data models are smoothly integrated, providing a single, cohesive, high-quality service. Access to core service delivery without subcontracting to third parties helps ensure effective communication and improved performance. Being part of an ecosystem facilitates the provision of comprehensive solutions beyond payroll, leveraging deep knowledge to address unique challenges.Organizations can address global payroll operational and service challenges by leveraging AI technology to create innovative solutions, such as a payroll chatbot. The proper use of AI can help simplify employer workload, answer complex payroll employee queries, provide regulatory compliance information, and enhance employee experience, leading to increased operational efficiency. Aaron C. Escartin is a Tax Partner and Philippine Payroll Operate Leader of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the author and do not necessarily represent the views of SGV & Co.

23 December 2024

Anna Maria Rubi B. Diaz

Future-proofing finance with future-ready controllers

IN BRIEF:Financial controllers need to step beyond compliance to create value and remain indispensable copilots to CFOs in driving organizational innovation and growth.AI adoption enhances controller impact on enterprise-wide operational efficiency, contributing to macroeconomic growth.PULL QUOTE: “Organizations are sitting on a goldmine of financial data, yet this resource often remains underutilized. This is a crucial area where the expertise of controllers can be fully harnessed.” The rapid acceleration of digital transformation is reshaping the business landscape, compelling finance teams to manage returns on investment goals, meet customer demands for innovation, and align with long-term sustainability objectives — all at the same time.This intersection of often-competing demands characterizes today’s Age of And, where success relies on an organization’s ability to effectively navigate and excel in managing these demands simultaneously. This evolving landscape necessitates a strategic shift in roles. Financial controllers, in particular, are moving beyond their traditional focus on operational tasks such as bookkeeping, compliance, and resource allocation and are now positioned as strategic enablers of value creation.According to the 2024 EY DNA of the Financial Controller Report, 86% of surveyed controllers across 28 countries recognize that their responsibilities will evolve substantially over the next five years. To execute their redefined responsibilities, controllers must harness tools such as analytics, automation, and artificial intelligence (AI) to transform vast amounts of data into actionable insights that can support strategic decision-making. Predictive analytics enables controllers to identify trends, forecast scenarios, and optimize budgeting. For example, analyzing historical financial data facilitates cash flow prediction and improves financial planning, allowing for agile responses to business challenges.Automation tools like robotic process automation (RPA) streamline reconciliations and report generation, reducing errors and accelerating processes. Automating financial statement consolidation enhances accuracy and delivers timely insights, empowering controllers to focus on strategic activities.AI-powered solutions, such as machine learning algorithms, detect anomalies, assess credit risks, and anticipate market trends. These capabilities help controllers proactively manage risks and capitalize on strategic opportunities, reinforcing their role as value creators.However, the successful integration of these tools requires controllers to adapt their skillsets and embrace a more collaborative role with Chief Financial Officers (CFOs) as copilots in driving innovation and organizational agility. This shift fosters greater cohesion within finance teams, breaking down traditional silos that often hinder efficiency and strategic alignment.Creating value from dataOrganizations are sitting on a goldmine of financial data, yet this resource often remains underutilized. Controllers can unlock this value using AI tools to transform complex datasets into actionable strategies. AI automates routine workflows, such as data consolidation and reporting, enhancing accuracy and freeing controllers to concentrate on strategic responsibilities like risk assessment and planning. Additionally, AI-driven analysis empowers controllers to forecast trends and develop proactive strategies, elevating their role as strategic contributors.Beyond its micro-level benefits, AI has the potential to stimulate macroeconomic growth. In fact, a global tech study by a global tech company estimates that AI adoption among local businesses could contribute Php2.8 trillion to the Philippine economy by 2030.In the vital sector of micro, small, and medium enterprises (MSMEs), which account for 99.63% of the Philippine business landscape according to the 2023 List of Establishments by the Philippine Statistics Authority, a data-driven ecosystem is essential for streamlining operations, boosting productivity, and achieving sustainable growth.AI tools play a pivotal role by automating routine financial tasks such as accounts receivable (AR) collections. For instance, an AI-powered AR Collection Assistant helps prioritize accounts, identify at-risk customers, and recommend optimal actions. Integration with enterprise resource planning (ERP) systems creates a unified platform for agents, improving efficiency and simplifying follow-up processes. By leveraging AI and automation, businesses can strengthen governance, reduce costs, and enhance operational efficiency, leading to long-term value creation. Additionally, integrating AI into business processes allows MSMEs to analyze complex datasets swiftly, uncovering actionable insights for strategic decision-making. For example, AI-driven predictive analytics can forecast financial trends, enabling businesses to proactively align strategies with organizational goals.Upskilling for the futureWhile many companies understand the importance of digital transformation, recognition alone will not drive progress. Delayed implementation risks leave organizations mired in inefficiency while competitors advance toward innovation and growth.In the Philippines, a disconnect between ambition and readiness for AI adoption stalls digital transformation among companies. A survey by a different global tech company found that although 65% of local companies allocate 10-30% of their IT budgets to AI adoption, only 22% are fully prepared to implement AI technologies.One critical obstacle is the skills gap, with only 23% of survey respondents reporting employee proficiency in managing AI tools. Within finance teams, this shortfall hinders controllers from meeting their redefined responsibilities, ultimately limiting their contributions and impacting organizational success in an increasingly complex business landscape.Reimagining talent strategiesRedefined roles often encounter resistance, particularly as traditional roles for controllers have focused primarily on value protection (e.g. regulatory compliance) and value optimization (e.g. budget planning, cost analysis, and investment evaluation).To address this, organizations must prepare teams for future-oriented responsibilities in value creation. One clear step is articulating a compelling vision for the controller role, emphasizing how their redefined responsibilities can contribute to the company’s long-term growth strategy. This approach not only clarifies their evolving responsibilities but also motivates teams to align with broader organizational objectives.For new hires, prioritizing adaptable mindsets and a willingness to learn over rigid credentials ensures a more future-ready workforce. Meeting evolving role expectations also requires targeted upskilling through robust training programs, mentorship, and leadership opportunities, enabling controllers to excel in their redefined roles.Actions for finance leadersOrganizational support is critical to empower controllers and their teams to develop the necessary skills while managing day-to-day responsibilities. According to the EY report, 59% of controllers state that their organizations encourage them to evolve into value creators to a large extent. However, many feel they lack adequate resources and support to make the transition.CFOs and senior leaders can address this gap by allocating budgets for technology adoption and fostering cross-functional collaboration. Providing autonomy and facilitating engagement with the C-suite and key stakeholders can transform controllers into strategic drivers of value.CFOs can further empower financial controllers by:Integrating innovation into roles. Redefine job descriptions to include innovation as a core responsibility, directly linking it to performance metrics to ensure that controller efforts contribute to enterprise-wide value creation.Leading transformative projects. Provide controllers with leadership opportunities in transformation initiatives, supported by adequate budgets, staffing, and mentorship. These experiences cultivate strategic thinking and innovation capabilities.Focusing on future-ready skills. Equip controllers with expertise in data analytics, AI, and strategic decision-making. These skills will prepare them for evolving financial landscapes and amplify their organizational impact.Expanding responsibilities strategically. Gradually assign controllers additional responsibilities to deepen their expertise and prepare them for future leadership roles, including the position of CFO.Developing a talent pipeline. Build a robust talent pipeline by identifying high-potential candidates for controllership roles. Provide these individuals with targeted training and mentorship to ensure the role remains a source of innovation and leadership.The future-ready controllerControllers must take an active role in their evolution. By embracing opportunities to view value creation through a broader lens, they can enhance their contributions to financial planning and analysis (FP&A) and investor relations.Strengthening engagement with the C-suite and other key internal and external stakeholders is equally essential. Successful transformation into a redefined role ultimately requires a commitment to continuous personal development. To achieve this, controllers should focus on the following key areas:Embracing uncertainty and disruption. Proactively seek new opportunities to create organizational value, balancing these initiatives with compliance oversight and operational efficiencies.Exploiting the potential of data and AI. Leverage financial data alongside operational and external data sources to generate insights that enable informed executive decision-making. Additionally, develop a roadmap for an AI-enabled controllership team, identifying the necessary data, processes, and controls. Equipping teams for the future. Encourage agility by fostering diverse skills within teams, including business, personal, and technological capabilities. Inspire team members to view themselves as innovators and problem-solvers beyond their roles as financial and compliance experts.Prioritizing cultural adaptabilityOrganizations must embrace a cultural shift that prioritizes adaptability and a growth-oriented mindset over reliance on legacy processes. To complement this shift, organizations must integrate a digital-first culture to break down silos and enhance operational efficiency, giving way for better, data-driven decision-making across all functions. In doing so, controllers can leverage their redefined roles to streamline processes, provide actionable trends and insights, and drive innovation, making them integral contributors to sustainable growth and organizational success. Anna Maria Rubi B. Diaz is an Assurance Partner under the Financial Accounting Advisory Services (FAAS) of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the author and do not necessarily represent the views of SGV & Co.

16 December 2024

Maria Kathrina S. Macaisa-Peña

Shopper spending trends this season

IN BRIEF: According to EY research, 69% of global consumers will participate in this year’s value hunt, with one-third indicating they will spend more than last year. Smart, savvy, and shrewd consumers are willing to switch between channels for what they want, intensifying shopping channel fragmentation.PULL QUOTE: “Shoppers are becoming more strategic, concentrating on value, utilizing various shopping channels, and being selective with promotions.” Despite low consumer confidence, shoppers eagerly anticipate this year’s holiday sales. According to the EY Future Consumer Index, which surveys 13,000 respondents, 69% of global consumers intend to participate in this year’s value hunt. The data also reveals subtle yet significant shifts in consumer shopping plans, expectations, and values – trends that are expected to influence consumer behavior well beyond the holiday sales. Shoppers are considered “smart” for utilizing a full range of channels and technologies to obtain what they want; “savvy” for their ability to evaluate marketing and promotional offers; and “shrewd” for being more discerning about what value means to them.Consumers anticipate deals and stretch budgetsThe value hunt began earlier this year, with companies initiating seasonal sales in September or October partly in response to the US Thanksgiving holiday falling at the end of November, shortening the traditional five-week spending period by a week. Despite this, 52% of global consumers will delay spending holiday budgets, anticipating better deals. Most global consumers plan to only purchase products on sale this year, with 67% actively tracking market offers – a figure that rises to 73% among consumers with children.In the Philippines, two local online shopping platforms have seen year on year growth surges, with customers anticipating monthly deals such as 11.11 and 12.12 sales. One shopping platform saw a nine-fold increase in customer engagement throughout its 11.11 sale as customers earned discounts by participating in daily check-ins and challenges. One food and beverage corporation observed strong consumer Christmas spending based on the sales of their gift packages, predicting an increase in sales from the previous year. Shoppers are also more deliberate about when and how they spend, often due to cost concerns. Nearly half will be using loans, credit cards, and buy-now-pay-later solutions to defer shopping costs. However, not all consumers are borrowing; about half report having saved for the festive season. Regardless of the source of their funds, more consumers are determined to spend wisely this year, preferring to purchase items with lasting value and invest more in technology. For many consumers, festive shopping behavior is not driven by bargain hunting, with 48% of global consumers stating they will purchase the ideal gift regardless of whether it is on sale. Additionally, 64% of consumers often question the real value of promotions they encounter in festive sales, while 58% believe that their preferred items will not be on sale anyway.To optimize value, consumer products companies and retailers should concentrate on digital promotions and messaging. They should continuously refine digital promotions to match the consumer quest for value, and create distinctive sales promotions to quickly broaden audience reach and enhance perceived value. In addition, ensure that messaging remains current, integrated, and easily accessible throughout the holidays.Balance physical and social media commerce A physical store remains the primary shopping destination for 68% of consumers, but they are willing to switch between channels for what they want, intensifying ongoing fragmentation of shopping channels. The value of physical stores extends beyond the holiday atmosphere they provide, with many consumers preferring to physically experience a product before purchasing. Nevertheless, platforms such as TikTok, YouTube, and Instagram are set to become significant sales channels this season, particularly among Chinese consumers. In China, 50% of consumers plan to purchase through social media, compared to 24% in the US and 17% globally. According to a TikTok-commissioned study conducted by research company Kantar Profiles, which studied shopping behaviors in Southeast Asia during the festive season, 81% of Philippine TikTok users rely on TikTok to find new brands and products for the holidays while 77% of users use the platform for their Christmas shopping. Notably, 84% of local TikTok users participated in its mega sales events last year, and they are 2.3 times more likely to increase spending in 2024. Global consumers will increasingly adopt social sales channels as new capabilities enable brands to replicate the in-store experience. Leading brands are already using livestreams to create competitor-free spaces where consumers can ask about a product in real-time and click to purchase.While the range of channels might seem overwhelming, data indicates that consumers are adept at selecting the right one for their needs. Consumers are now prioritizing price over product, a shift from the norm as the value from promotions becomes a key differentiator in deciding where to shop. Although this approach works for shoppers, it exacerbates the ongoing challenge of channel fragmentation.To navigate the increasingly complex brand experience, companies must adopt a holistic approach to actively analyze, prioritize, and support the channels delivering the most value. Experiment with shoppable social content to accelerate the purchase journey and take advantage of impulse buying, then incorporate these insights into planning for next year.Gen Z preferences signal a future of sustainable choices Younger consumers are expected to be the most active shoppers this festive season. Gen Z, in particular, plan to increase their spending across nearly every category, including clothing, technology, and experiences. These consumers can be particularly demanding, as they are impatient, seek convenience, and value sustainability, indicating trends that more consumers will likely adopt in the coming years.Gen Z is prioritizing organic or sustainably sourced products, actively seeking brands that align with their values. A third plan to purchase second-hand goods as gifts, either to stretch their budgets or invest in higher-quality items they couldn’t afford if new.The rise of second-hand shopping and gifting could significantly impact categories such as fashion, while popular resale platforms offer Gen Z opportunities to find unique, affordable, and environmentally-friendly gifts. Some brands already capitalize on this trend by establishing or investing in resale platforms for their own goods. These platforms boost sales while helping brands, especially luxury ones, maintain a high-quality experience and limit counterfeit sales.As digital natives, younger consumers prefer using online channels with access to peer reviews and influencer content about potential purchases. Seeing someone relatable unboxing and using items eliminates the need to see them instore.Companies can focus on meeting Gen Z’s expectations for convenience, as they value having more control over deliveries and are likely to choose faster options, free shipping, and flexible delivery windows. For instance, 40% of Gen Z consumers value same-day delivery, compared to just 25% of Baby Boomers.While these expectations are challenging to meet profitably, data shows that 47% of younger consumers are willing to buy extra items to qualify for free shipping, compared to 35% of consumers over the age of 60. Companies that optimize their delivery logistics to meet this demand can drive additional purchases and increase their margins simultaneously.Moreover, themes of self-care and self-reward resonate more deeply with younger consumers. Gen Zers are more interested in beauty and personal care products than clothing, possibly because they are more discerning towards what needs to be new and what can be bought used. To connect with them during the holiday season, rethink product mixes and business models to incorporate preloved items, private labels, and emerging brands aligned with Gen Z values. Companies can create cost and distribution strategies that address their desire for control and convenience, and collaborate with influencers to enhance brand transparency and showcase value.Consumer behavior shifts beyond the holidays Despite global economic uncertainty, most consumers are enthusiastic about this year's festive sales while also becoming more strategic, concentrating on value, utilizing various shopping channels, and being selective with promotions. These trends signify a consumer behavior shift that will persist beyond the holidays. As consumers become more discerning, tech-savvy, and intentional towards deals, retail and consumer product companies must note how this influences their future strategies. Maria Kathrina S. Macaisa-Peña is a Business Consulting Partner and the Consumer Products and Retail Sector Leader of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the author and do not necessarily represent the views of SGV & Co.

09 December 2024

Carlo Kristle G. Dimarucut

Guiding Philippine SMEs through the cybersecurity journey

IN BRIEF: Attacks targeting small businesses are on the rise, and a single successful breach could jeopardize operations, customer trust, and business continuity.Rather than try to build a comprehensive security team from scratch — which can be prohibitively expensive — many small businesses are benefiting from "CISO-as-a-Service" models.This model allows companies to bring in experienced security professionals who offer strategic guidance, oversee critical cybersecurity activities, and provide access to a broader team of security specialists, all on a shared-service basis.PULL QUOTE: “By outsourcing key functions, adopting best practices step by step, and focusing on tools that blend security with usability, Philippine SMEs can more effectively protect themselves without overextending their resources.” In the Philippines, medium and small businesses (SMEs) often face significant challenges when it comes to cybersecurity. With fewer than 20 IT personnel on staff, many organizations may only have basic protections — such as antivirus software programs and a firewall — in place. It’s common for these businesses to not have implemented services like Active Directory, and handle cybersecurity as an afterthought rather than a priority.Yet, in today’s increasingly digital economy, these businesses are at risk. Attacks targeting small businesses are on the rise, and a single successful breach could jeopardize operations, customer trust, and business continuity. With that in mind, this article will discuss how Philippine SMEs with limited resources can embark on a cybersecurity journey that’s practical, achievable, and cost-effective.An effective approach: outsource for efficiencyOne of the most effective approaches towards cybersecurity for SMEs in the Philippines is to consider outsourcing cybersecurity functions. Rather than try to build a comprehensive security team from scratch — which can be prohibitively expensive — many small businesses are benefiting from "CISO-as-a-Service" models.A Chief Information Security Officer (CISO) as a service allows SMEs to access top-tier security expertise without having to hire full-time specialists. Through this model, companies can bring in experienced security professionals who offer strategic guidance, oversee critical cybersecurity activities, and provide access to a broader team of security specialists, all on a shared-service basis. This reduces costs while still ensuring that the business benefits from industry best practices.The cybersecurity journeyAssess current state. Begin by assessing the current capabilities of the company. Understand what assets must be protected, identify any existing vulnerabilities, and evaluate all current tools and configurations. An outsourced partner can help facilitate this process, providing an unbiased, thorough review of the company’s security posture.Focus on the fundamentals. For organizations that have limited resources and basic tools, starting with strong foundational controls is key. This includes the following:Endpoint Security: Go beyond simple antivirus programs by considering endpoint detection and response (EDR) tools. These can provide more visibility into potential threats and help respond to attacks quickly. Choose EDR solutions that are simple to deploy and have an intuitive interface, making them easy for the IT team to manage.Network Segmentation and Firewalls: Reinforce the company’s firewall setup and consider segmenting its network. This way, even if an attacker gains access to one part of the system, they won’t be able to move freely. Look for firewalls that offer user-friendly dashboards, allowing the IT team to easily understand and manage network activity.Prioritize identity and access management. Many Philippine SMEs may not have any form of identity management system yet in place. Implementing a cloud-based solution, such as a simple single sign-on (SSO) or even managed identity access solutions, can significantly reduce risk. These solutions simplify login processes for users while enhancing security. An outsourced partner can make these systems easy to deploy and manage, reducing the burden on the internal team.Embrace managed security services. As part of the company’s journey, outsourcing Managed Detection and Response (MDR) can be particularly valuable. Managed service providers have dedicated security operations centers (SOCs) and can monitor the company network 24/7 for suspicious activity — something most SMEs can’t do on their own. The MDR tools often come with simplified reporting and alerts that are easy for the internal team to understand, ensuring that even non-specialist staff can grasp the current security state.Employee awareness and training. Many attacks target employees through phishing or social engineering tactics. Implement regular training sessions for company employees to teach them how to recognize threats. This is also something that a managed partner can easily help facilitate. Look for training programs that are interactive and easy to understand, ensuring employees find them engaging rather than overwhelming.Adopt user-friendly security controls. One concern that often arises when discussing cybersecurity is that it may hinder productivity. However, many of today’s solutions focus on enhancing both security and usability. Multi-Factor Authentication (MFA), for example, may seem like an extra step, but when integrated properly, it makes logging in faster while also being more secure. Choose MFA tools that are simple to use and integrate seamlessly with the company’s existing systems. Prioritize tools that simplify administration and are transparent to users, ensuring security isn’t seen as a burden but rather as an enabler of efficient work.Benefits of outsourcing cybersecurity for SMESCost efficiency. Rather than investing in full-time employees and costly infrastructure, outsourcing enables paying only for what the company needs, when it is needed.Access to expertise. Cybersecurity is complex and constantly evolving. Partnering with a provider provides access to specialists who are on top of the latest threats and trends.Scalable solutions. Outsourcing allows the scaling of security capabilities as the business grows, meaning companies do not have to worry about outgrowing their protections.Faster implementation. Leveraging external resources means that new security controls can be implemented faster, helping the business reach an improved level of security in weeks, rather than months or years.Transforming security for growthAs an example, a local medium-sized business had started with just an antivirus program and a basic firewall. They began their cybersecurity journey by gradually adopting outsourced cybersecurity services, such as MDR and a CISO-as-a-Service. Over time, they were assisted in implementing more sophisticated controls — including endpoint detection, identity management, and cloud security. While their footprint is smaller compared to global organizations, their level of protection is now at par with international standards.Throughout the journey, their service provider kept a focus on ease of administration and usability. The goal of their journey wasn’t just to make the organization more secure but also to make it easy for their employees to operate securely — resulting in a more productive and safer environment for everyone.Beginning the cybersecurity journey todayThe path to cybersecurity doesn’t have to be overwhelming. By outsourcing key functions, adopting best practices step by step, and focusing on tools that blend security with usability, Philippine SMEs can more effectively protect themselves without overextending their resources. Remember, it’s not about where the company starts — it’s about taking that first step towards securing the business for the future. Carlo Kristle G. Dimarucut is a Technology Consulting Partner of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the author and do not necessarily represent the views of SGV & Co.

02 December 2024

Joseph Ian M. Canlas and Christiane Joymiel C. Say-Mendoza

Integrating ESG into risk management

IN BRIEF: Integrating environmental, social, and governance (ESG) into risk management is not just a moral imperative but a strategic necessity.As companies are increasingly required to outline their ESG policies and positions, it is crucial to evaluate how these commitments are being assessed and judged.There is a growing consensus that sustainability risk is also a financial risk, and corporate strategies need to reflect this broader perspective. PULL QUOTE: "By integrating ESG principles into risk management, companies can safeguard their operations against climate-related risks and promote inclusive growth, driving real and positive change." Integrating environmental, social, and governance (ESG) into risk management is not just a moral imperative but a strategic necessity. As businesses navigate a landscape where ESG considerations significantly impact operations and reputation, integrating ESG into risk management becomes crucial. This article explores how companies can integrate ESG into risk management to build resilient, sustainable, and ethically grounded business practices.The crucial role of ESG in risk managementAs companies are increasingly required to outline their ESG policies and positions, it is crucial to evaluate how these commitments are being assessed and judged. Most companies release an annual ESG report, which customers and other key stakeholders review to ensure alignment with their values, and which investors use to support their investment decisions. Companies that pursue management system certification (e.g., ISO Management Standards, Environmental and Energy certifications, etc.) can integrate ESG goals from the initial planning stage of the PDCA (Plan-Do-Check-Act) cycle. The check phase allows them to evaluate the effectiveness of their policies and processes in meeting their commitments and take appropriate actions. This approach also helps proactively address potential risks, build resilience against ESG-related shocks, and comply with regulatory requirements. Enhancing existing risk management practices is vital because negative ESG incidents are increasingly damaging and costly. Research by international ratings firm Morningstar Sustainalytics indicates that companies experiencing significant ESG incidents lost an average of 6% of their market capitalization. Additionally, incorporating ESG into risk management is not just about avoiding negative outcomes; it also involves seizing opportunities to create value and drive innovation. Companies that effectively manage their ESG risks are well-positioned to succeed in a rapidly changing global business environment.According to the 2025 Asia Pacific Risk in Focus study, a survey conducted by the Institute of Internal Auditors, organizations consider climate change or environmental risk to be in their top ten risk expectations this year but consider it to be in their top five in the next three years, highlighting its increasing significance and the need to address it sooner than later. Companies with effective ESG practices are less likely to encounter harmful controversies and are better equipped to respond when incidents occur. Medium and smaller firms may not face the same level of stakeholder scrutiny or regulatory requirements, but they are equally at risk from ESG incidents, which can be even more damaging. Without the support of major investors, smaller companies may struggle to recover from adverse events. In essence, ESG risk is a material risk, and failing to address it promptly and appropriately can lead to severe consequences.Integrating ESG principles in the ERM processAccording to the 2023 EY Global Board Risk Survey, highly resilient boards are more aware of the potential of ESG governance to create long term value as well as more aware of the sustainability risks their organization may face. Integrating ESG factors into enterprise risk management (ERM) process is crucial for enhancing executive management’s understanding of risk, encouraging a collaborative relationship with risk owners and risk management units, ensuring regulatory compliance, protecting reputation, mitigating risks, and ensuring long-term sustainability.Boards can accomplish this by incorporating ESG risk assessments into regular risk identification processes and exploring how climate change impacts the business model. Companies should adopt a comprehensive approach encompassing internal and external factors, identifying financially material ESG risk exposures through a materiality assessment. In addition, create strategies to mitigate any identified ESG risks, and regularly monitor these and report progress to stakeholders. The current regulatory landscape In recent years, government regulators have introduced various ESG-related regulations, primarily focusing on reporting and disclosure requirements. However, laws and regulations that mandate a more proactive approach towards ESG were deemed essential. Two significant steps in this direction are the Extended Producer Responsibility (EPR) Act of 2022 and the proposed Local Carbon Economy Law.The EPR Act of 2022 addresses the Philippines' plastic pollution problem by requiring large enterprises to establish programs for the effective recovery of plastic waste. Companies must meet target recovery rates, starting at 40% in 2024 and increasing by 10% annually until 2028. This act aims to ensure that producers take responsibility for the entire lifecycle of their products, particularly in managing post-consumer waste.The proposed Local Carbon Economy Law seeks to create a framework for reducing carbon emissions at the local level, promoting sustainable practices, and encouraging the development of a low-carbon economy. This law aims to align local initiatives with national and international climate goals, fostering a more sustainable and resilient economy.Over the years, the Philippines has made significant strides in promoting ESG practices. In 2019, the Securities and Exchange Commission (SEC) issued Memorandum Circular No. 04, requiring publicly listed companies (PLCs) to submit sustainability reports. These reports assess and manage non-financial performance across economic, environmental, and social aspects, enabling PLCs to measure and monitor their contributions towards achieving universal sustainability targets and national policies.The Philippine government is actively working to enhance its ESG regulatory framework. The country has expressed its intention to adopt the International Sustainability Standards Board (ISSB) standards, demonstrating a commitment to align with international best practices. In October 2021, the Sustainable Finance Taxonomy Guidelines (SFTG) for the Philippines were developed through cooperative efforts between the SEC, the Bangko Sentral ng Pilipinas (BSP), and the Insurance Commission (IC). These guidelines, drawing on the ASEAN Taxonomy’s Foundation Framework, initially focus on climate change mitigation and adaptation, with plans to include ecosystems, biodiversity, circular economy, and potential social objectives in future iterations. Additionally, the SEC plans to fully implement the Association of Southeast Asian Nations Sustainable and Responsible Fund Standards (ASEAN SRFS) to enhance transparency and uniformity in reporting.With climate risks looming, the business community has also increasingly integrated ESG into their operations and reporting over the past few years. Several companies in the Philippines have been recognized for leading the way in adopting ESG practices, setting examples for others to follow. To help their organizations manage ESG risks, Chief Audit Executives (CAEs) can help define the Board’s role in sustainability requirements, overseeing the processes around approving disclosure reports. Greenwashing, or the act or practice of making something appear more environmentally friendly than it actually is, poses a new kind of risk that must be incorporated into the overall risk assessment. CAEs can provide assurance for the accuracy of sustainability reporting and guard against potential greenwashing. Driving real and positive changeCompanies that prioritize ESG have been shown to have a positive correlation with financial performance and attractiveness to investors. Many business leaders recognize the importance of strong ESG governance, oversight, and accountability. There is a growing consensus that sustainability risk is also a financial risk, and corporate strategies need to reflect this broader perspective. By integrating ESG principles into risk management, companies can safeguard their operations against climate-related risks and promote inclusive growth, driving real and positive change. Joseph Ian M. Canlas is a Risk Consulting Partner and ASEAN Core Consulting Quality Leader, and Christiane Joymiel C. Say-Mendoza is a Risk Consulting Partner, both of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the authors and do not necessarily represent the views of SGV & Co.

25 November 2024

Aris C. Malantic and Benjamin N. Villacorte

Beyond Metrics: Creating lasting value in the "Age of And"

IN BRIEF: CFOs are uniquely positioned to integrate sustainability into financial strategies and drive long-term value creation.Advanced AI and data analytics offer CFOs powerful tools to enhance reporting accuracy and transparency.By fostering deeper engagement with investors and stakeholders, CFOs can build trust and confidence in their company's sustainability commitments. PULL QUOTE: "In the Age of And, CFOs must balance short-term pressures with long-term goals to drive sustained performance.”In today's rapidly evolving business landscape, the role of the Chief Financial Officer (CFO) has never been more critical in driving long-term value. Investors are increasingly demanding clear and credible narratives on how companies will create long-term value while managing immediate challenges. However, recent research highlights significant doubts among both CFOs and investors regarding the reliability of non-financial reporting and the achievement of sustainability targets.The challenge of non-financial reportingThe 2024 EY Global Corporate Reporting Survey, which surveyed more than 2,000 finance leaders and 815 institutional investors globally, reveals a concerning level of skepticism surrounding transparency and sustainability. Only about half of the finance leaders and investors surveyed believe that companies will likely meet their stated sustainability targets. This doubt is compounded by perceptions of greenwashing, where companies are seen as overstating their environmental efforts without substantial actions to back up their claims.Non-financial reporting, particularly in the realm of sustainability, is still maturing. Unlike financial reporting, which is governed by well-established standards and metrics, sustainability reporting often relies on voluntary frameworks that widely vary. The lack of standardization can lead to inconsistencies and a lack of confidence in the reported data. CFOs, therefore, face the dual challenge of improving the quality of non-financial reporting while ensuring that it aligns with investor expectations and regulatory requirements.Balancing multiple priorities in The Age of AndIn what is termed the "Age of And," CFOs are tasked with the complex challenge of balancing short-term financial pressures with long-term strategic goals. This involves making informed capital allocation decisions that drive growth in areas such as artificial intelligence (AI) and sustainability while also meeting near-term performance expectations.The "Age of And" reflects a business environment where companies must simultaneously address multiple, often conflicting, priorities. For CFOs, this means developing strategies that ensure immediate financial stability and position the company for future growth. This balancing act requires a deep understanding of both financial and non-financial drivers of value, as well as the ability to communicate these effectively to investors and other stakeholders.Building credibility in sustainability reportingTo address these challenges, CFOs must take proactive steps to enhance the credibility of their sustainability reporting. This involves understanding investor requirements, resetting non-financial reporting standards, and integrating sustainability into financial decision-making processes. By doing so, CFOs can provide the structured insights needed to distinguish their companies in the market.One of the key steps in building credibility is ensuring that sustainability disclosures are backed by rigorous data and due diligence. This means going beyond mere compliance with reporting standards to provide a transparent and verifiable account of the company's sustainability efforts. CFOs should work closely with sustainability officers and other key stakeholders to develop robust reporting frameworks that can withstand scrutiny from investors, regulators, and the public.The role of AI in enhancing sustainabilityAI presents a significant opportunity to transform finance functions and enhance sustainability efforts. It can improve the efficiency of core processes, enhance data analytics, and generate insights that drive value creation. However, the successful implementation of AI requires strong data and technology foundations as well as a responsible approach to building trust in AI systems.AI can help CFOs address some of the key challenges in sustainability reporting by automating data collection and analysis, identifying trends and anomalies, and providing real-time insights into the company's performance. For example, AI tools can be used to monitor sustainability metrics, track progress against targets, and identify areas where additional investment or action is needed. By leveraging AI, CFOs can improve the accuracy and reliability of their reporting while also freeing up time and resources for more strategic activities.Recommendations for CFOsEnhance reporting credibility. CFOs should ensure that their sustainability reporting is backed by rigorous data and due diligence to avoid perceptions of greenwashing. This involves developing robust reporting frameworks, conducting regular audits, and engaging with stakeholders to ensure transparency and accountability. To provide additional comfort to their stakeholders, CFOs and financial reporting teams should endeavor to align sustainability reporting with financial and regulatory reporting implications and disclosures to achieve consistency in reporting. Leverage AI. Utilize AI to improve data analytics and decision-making processes, ensuring that the technology is built on solid data foundations and adheres to ethical principles. CFOs should invest in AI tools that can enhance the efficiency and accuracy of their reporting while providing valuable insights into the company's performance. This includes developing a clear strategy for AI implementation, training staff on the use of AI tools, and establishing governance frameworks to ensure the responsible use of AI.Engage with investors. Building deeper engagement with investors is crucial for gaining their trust and confidence. CFOs should regularly communicate with investors about the company's sustainability efforts, progress against targets, and plans for future growth. This includes providing detailed and transparent reports, hosting investor briefings, and seeking feedback from investors to understand their concerns and expectations.Cultivate a sustainability-driven culture. CFOs should play a key role in fostering a culture of sustainability within the organization. This involves promoting sustainability as a core value, encouraging collaboration between different departments, and providing training and resources to support sustainability initiatives. By embedding sustainability into the company's culture, CFOs can ensure that it becomes a key driver of long-term value creation.Driving long-term value through sustainable practicesCFOs play a pivotal role in shaping the future of their organizations by providing credible, transparent, and forward-looking reporting. By addressing investor concerns and integrating sustainability into their financial strategies, CFOs can build trust and drive long-term value creation. In doing so, they position themselves as essential strategic partners to the CEO and the board, capable of navigating the complexities of the modern business environment.The journey towards reliable non-financial reporting and sustainable value creation is challenging, but it is also an opportunity for CFOs to demonstrate their leadership and vision. By taking proactive steps to enhance reporting credibility, embed sustainable principles into their core operations, leverage AI, engage with investors, and foster a culture of sustainability, CFOs can ensure that their companies are well-positioned for long-term success in the Age of And. Aris C. Malantic is the Financial Accounting Advisory Services (FAAS) Leader, and Benjamin N. Villacorte is the Sustainability Services Leader, both of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the authors and do not necessarily represent the views of SGV & Co.

18 November 2024

Joseph Ian M. Canlas and Christiane Joymiel C. Say-Mendoza

Harnessing the human element in cybersecurity

IN BRIEF: Recognizing employees as the cornerstone of cybersecurity, organizations must shift from tech-centric defenses to fostering a vigilant, security-aware culture.Comprehensive education and behavioral change strategies are essential to mitigate human-related security risks and reinforce a collective approach to cybersecurity.A balanced strategy that combines technological tools with human oversight and continuous cultural development is key to maintaining a resilient cybersecurity posture. PULL QUOTE: "Empowering employees with knowledge and vigilance is as crucial as technology in building a resilient cybersecurity defense.” In today’s rapidly evolving digital landscape, cybersecurity threats are more sophisticated and pervasive than ever. While companies invest heavily in advanced technologies and security protocols, the most critical line of defense consists of their own employees. Despite having robust security measures in place, organizations frequently find themselves vulnerable due to human error, negligence, or a lack of awareness. This reality underscores the urgent need for a shift in focus—from solely relying on technology to cultivating a culture where every employee actively contributes to cybersecurity.The critical role of human behavior in information securityThe prevalence of cyber threats in our interconnected world is undeniable, and the assumption that technology alone can safeguard information security and privacy is a misconception. A security-conscious culture within an organization is essential to effectively complement and enhance the technical safeguards already in place. IT risk management, therefore, must be a holistic practice that not only includes technological solutions but also addresses the human factors that significantly influence the security landscape.The impact of human error on security breachesHuman error continues to be a significant contributor to security breaches, with recent statistics from the 2024 Verizon Data Breach Investigations Report indicating that 68% of breaches involve some form of non-malicious human element. According to IBM, the financial repercussions are staggering, with the global average cost of each data breach in 2024 reaching USD 4.88M — the highest total ever recorded. This figure reflects direct financial losses and encompasses the long-term reputational damage that organizations suffer following a breach. Case studies from various industries have shown that breaches often stem from a lack of awareness or negligence, underscoring the importance of addressing human error as a critical component of cybersecurity strategies.Understanding human behavior in cybersecurityDelving into the psychological and behavioral aspects of cybersecurity reveals that human actions are often the weakest link in security chains. Common risky behaviors such as password reuse, oversharing on social media, and susceptibility to phishing and social engineering attacks can significantly compromise an organization's security. To effectively mitigate these risks, it is imperative to understand the underlying motivations and cognitive biases that drive such behaviors and to develop targeted strategies that promote secure practices.To combat the risks associated with human behavior, organizations must implement comprehensive and continuous education programs that raise awareness about the dangers of insecure practices and actively engage employees in adopting and maintaining secure habits. These programs should be dynamic, incorporating real-life scenarios and practical exercises that resonate with employees and foster a sense of personal responsibility for cybersecurity.Building and sustaining a security-conscious cultureCreating a security-conscious culture within an organization begins with the development of engaging and effective training programs. These programs should be designed to capture the attention of employees, providing them with the knowledge and skills necessary to recognize and respond to cybersecurity threats. Leadership commitment is crucial in reinforcing the importance of these programs, ensuring that security awareness is not just a one-time event but an ongoing priority.A human-centered approach to designing security processes and IT risk management is essential. By considering the user experience and incorporating principles of secure-by-design and human-centered design, organizations can create systems and processes that naturally encourage secure behaviors. The promotion of security champions within teams can also further embed security awareness into the fabric of business operations.The responsibility for maintaining a secure environment extends beyond the cybersecurity function or the Chief Information Security Officer (CISO). It is a collective responsibility that requires the engagement and participation of every employee. By instilling a culture where security is viewed as a shared obligation, organizations can create a more resilient and vigilant workforce capable of defending against cyber threats.Technology and human oversight: a balanced approachWhile technology plays a vital role in supporting good security habits through tools such as two-factor authentication and password managers, human oversight remains indispensable. Employees must be trained to understand the limitations of these tools and to remain vigilant in their daily activities, ensuring that security practices are consistently applied.The balance between automating security processes and maintaining human oversight is particularly important in the context of Zero Trust models. These models, which integrate privacy, security, and cyber resilience, rely on a combination of technology and human insight to verify trustworthiness and manage access to sensitive resources.Evaluating the effectiveness of security awareness programs is critical to ensuring that they are meeting their objectives. Organizations should employ strategies for continuous improvement, staying abreast of emerging threats and adapting their programs to address the evolving cybersecurity landscape.Securing the futureFostering a culture of security and privacy awareness is a collective endeavor that requires the active participation of every individual within an organization. By integrating the human element into IT risk management strategies, organizations can build a resilient defense against cyber threats. Continuous education and cultural evolution are imperative in promoting this balanced approach in risk management, ensuring that organizations remain vigilant and prepared to face the rapidly evolving cybersecurity challenges of the digital age. Joseph Ian M. Canlas is a Risk Consulting Partner and ASEAN Core Consulting Quality Leader, and Christiane Joymiel C. Say-Mendoza is a Risk Consulting Partner, both of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the authors and do not necessarily represent the views of SGV & Co.

11 November 2024

Joseph Ian M. Canlas and Christiane Joymiel C. Say-Mendoza

Managing third-party risk

IN BRIEF: Shifting from traditional Third-Party Risk Management (TPRM) to agile, real-time methodologies is crucial due to the intricate interdependencies and evolving cyber threats in IT operations.Proactive TPRM, powered by AI, enables organizations to predict and respond to third-party risks swiftly, ensuring continuous IT security.Embracing transparency and strategic collaboration with vendors fortifies TPRM, equipping organizations to handle emerging challenges and maintain robust IT systems.PULL QUOTE: " Proactive and AI-powered TPRM is vital for navigating the complexities of today's IT ecosystems and effectively managing third-party risks. In an era where technology is deeply integrated into business operations, managing third-party risk has become a critical concern for organizations worldwide. The traditional methods of Third-Party Risk Management (TPRM) are being challenged by the fast-paced and complex nature of modern IT environments, where external vendors play a pivotal role in day-to-day operations. As the reliance on third parties grows, so does the potential for risk, making it imperative for TPRM strategies to keep pace with the dynamic landscape of IT risks. This article seeks to explore the transformative approaches necessary for managing third-party risks effectively, ensuring that organizations can maintain robust IT operations amid the ever-present threat of external vulnerabilities.The evolving landscape of TPRM in IT operations The complexity and interconnectivity of modern IT operations demand a more agile and continuous approach to managing third-party risks. This necessity is underscored by the escalating frequency and sophistication of cyber threats, which can significantly impact IT operations. As businesses become more reliant on third-party vendors for essential services, the potential for risk exposure grows, highlighting the need for TPRM strategies that can adapt to new threats as they emerge. The evolving landscape of TPRM in IT operations requires a strategic shift from static, periodic assessments to a dynamic, real-time risk management model that is capable of identifying and mitigating risks promptly.From static to dynamic TPRM: adapting to real-time threats The transition from a traditionally reactive TPRM approach, characterized by annual assessments, to a more proactive and dynamic model marks a significant shift in risk management practices. This shift necessitates the continuous monitoring of third-party activities to swiftly identify and address potential risks.As an example, a global organization implemented continuous real-time monitoring tools to proactively assess third-party risks. By leveraging advanced analytics and real-time data, they were able to swiftly detect and mitigate potential vulnerabilities introduced by external vendors, enhancing their overall security posture. Continuous threat intelligence and monitoring solutions allowed the organization to detect and respond to third-party risks in real time, minimizing the window of exposure to potential threats.Integrating cyber threat intelligence (CTI) into this proactive TPRM framework offers a strategic advantage, transforming reactive security measures into a forward-thinking, intelligence-driven approach. By enabling real-time monitoring of potential vulnerabilities and emerging threats, CTI enhances the ability to share tactical intelligence with industry peers and conduct comprehensive risk assessments, thus strengthening the overall security posture of the extended enterprise. The importance of this approach was starkly highlighted by incidents such as the CrowdStrike incident, which exposed vulnerabilities in third-party risk management and had profound implications for critical IT infrastructure. Incidents such as these serve as wake-up calls, prompting organizations to reevaluate their TPRM practices. The evolution of TPRM practices post-incident, focusing on lessons learned and the implementation of strategies to prevent similar issues, is essential for safeguarding IT operations against the ubiquitous risk of third-party threats.Interdependencies between TPRM and IT operations The interdependencies between TPRM and IT operations are becoming increasingly apparent as third-party failures, such as cybersecurity breaches or service outages, directly impact IT operations. These incidents can have cascading effects across an organization, affecting everything from data security to business continuity. For example, an organization that experienced a service disruption due to issues with a third-party provider strengthened its incident response and disaster recovery plans by implementing redundancy measures and conducting regular recovery drills. This integration of TPRM and IT operations ensured that the organization could swiftly recover and maintain operational stability during future vendor-related disruptions.The integration of TPRM with IT disaster recovery and incident response planning is crucial for building resilience. Organizations must employ redundancy, backup systems, and other measures to mitigate the impact of third-party risks on IT operations. Understanding these interdependencies is vital for developing robust TPRM strategies that can withstand the ripple effects of third-party issues and maintain operational stability.Navigating unforeseen changes and unvetted updates from vendors The challenge of navigating unforeseen changes and unvetted updates from vendors is becoming increasingly relevant in today's IT landscape. Vendors' software or service updates are often released without comprehensive testing, and these can introduce significant vulnerabilities or compatibility issues. Organizations must develop adaptive response mechanisms to quickly adjust to these changes.For instance, one organization faced unexpected compatibility issues when a vendor released a critical software update without thorough testing. In response, they established an automated testing environment to assess vendor updates before deployment, allowing for seamless integration with existing systems and minimizing operational disruptions.This includes maintaining robust patch management processes, utilizing automated testing environments, and employing rapid deployment frameworks to ensure the continuity and security of IT operations. By adopting such strategies, organizations can better manage the risks associated with unpredictable vendor changes and maintain the integrity of their IT infrastructure.Future-proofing TPRM Future-proofing TPRM strategies with advanced technologies and collaboration is essential for staying ahead of potential third-party risks. Leveraging AI and machine learning can provide predictive insights into third-party risks based on patterns and trends, enabling organizations to anticipate IT disruptions before they occur. For example, a logistics company used AI-driven predictive analytics to identify potential disruptions from third-party providers, such as delays due to external factors. This allowed them to adjust operations proactively, minimizing risks and maintaining service continuity.Enhancing vendor collaboration and transparency ensures that all parties are aligned on updates, vulnerabilities, and risks. Additionally, the continuous integration of feedback from IT incidents, risk assessments and cyber threat intelligence into the TPRM framework drives ongoing improvements, ensuring that TPRM strategies remain effective and aligned with the evolving IT landscape, providing organizations with actionable intelligence, facilitating informed decision-making, and fostering a proactive security posture.Evolving together – the future of TPRM in IT-driven environments As IT operations continue to evolve at a rapid pace, the need for an evolving, dynamic approach to TPRM becomes increasingly apparent. Organizations must view TPRM as an integral component of their IT strategy and resilience planning, rather than as a mere compliance requirement. Managing third-party risk in an IT-centric world requires a forward-thinking approach that embraces advanced technologies, collaboration, and continuous improvement. By adopting dynamic TPRM strategies and viewing them as integral to IT strategy, organizations can confidently and effectively navigate the challenges of an IT-driven environment and secure their operations for the future. Joseph Ian M. Canlas is a Risk Consulting Partner and ASEAN Core Consulting Quality Leader, and Christiane Joymiel C. Say-Mendoza is a Risk Consulting Partner, both of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the authors and do not necessarily represent the views of SGV & Co.

04 November 2024

Christiane Joymiel C. Say-Mendoza and Joseph Ian M. Canlas

Key components for strategic risk management

IN BRIEF: Board surveys reveal a pressing need for more effective risk management, with several boards recognizing room for improvement.The strategic empowerment of CROs is essential to navigate the complex risk landscape and capitalize on emerging opportunities.Implementing a connected risk approach and embracing technology are key steps to advancing risk management practices and driving organizational value.PULL QUOTE: " As organizations strive for resilience amid escalating risks, empowering CROs is essential. They must break down silos, foster collaborative interactions, adopt a connected risk approach, and harness technology to modernize risk management strategies." In an era where risk landscapes are rapidly evolving, the role of Chief Risk Officers (CROs) has never been more crucial. The 2023 EY Global Board Risk Survey revealed a stark reality: 60% of boards agree that emerging risks are insufficiently addressed in risk management. Looking ahead, the survey suggests that boards need to strengthen their governance structures, processes and knowledge to improve oversight of both risks and opportunities.The survey further echoes the urgency for robust risk management, identifying various risks poised to severely impact organizations in the upcoming year. From geopolitical events and supply chain disruptions to cyberattacks and changing customer demands, the array of threats is diverse and daunting. Notably, while certain risks such as changing customer demands have decreased in perceived importance since 2021, others like misaligned culture and increased remote working have surged in significance.Empowering the risk steward/Chief Risk Officer (CRO)Successful risk management lies in the empowerment of the CRO. In many non-regulated sectors, this role is not formally recognized within the C-suite, despite the intense demands on risk leaders. As the complexity of the risk environment evolves, the need for CROs to collaborate closely with executive management and the board becomes paramount.Boards now expect executive management to identify risks and uncover the opportunities they may present. For example, a competitor's new joint venture could be seen as a threat, but from a strategic standpoint, it might also represent an acquisition target or potential partnership. Additionally, boards are calling for a deeper understanding of interconnected risks and their second-order impacts, such as the multifaceted challenges posed by climate change.CROs must be fully integrated into the business strategy and kept abreast of emerging megatrends that could affect the organization. Their insights are invaluable for mitigating downside risks and seizing "upside" opportunities. To be effective, CROs need clear and open communication channels with other senior executives and should be involved in regular management reporting, including strategies, business plans, and investment proposals.Successful risk stewards are characterized by their ability to break down organizational silos and work across all lines of defense. They understand the cultural risk appetite and can motivate leaders to adopt a common risk definition. Their experience in prioritizing risk outcomes is crucial for organizational performance.Connected risk approachA connected risk approach leverages improved data access to risk taxonomy, implement dynamic risk assessment methods that adapt to the changing business environment and coordinate risk response and reporting across all Three Lines (e.g., management, risk and compliance teams and internal audit). This approach unifies data on a common platform, offering continuous refresh capabilities and creating value through analytics and dashboards for better risk management planning.To execute a connected risk approach, an integrated risk taxonomy is essential. It provides a single view of risk by connecting data from traditionally siloed functions across the Three Lines. This enables rapid identification and assessment of risks that matter. Building a dynamic risk assessment is a collaborative effort that must be comprehensive and flexible, incorporating new data and market changes for agility.The dynamic risk assessment process includes orienting the mandate to manage risk, identifying risks through data-driven inputs, prioritizing current risks, and responding in a manner that fits the organization's risk posture. It incorporates qualitative assessments, quantitative metrics, risk performance leveraging a common taxonomy, and external data to challenge internal risk assessments.Technology-enabled risk managementThe 2023 EY Global Board Risk Survey indicates that only 31% of boards say their oversight of risks related to digital transformations is very effective, while 19% say it is slightly or less effective. Traditional risk management, which relied on professional judgment and manual processes, must evolve to take advantage of automation and data analysis capabilities.Integrated Risk Management treats risk and compliance activities as an enterprise-wide responsibility, promoting transparency and better decision-making. Automation technology can process low-value manual tasks and free up management time to enable them to focus on emerging risks, while data collection and monitoring can be automated to occur in real time to flag issues earlier. Cloud and AI technologies can execute complex scenario analyses and reveal insights into risk interdependencies.An integrated risk platform is foundational for connected risk capabilities, storing and modeling relationships between various data sources. This unified technology solution provides better insights, enabling a common risk ecosystem, consolidating risk management activities, and managing customer expectations through informed risk-taking.Fostering resilient risk leadershipTo be risk resilient, the boards need to understand the full spectrum of current and emerging risks that could impact the organization. CROs can swiftly generate value by aggregating risk registers to form a comprehensive risk landscape and conducting collaborative sessions to unify risk definitions across the organization. This establishes a centralized framework and common taxonomy, essential for integrating risk management with strategic and operational planning. By embedding risk considerations into decision-making and employing technology for automation, CROs enhance the organization's proactive risk posture, turning risk management into a strategic asset for resilience and success.As organizations strive for resilience amid escalating risks, empowering CROs is essential. They must break down silos, foster collaborative interactions, adopt a connected risk approach, and harness technology to modernize risk management strategies. The strategic empowerment of CROs is not just beneficial—it is imperative for safeguarding and driving value. Christiane Joymiel C. Say-Mendoza and Joseph Ian M. Canlas are Business Consulting Partners of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the authors and do not necessarily represent the views of SGV & Co.

28 October 2024

Victor C. De Dios

The far-reaching effects of VAT on digital services

IN BRIEF: As more countries legislate on the imposition of consumption tax on digital services, the Philippines joins the list with the recent enactment of Republic Act No. 12023, commonly known as the VAT on digital services law. The law defines digital service providers (DSPs) as the suppliers of digital services consumed in the Philippines, and sets certain VAT obligations upon them, both resident and non-resident.The far-reaching effects of the new law are to be felt more by non-resident DSPs who are assigned unprecedented VAT responsibilities.PULL QUOTE: “For the very first time, a Philippine law calls the attention of non-resident businesses, DSPs in particular, to comply with local VAT requirements such as registration, invoicing, and more importantly, VAT payment.” The digital economy significantly changed the landscape of doing business worldwide, and with this change comes the obvious need for governments to regulate, as well as the opportunity to conceptualize measures for raising revenue. As more countries legislate on the imposition of consumption tax on digital services, the Philippines joins the list with the recent enactment of Republic Act No. 12023, commonly known as the VAT on digital services law. This new law took effect last 18 October 2024. According to the Department of Finance, the initiative is set to generate an estimated Php16 billion VAT collection annually, and somehow level the playing field between traditional and digital businesses. It introduces amendments to the general VAT provisions of the Tax Code, putting emphasis on ‘digital service’ as among the services subject to VAT. It defines digital service as any service supplied over the internet or other electronic network with the use of information technology, describing the supply as essentially automated. Included in the definition of digital service are online search engines, online marketplace or e-market places, cloud services, online media and advertising, online platforms, and digital goods. Defining digital service providers The law defines digital service providers (DSPs) as the suppliers of digital services consumed in the Philippines, and sets certain VAT obligations upon them, both resident and non-resident.Resident DSPs, being local service providers, are presumed to have been operating within the purview of the old VAT provisions. Thus, for them, the new law would serve as a reaffirmation of the obligation to report and remit VAT. The far-reaching effects of the new law are to be felt more by non-resident DSPs who are assigned unprecedented VAT responsibilities. These responsibilities are anchored on the core of the law, which treats digital services by non-resident DSPs as performed or rendered in the Philippines, provided that they are consumed in the country, thus subjecting them to VAT.VAT implications The following are VAT implications of the new law as far as non-resident DSP transactions are concerned, highlighting what transacting parties should be on the lookout for:VAT registration. The law requires non-resident DSPs to register with the BIR for VAT purposes if their gross sales for the past three months exceed Php3 million or if there are reasonable grounds to believe that their gross sales for the next 12 months will exceed the same threshold. The actual requirements and process for VAT registration are not yet clearly set out. In any case, non-resident DSPs are advised to watch out for the ‘simplified automated registration system’ that the BIR is mandated to establish. Invoicing and accounting. The law requires non-resident DSPs to issue VAT invoices for digital services consumed in the Philippines. In any case, the law ensures that a non-resident DSP’s invoice is simplified in terms of contents as compared to mandatory contents of a regular local invoice. A non-resident DSP invoice only needs to reflect the date, transaction reference number, consumer identification, brief description of the transaction, amount, and breakdown of sale price by component if subject to VAT at 12%, VAT zero-rated, or VAT exempt, if necessary. Non-resident DSPs are advised to be on standby for announcements on when the government will operationalize the invoicing requirement. For accounting purposes, non-resident DSPs are not required to maintain subsidiary sales and purchase journals.VAT payment. The law mandates the manner of VAT remittance, which depends on whether the non-resident DSP transacts with a non-VAT consumer or VAT-registered consumer in the Philippines. For transactions with non-VAT registered consumers, the non-resident DSPs are the ones required to directly remit the VAT to the BIR. For transactions with VAT-registered consumers, the said consumers are the ones supposed to withhold VAT and remit the same to the BIR. This process is referred to as the ‘reverse charge mechanism,’ a similar mechanism to our existing withholding VAT. The BIR will likely soon release mechanics for VAT payment, whether via direct remittance or reverse charge. In either case, transacting parties are advised to assess whether the imposition of VAT on the digital services would have an effect on agreed pricing between them.Special rule for online marketplaces or e-marketplaces. Online marketplaces may also be required under the law to remit the VAT on behalf of its non-resident sellers, if the online marketplaces are involved in setting the terms and conditions of supply, or are involved in the ordering or delivery of goods. Recognizing the far-reaching effects of VAT on digital servicesFor the very first time, a Philippine law calls the attention of non-resident businesses, DSPs in particular, to comply with local VAT requirements such as registration, invoicing, and more importantly, VAT payment. The law even goes on to say that, in case of failure to register and non-compliance, the BIR, through the Department of Information and Communications Technology, can suspend business operations by blocking access to their digital services in the Philippines.At the same time, the law subtly calls the attention of Philippine customers transacting with DSPs. With a local tax ecosystem that encourages taxpayers to comply, Philippine customers, especially businesses placed on the receiving end of tax audits, should assess its implications from various angles. Questions around the consequences of transacting with unregistered non-resident DSPs, transacting with DSPs that issue non-compliant VAT invoices, and the applicability and proper implementation of the reverse charge mechanism are just some of the valid concerns consumers should recognize in view of the recent VAT law development.The effects of the VAT on digital services law are far-reaching. For now, taxpayers can expect further clarifications to come from the tax authority as it designs the rules and regulations for effective implementation. Atty. Victor C. de Dios is a Tax Principal of SGV & Co.This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinion expressed above are those of the authors and do not necessarily represent the views of SGV & Co.

2024

Enhancing payroll management with AI

Future-proofing finance with future-ready controllers

Shopper spending trends this season

Guiding Philippine SMEs through the cybersecurity journey

Integrating ESG into risk management

Beyond Metrics: Creating lasting value in the "Age of And"

Harnessing the human element in cybersecurity

Managing third-party risk

Key components for strategic risk management

The far-reaching effects of VAT on digital services

Other SGV News and Publications

SyCip Gorres Velayo & Co. SGV Main Office

Our Locations Where to find us?

From Our Site Helpful Links

SyCip Gorres Velayo & Co. SGV Main Office

Our Locations Where to find us?

From Our Site Helpful Links