Compliance Theater Is Hiding Your Biggest Security Risks

 

Consider an illustrative scenario, a composite of patterns that repeat across security programs. A payments processor presents its quarterly security report to the audit committee. Every scheduled vulnerability scan ran on time. Nearly all employees finished security training, the certification renewed without a gap, and every audit finding from the prior year is closed. Three weeks later an attacker enters through a server that never appeared on a scan target list, because the team built it after the list was last updated. The report was accurate on every line, and it still told the committee nothing about whether the company was getting safer.

Compliance is a byproduct of security. When an organization knows its threats, protects the assets that matter, tests its controls, and fixes weaknesses until a retest confirms the fix, most of its compliance evidence becomes a record of work already done to reduce risk. When the sequence runs the other way, the organization collects evidence first and hopes protection follows. That gap is where false confidence grows, and decision-makers stop asking hard questions at the moment they most need to ask them. This article is for CISOs and compliance officers who want to report outcomes instead of activity, and it ends with seven metrics you can start swapping in this quarter.

The argument covers the obligations most teams already carry. GDPR, NIS2, HIPAA, SOX, PCI DSS, ISO/IEC 27001, and SOC 2 each ask, in different words, whether controls work and whether you can show it. Compliance stays a legal and contractual duty with its own deadlines, and nothing here argues for skipping it. The point concerns order and evidence. Security work comes first, and the records that work produces earn the compliance claim. The sections below cover what each obligation requires, how checkbox reporting goes wrong, which metrics replace it, and how to make the evidence trail a normal output of operations.

 

Essential Skills for GRC, Finance, Legal and Cyber in 2027 and 2028

This article answers one worry: if AI now drafts the policies, tests the controls, reviews the contracts and triages the alerts, what is left for a GRC, finance, legal or cyber professional to do? The answer is five human skills, ranked by how well they protect your job: professional judgment (called taste in the AI community), agency, follow-through, focus and resourcefulness. Each one sits where automation stops and accountability starts. Judgment decides which AI output is sound and defensible. Agency moves you from the person who samples 40 payments to the person who runs the agent that checks all 18,000. Follow-through makes the work land with the people who rely on it. Focus keeps you on the few exposures that matter, and resourcefulness lets you take on the unfamiliar projects others decline.

The key advice is to build these skills on one real project instead of reading about them. Pick one control you test by sampling today, write the decision it supports and who makes it, and run an agent across the whole population. Write down the rules you used to sort real exceptions from noise, because that is your judgment on paper. Keep humans on irreversible decisions, give every agent an owner, a boundary and a log, and stay with the work until the business actually uses it. Revisit the projects you ruled out, since the constraint that stopped them may be gone. Employers will pay for the professional who can show the exposure chosen, the decision supported and the person who relies on the result.

Consider a composite situation, not a real engagement. An internal auditor at a mid-sized manufacturer spends two weeks every quarter testing a sample of 40 payments out of roughly 18,000 for duplicates and approval breaches. That sample covers about 0.2 percent of the population, and everyone in the room knows it. An AI agent can now read all 18,000 payments overnight and hand the auditor a short list of exceptions by Monday morning. The two weeks of sampling are gone, and so is the part of the job that looked like work.

The question for 2027 and 2028 is what the auditor does with the other thirteen days. The short answer is five human skills, and I rank them here by how well they protect a GRC, finance, legal or cybersecurity career from displacement by automation of repetitive analysis, reporting and control reviews. In order of job-market relevance they are professional judgment, agency, follow-through, focus and resourcefulness. This article is for risk analysts, internal and external auditors, compliance officers, finance controllers, in-house lawyers and security engineers who want to know which habits employers will pay for once everyone has the same AI tools.

AI has removed the old excuses that kept capable professionals from acting on what they already understood: no time, no access, no technical skill. That makes the call to action simple. Revisit the projects you ruled out in the last three years, because the constraint that ruled them out may no longer exist. AI has expanded what is possible in risk management, auditing, compliance, cybersecurity, legal work and finance faster than most people have expanded what they are willing to attempt, and that gap is where your next promotion sits.

SOX Controls Over AI

Consider a composite situation, not a real engagement. A controller opens the monthly bank reconciliation, and the matching tool shows 1,250 unmatched items out of 18,400 bank lines. The accounting manager reviewed every item and approved the package. The external auditor asks which version of the matching logic produced that list, whether the bank file was complete when the tool ran, and what the reviewer saw on screen. Nobody can answer. The matching feature arrived in an ERP update that the supplier switched on, and the SOX risk and control matrix still describes a spreadsheet.

If AI influences financial reporting, your organization must be able to show five things: where the AI is used, how it works, that its inputs and outputs are reliable, that changes to it are controlled, and that a human exercised oversight and left evidence of it. Each of those five becomes an auditor question, and this article takes them in the order a SOX program would address them. Treat the five questions as a practical synthesis of current auditor concerns. No official PCAOB or SEC checklist with five questions exists, and I would be wary of anyone who presents one. The article is written for controllers, SOX control owners, and internal auditors who need working answers before fieldwork starts.

You do not need a separate AI compliance program to get there. COSO released guidance on internal control over generative AI in February 2026 that applies its Internal Control Integrated Framework to generative AI, and it names the risks that matter most to financial reporting: prompt-based manipulation, opaque reasoning, model drift, and frequent configuration changes. SEC staff remarks at the December 2025 AICPA and CIMA conference, as summarized in an EY compendium, pointed the same way, with attention on model design, data, human oversight, and the way AI changes IT general controls. What follows turns that direction into an inventory, a control narrative standard, a validation plan, a change register, and a failure path you can build this quarter.

 

AI Agent Segregation of Duties Guide for GRC and SOX Compliance

 

Finance leaders are under constant pressure to cut costs, and automation is the fastest lever available. IT teams are asked to hand AI agents more autonomy every quarter, and in many workflows that autonomy now stretches across the full transaction lifecycle: an agent reads customer or financial data, produces a recommendation, approves it, executes the action through an API, and writes the log entry that documents what happened.

No serious organization would hand a single employee that combination of powers without a control wrapped around every step. Yet that is precisely the architecture some companies are building today, one agent deployment at a time, often without anyone deciding to do so on purpose. This piece walks through why that pattern is a genuine segregation of duties problem, what Sarbanes-Oxley actually requires when an agent touches a financially relevant process, and what a control owner can do about it in practice.

The Risk Management Blueprint: A Practitioner's Guide to Quantitative GRC

 

Risk management has a credibility problem. Not because the profession lacks talent, but because color-coded heat maps, ordinal scoring matrices, and quarterly dashboard reviews were never built to change decisions. They exist to document that a compliance process took place. Executive teams know this. They react accordingly by treating risk departments as corporate overhead instead of strategic assets.

I wrote this book to help my peers turn that dynamic around.

After 25 years leading risk functions and advising executive boards across complex multinational companies, I needed a manual that actually bridges advanced quantitative methods with the daily decisions that determine business outcomes. That drive is why The Risk Management Blueprint hit #9 among the most sold risk management books in the weeks after publishing.

At 867 pages, it gives practitioners a single unified methodology across every major risk domain, covering AI systems, cyber exposure, financial cash flows, sustainability transitions, and human behavior. The framework rests on probability theory, financial modeling, and decision science so you can swap subjective scores for numbers that stand up in the boardroom.

You can preview the first four chapters and access the book here: https://amzn.to/4ciag1F

This is not a textbook. It does not spend the majority of its pages diagnosing what is broken in the profession before gesturing toward improvement in a final chapter. More than 70 percent of the book's total length is allocated to domain applications and advanced analytical infrastructure, meaning the bulk of every page is spent on how to build, calibrate, and apply quantitative and predictive risk models across the decisions that actually shape organizational outcomes.

SR 26-2 Is Here: The 2026 Model Risk Guidance That Finally Gives Validators Teeth

On April 17, 2026, the Federal Reserve, the FDIC, and the OCC (collectively, "the agencies") issued SR Letter 26-2, which replaces prior model risk management guidance, the SR 11-7 issued in 2011. This update refines supervisory expectations regarding how banking organizations should calibrate their model risk management frameworks. The guidance is most directly applicable to institutions with total assets exceeding $30 billion, though smaller institutions with complex modeling activities are advised to consider its principles.

The guidance formally excludes simple arithmetic calculations, deterministic rule-based processes, and notably, generative artificial intelligence and agentic artificial intelligence models from the definition of a model. However, the agencies explicitly state that traditional statistical, quantitative, and non-generative artificial intelligence models remain within scope. The primary audience is organizations with over $30 billion in assets, reflecting a tailored supervisory approach that recognizes the lower inherent risk profiles of most community banking institutions.

 

How to Use Large Language Models Securely in Risk Management, Compliance, Cybersecurity, and Audit

 

A compliance officer asked an LLM to analyze a vendor contract for GDPR obligations. The prompt included the full contract text. The contract contained employee names, personal email addresses, salary data from an embedded compensation schedule, and a confidential arbitration clause. All of it went into a third-party API. The compliance officer received a helpful analysis. The organization received a data privacy incident.

Nobody planned for this. The compliance officer was doing good work. The tool produced a useful output. And the organization now had regulated personal data sitting in an external system with no data processing agreement, no retention controls, and no way to request deletion.

That is the paradox of LLMs in GRC. The same capability that makes them powerful for regulatory analysis, risk assessment, and audit automation makes them dangerous when deployed without guardrails. An LLM will process whatever you feed it. It does not distinguish between public regulatory text and confidential personal data. It does not know that the regulation it cited does not exist. It does not understand that the risk score it generated was influenced by training data biases that systematically underweight emerging market vendors.

 

AI for GRC: 10 Use Cases Every Risk and Compliance Team Can Deploy in 90 Days

A compliance analyst at a mid-tier financial institution spent 14 hours last week reading regulatory updates. She flagged three items as potentially relevant to her business. She missed two others that directly affected the firm's cloud outsourcing arrangements. One of those triggered an enforcement action against a peer institution six weeks later.

That story repeats across thousands of GRC teams every week. The volume of regulatory change, vendor risk signals, control evidence, and incident data has exceeded human processing capacity. Not because the people lack skill. Because the volume is physically impossible to cover manually with the rigor the work demands.

AI changes this equation. Not by replacing human judgment, but by compressing the time between a risk signal appearing and a qualified human evaluating it. The 10 use cases in this post are not theoretical. GRC leaders at financial institutions, technology companies, and manufacturing firms are running three to five of these today, cutting manual hours by 30-60% while improving coverage across the full risk population.

Each use case includes the practical workflow, the authoritative framework it maps to, and the implementation path you can follow starting this week.

 

How to Audit the SAP S/4HANA Forecast-to-Stock Cycle

Audit Controls for the SAP S/4HANA Forecast-to-Stock Cycle

Inventory audits are rarely just about counting boxes. They are about trust. Trust that the quantities in SAP S/4HANA reflect physical reality. Trust that movements are valid. Trust that scrapped material is actually scrapped. Trust that stock in transit exists. Trust that inventory valuation is right, period cutoffs are right, and adjustments are not hiding mistakes or theft.

That is why the forecast-to-stock cycle matters so much, even when most audit work in this area ends up focusing on inventory management rather than forecasting.

I have seen inventory environments where the count procedures looked disciplined but the underlying movement controls were weak. The result was predictable. Repeated write-offs. Unexplained adjustments. Warehouse frustration. Management arguing over whether the issue was process, system, or people. I have also seen the reverse. Well-designed movement controls, cycle counting discipline, material master governance, and better reporting reduced inventory noise sharply before year-end counts ever began.

This article gives you a practical framework for auditing the SAP S/4HANA forecast-to-stock cycle, with emphasis on inventory management. It covers the key S/4HANA changes, enterprise structure, material master, movement types, security, configurable controls, and the most useful audit reports. As requested, I include transaction codes, key tables, technical field names, and practical implementation guidance throughout.

 

How to Audit the SAP S/4HANA Purchase-to-Pay Cycle

 

Practical Audit Controls for the SAP S/4HANA Purchase-to-Pay Cycle

Few audit areas get management’s attention faster than purchase-to-pay. The reason is simple. Cash is leaving the company. When controls are weak, the damage is usually visible in money, not theory. Duplicate payments. Overpayments. Invalid vendors. Missed discounts. Manual payments. Invoice blocks cleared too easily. Purchase orders changed after approval. Those are not abstract control concerns. They are operating losses.

That is why a strong SAP S/4HANA purchase-to-pay audit can be one of the most valuable reviews in the annual plan.

I have seen organizations recover meaningful cash just by tightening duplicate invoice checks, vendor master controls, and release strategy gaps. I have also seen teams focus too narrowly on invoice processing and miss the actual cause of the problem, which often sits earlier in the flow. In vendor setup. In purchasing info records. In source lists. In movement types. In tolerance settings. In who can create, approve, receive, and pay.

This article gives you a practical framework for auditing the SAP S/4HANA purchase-to-pay cycle. It covers the S/4HANA changes that matter, enterprise structure, master data, security, common configurable controls, and high-value reports. As requested, it includes transaction codes, relevant tables, authorization objects, and full technical names where they help the work become actionable.

 

How to Audit the SAP S/4HANA Order-to-Cash Cycle

Practical Audit Controls for the SAP S/4HANA Order-to-Cash Cycle

Revenue problems rarely begin in the income statement.

They begin earlier. In customer master data. In pricing conditions. In credit limits. In copy control. In blocked deliveries that no one resolves. In incomplete sales documents that sit too long. In manual overrides that looked harmless at the time.

That is why a strong SAP S/4HANA order-to-cash audit is never just a sales process walkthrough. It is a control review across sales, shipping, billing, receivables, customer master data, pricing, credit management, and the handoff into financial accounting.

I have seen organizations with healthy top-line growth discover margin leakage only after audit tested pricing overrides and free-of-charge processes in detail. I have also seen teams with good commercial discipline still struggle because customer business partner data, incompleteness procedures, or credit checking were only partially configured. The process looked fine on paper. The exceptions told a different story.

This article gives you a practical framework for auditing the SAP S/4HANA order-to-cash cycle. It covers new S/4HANA features, enterprise structure, master data, security, common configurable controls, high-value reports, and the technical details needed for a serious audit or GRC review. As requested, I include transaction codes, tables, authorization objects, and field-level references where they are relevant.

 

How to Audit the SAP S/4HANA Record-to-Report Cycle

Practical Audit Controls for the SAP S/4HANA Record-to-Report Cycle

Most finance audits focus on the final reports. That is too late. If you want reliable financial reporting in SAP S/4HANA, you need to look earlier. At posting periods. At journal entry controls. At field status logic. At validation rules. At asset settings. At master data. At who can post, who can reopen a period, and who can change document fields after the fact. The balance sheet only tells you the ending story. The controls tell you whether the story can be trusted.

I have seen finance teams with excellent close discipline still struggle because SAP S/4HANA was left at default settings that did not match the business. I have also seen the opposite. A well-configured environment cut period-end stress sharply because errors were prevented before they became close issues. That is the real promise of a strong record-to-report design. Fewer surprises. Better evidence. More confidence in the numbers.

This article sets out a practical framework for auditing the SAP S/4HANA record-to-report cycle. It covers statutory and managerial reporting, enterprise structure, master data, security, common configurable controls, useful reports, and the technical details auditors and GRC teams actually need. As requested, I include transaction codes, relevant tables, key technical field names, and plain-language descriptions.

 

How to Execute a Complete SAP S/4HANA Audit: ITGCs, Basis Security, Process Controls, and Every T-Code You Need

 Most SAP S/4HANA audits fail before fieldwork even begins. The planning is shallow, the scope misses entire control layers, and the team lacks the technical depth to distinguish a real finding from a false positive. I have seen audit reports with 40 findings that missed the three issues that actually mattered. That is expensive failure.

Getting the SAP S/4HANA audit right matters because the system sits at the center of financial reporting, procurement, inventory management, and dozens of other processes that carry real organizational risk. A weak audit gives false assurance. A strong audit identifies quantifiable business impact and drives measurable control improvement.

This post walks through the complete SAP S/4HANA audit framework, from IT General Controls through business process validation, with every T-code, table, and configuration parameter you need to execute at a high level. Each section includes implementation tips drawn from field experience across financial services, manufacturing, and public sector engagements.

 

Prof. Hernan Huwyler, MBA, CPA, CAIO: AI Governance, Risk & Compliance Executive | Speaker, Trainer & Advisor

 

I am an AI Risk Manager and Governance, Risk, and Compliance (GRC) executive dedicated to empowering business leaders to achieve strategic objectives through robust AI governance, digital compliance, and responsible AI frameworks. With over two decades of global executive experience spanning four continents, I specialize in guiding Fortune 500 organizations toward financial success and operational excellence by transforming regulatory pressure into a competitive advantage -1.

Combining internal audits with anti-corruption compliance monitoring

 

Post by Prof. Hernan Huwyler, MBA, CPA, CAIO
AI GRC Director | AI Risk Manager | Quantitative Risk Lead
Speaker, Corporate Trainer and Executive Advisor

Top 10 Responsible AI and Risk Management by Thinkers360

Why Detecting Concealed Payments Has Become A Board Level Priority

Detecting illegal payments concealed in accounting records remains a top priority for both internal audit and anti-bribery compliance functions. Corruption risk is a significant and growing concern for global organizations, driven by an expanding web of extraterritorial anti-corruption legislation. The U.S. Foreign Corrupt Practices Act, the UK Bribery Act 2010, France's Sapin II, and Brazil's Clean Company Act all impose obligations that extend well beyond domestic borders, creating overlapping enforcement regimes that demand coordinated internal controls.

Enforcement activity continues to intensify. The U.S. Department of Justice and the Securities and Exchange Commission have collectively imposed billions of dollars in FCPA-related penalties over the past decade. Whistleblower programs, particularly under the Dodd-Frank Act, have created powerful financial incentives for individuals to report suspected violations directly to regulators, with the SEC Whistleblower Program having awarded over two billion dollars since its inception. These dynamics make it essential for organizations to detect and prevent improper payments before they surface externally.

Identifying illegal payments hidden in accounting records is no longer a narrow compliance exercise. It is a core governance issue that sits at the intersection of anti bribery compliance, financial controls, internal audit, third party risk management, and investigations. For global companies, the stakes are high. Enforcement authorities continue to pursue cases under extra territorial anti corruption laws, whistleblower activity has increased, and regulators now expect companies to demonstrate not only that they have policies in place, but that they can identify and respond to suspicious transactions in practice.

Improper payments are rarely recorded as bribes. They are usually disguised as legitimate business expenses. In many cases, they appear as commissions, consulting fees, rebates, customs charges, facilitation arrangements, marketing support, travel expenses, charitable contributions, or vendor payments that appear ordinary on the surface. In more sophisticated schemes, illegal payments are concealed through inflated invoices, success fee arrangements with vague deliverables, layered subcontracting, shell entities, or payment flows involving offshore accounts and unrelated jurisdictions.

That is why anti bribery risk cannot be addressed through policy language alone. It requires a control architecture capable of identifying transactions that are technically booked within approved accounting categories but are economically inconsistent with the underlying business purpose.

Why Accounting Records Remain Central To Anti Bribery Detection

Under major anti corruption enforcement regimes, including the US Foreign Corrupt Practices Act, the integrity of books and records remains a central issue. Companies can face enforcement not only for improper payments themselves, but also for failures in internal accounting controls and the maintenance of inaccurate records. This is one of the most important practical realities in anti bribery compliance. Illegal payments are often detected not from direct evidence of intent, but from inconsistencies in documentation, approval logic, service validation, pricing patterns, vendor onboarding, or payment behavior.

For that reason, the most effective anti bribery programs do not separate ethics risk from financial control design. They treat accounting data, procurement data, third party due diligence, and approval workflows as connected evidence streams.

Why Improper Payments Are Difficult To Detect

Improper payments are deliberately designed to evade detection. The most straightforward schemes disguise bribes as legitimate business expenses such as agent commissions, third-party fees, consulting charges, or reimbursed travel and entertainment costs. More sophisticated arrangements involve inflated invoices, deceptive commission structures, fictitious services, and the use of complex webs of intermediaries, shell companies, and offshore bank accounts.

Under the FCPA, even when a substantive bribery charge cannot be proven, organizations face significant liability for books and records violations and failures to maintain adequate internal accounting controls. This means that the quality of accounting records and the integrity of the control environment are themselves compliance obligations, not merely audit concerns.

Mapping The Risk Factors Behind Improper Payments

Effective corruption risk assessment requires evaluating the full environment surrounding each transaction rather than relying on a single risk indicator. Organizations that anchor their bribery risk maps exclusively to country-level corruption indices, such as the Transparency International Corruption Perceptions Index, miss the broader transactional context that drives actual exposure.

A robust risk mapping framework balances four dimensions.

Where the transaction occurs encompasses the jurisdiction where the service is provided, the location from which payment is requested, and the domicile of the supplier. High perceived corruption jurisdictions, tax haven countries, new market sectors, and offshore locations all elevate this dimension of risk.

Who is involved examines the parties to the transaction, including public officials, politically exposed persons, small or newly established companies, new vendors without established track records, subcontractors, joint venture partners, associations, and any associated persons as defined by applicable legislation. The completeness and findings of due diligence, including any unresolved red flags, and the verification of beneficial ownership are critical elements of this assessment.

What service is provided evaluates the nature of the engagement. Consulting and advisory services, government licenses and permits, customs and logistics services, public procurement, complex or first-of-their-kind projects, and transactions where incentives or pressures exist to complete a deal on aggressive timelines all carry elevated risk.

How the service is contracted and paid focuses on the commercial and financial mechanics. The payment method, flat-fee structures versus success-based compensation, commission clauses, reimbursed expenses, upfront payments, the use of cash, and the routing of payments through jurisdictions unrelated to the underlying service are all relevant indicators.

Balancing these four dimensions provides a holistic view of corruption exposure. Organizations that assess only one or two of these factors, typically the country dimension alone, create gaps in their risk coverage that more sophisticated bribery schemes are specifically designed to exploit.

 

How Corruption Risk Should Be Assessed In Practice

Many companies still make a basic but costly mistake in corruption risk assessments. They over concentrate on country risk and assume that corruption exposure is driven primarily by geography. Geography matters, but it is only one element of the transaction risk profile. A stronger model evaluates corruption risk through the interaction of location, counterparties, business purpose, and payment mechanics.

A more complete risk view starts with where the service is delivered, where the payment is requested, where the third party is domiciled, and whether the transaction touches jurisdictions associated with weak transparency, sanctions concerns, customs complexity, or tax opacity. It also considers who is involved, including public officials, state owned entities, politically exposed persons, newly formed vendors, subcontractors, joint venture partners, customs brokers, commercial agents, and intermediaries with limited operating history or negative due diligence findings.

The nature of the service is equally important. Certain services are structurally higher risk because they are difficult to verify or can be used to justify discretionary payments. These often include consulting, licensing support, customs clearance, permit acquisition, business development, logistics support, market access work, and public procurement support. Risk also rises when a project is unusually complex, commercially pressured, fast tracked, or dependent on external approvals.

The final dimension is how the transaction is structured and paid. Payment method, fee logic, reimbursement provisions, use of advances, round sum compensation, success based compensation, vague statements of work, accelerated approvals, split invoices, foreign currency requests, or payments to accounts in unrelated jurisdictions can all materially elevate risk.

A mature corruption risk model balances all of these dimensions. It does not treat any single factor as determinative. It recognizes that a low transparency jurisdiction does not automatically make a transaction improper, and that a payment in a lower risk country may still be highly suspicious if the service cannot be substantiated or the payment structure lacks economic logic.

Why Compliance And Internal Audit Need A Shared Detection Model

Compliance and internal audit both play important but distinct roles in detecting illicit payments. Compliance typically owns anti bribery policy, third party due diligence standards, training requirements, escalation protocols, and ongoing monitoring of high risk transactions and third parties. Internal audit provides independent assurance over the design and operating effectiveness of controls, the adequacy of governance, and the consistency of execution across business units.

These roles should not be merged, but they should be coordinated. In practice, both functions rely on overlapping risk indicators, control points, and transactional evidence. If they use different definitions of bribery risk, different red flag criteria, or different scopes for testing, the result is fragmented oversight and duplicated effort. If they align on risk factors, data triggers, and control objectives, they can achieve stronger coverage with less burden on the business.

The most effective model is one in which compliance and internal audit share a common view of transaction risk, while preserving their separate mandates. Compliance performs targeted monitoring and program oversight. Internal audit independently evaluates whether the anti bribery control environment is designed and operating effectively. Each function benefits from the work of the other, but neither substitutes for the other.

A Better Way To Structure Collaborative Reviews

A practical way to coordinate anti bribery detection is to organize the review model around control design, operating effectiveness, and risk based monitoring. This structure is more useful than dividing work only by function because it aligns the assurance approach to how illicit payments actually bypass controls.

When organizations evaluate control design, they assess whether the preventive and detective control framework is capable of stopping or surfacing improper payments before they are embedded in normal accounting activity. When they evaluate operating effectiveness, they test whether those controls are consistently functioning in real transactions and whether exceptions are being challenged. When they monitor, they use data and trigger based review to identify payment behavior that warrants additional investigation or targeted audit attention.

This three part structure creates a practical bridge between governance, transaction testing, and analytics.

Evaluating Control Design Through An Anti Bribery Lens

Control design reviews should go beyond traditional financial authorization logic. They should assess whether the process architecture makes concealment difficult.

A strong design review examines segregation of duties across vendor onboarding, contract approval, service confirmation, invoice approval, master data changes, and payment release. The objective is not simply to confirm that different individuals are involved, but to ensure that the sequence of approvals creates meaningful challenge and that approval authority is appropriate to transaction risk and value.

Contracting controls also deserve close attention. Agreements with third parties should include anti corruption clauses, audit rights where appropriate, compliance with applicable laws, cooperation obligations, and termination rights tied to misconduct or control failures. It is equally important that the actual statement of work be specific enough to allow later verification of what the third party was expected to deliver.

The integrity of accounting descriptions is another underappreciated control. Accounting teams should be trained to use booking categories that reflect the economic substance of the transaction and to maintain meaningful entry descriptions. Large manual journal entries supported only by auxiliary spreadsheets, especially where line item support is missing or vague, create opportunities for concealment and should be tightly controlled.

Financial controllers and approvers should also be trained to identify anti bribery red flags in routine finance activity. This includes unusual travel and entertainment patterns, unsupported reimbursements, high risk petty cash usage, weak service confirmations, inconsistent vendor banking details, and commercially irrational pricing patterns.

Testing Operating Effectiveness Where Illegal Payments Actually Hide

Testing for operating effectiveness should focus on whether the control framework can withstand real world pressure. This means selecting transactions not only through conventional statistical sampling, but also through judgment based selection informed by known bribery risk patterns and red flags. Statistical samples are useful for some control objectives, but on their own they may miss the very transactions that merit scrutiny because corruption schemes are often low frequency, non random, and intentionally structured to look exceptional but explainable.

A stronger testing approach includes payments across multiple risk levels, with deliberate inclusion of transactions that are not necessarily high value but display unusual characteristics. These may include unnecessary intermediaries, vague consulting arrangements, success based compensation with no measurable output, emergency vendor onboarding, repeat reimbursements without adequate support, unusual discounts or rebates, or payments approved shortly before key regulatory or commercial milestones.

Third party testing is especially important. Reviews should examine whether due diligence was completed before engagement, whether red flags were resolved rather than simply documented, whether the third party had the capability to perform the service, whether beneficial ownership and control were understood, whether screening was refreshed appropriately, and whether the actual service provided can be corroborated through evidence beyond the invoice itself.

Approvals should also be tested for substance. Effective approval is not the presence of a signature in workflow. It is evidence that the approver assessed legitimacy, reasonableness, service performance, pricing, and potential conflicts of interest. If a company cannot demonstrate how an approver validated the business purpose of a payment, then the approval may have limited control value even if it was technically completed.

Using Monitoring To Surface Concealed Risk Earlier

Ongoing monitoring is one of the highest value areas in anti bribery detection because it can identify suspicious activity before it becomes systemic. The most effective monitoring models use data analytics to identify transactions and vendor behavior that deviate from expected patterns and then route those signals into compliance review, finance challenge, or internal audit follow up.

Monitoring should focus on transaction types that historically present bribery and fraud exposure, including gifts, meals, entertainment, travel, sponsorships, charitable donations, political contributions where permitted by law, agent commissions, distributor rebates, consulting fees, customs and logistics charges, and manual adjustments that affect vendor balances or expense classifications.

It is also important to monitor payment destinations and methods. Payments to offshore accounts, payments in currencies that do not align with the contractual arrangement, split payments, advances, round dollar payments, unusual prepayments, credits and rebates without clear commercial support, and sudden changes in bank account details all warrant closer review.

Trend analysis can be particularly effective. Out of pattern commissions by service type, abrupt pricing increases or decreases, changes in lease or equipment related expenses, repeated invoice amounts just below approval thresholds, and recurring payments to recently created vendors can all signal elevated risk. On their own, these indicators do not prove misconduct. Their value lies in helping the organization prioritize review where the transaction logic appears economically weak or control behavior appears abnormal.

What High Performing Programs Do Differently

Organizations with stronger anti bribery detection capability do not rely on isolated controls. They connect due diligence, contracting, procurement, accounts payable, general ledger data, employee expenses, and issue management into a coherent control environment. They also understand that corruption risk overlaps with fraud risk, sanctions risk, and money laundering exposure. That overlap matters because the same transactional patterns that indicate a bribery concern may also indicate vendor fraud, collusion, false billing, or concealment of beneficial ownership.

High performing programs also avoid treating anti bribery testing as a once a year review. They use targeted analytics and focused assurance cycles that adapt as the business changes. Market entry, distributor model changes, public sector expansion, customs intensive operations, and urgent project delivery environments all create periods where transaction scrutiny should increase.

Most importantly, mature programs ensure that findings lead to response. A red flag is only useful if the organization has a clear process to investigate it, escalate it, document conclusions, and adjust controls where necessary.

Common Weaknesses That Undermine Detection

Several recurring weaknesses tend to reduce the effectiveness of anti bribery detection even in otherwise mature organizations.

One is overreliance on due diligence at onboarding without enough scrutiny of what happens after the third party is engaged. A third party may pass initial screening and still become a bribery risk through changes in ownership, personnel, subcontracting, payment structure, or business pressure.

Another is excessive dependence on form based approvals. If the approval process captures signatures but not real challenge, then improper payments can move through the system with apparent control compliance.

A third weakness is insufficient integration between compliance monitoring and internal audit assurance. If compliance identifies recurring anomalies but audit does not assess whether the underlying control design is flawed, the organization treats symptoms instead of causes. If internal audit identifies design weaknesses but compliance does not adapt monitoring to reflect those weaknesses, risk remains under observed.

A final weakness is poor accounting transparency. Ambiguous general ledger descriptions, inconsistent use of expense categories, unsupported manual journal entries, and poor vendor master governance can make even a good anti bribery program far less effective.

Final Perspective

Detecting illegal payments in accounting records requires more than vigilance and more than policy. It requires a transaction level view of corruption risk supported by control discipline, data analysis, and coordinated assurance. Companies that treat anti bribery compliance, internal audit, and financial control as separate worlds will continue to miss important signals. Companies that connect them through a shared risk model and a common evidence base will be far better positioned to prevent, detect, and respond to concealed payments.

For boards, audit committees, chief compliance officers, and heads of internal audit, the practical question is no longer whether anti bribery controls exist. The more important question is whether those controls can detect a payment that was intentionally designed to look ordinary. That is the standard that matters.

References

US Department of Justice and US Securities and Exchange Commission. A Resource Guide To The US Foreign Corrupt Practices Act

US Department of Justice. Evaluation Of Corporate Compliance Programs

Organisation For Economic Co operation and Development. Good Practice Guidance On Internal Controls, Ethics, And Compliance

International Organization for Standardization. ISO 37001 Anti Bribery Management Systems Requirements With Guidance For Use

Committee of Sponsoring Organizations of the Treadway Commission. Internal Control Integrated Framework

Institute of Internal Auditors. Global Internal Audit Standards and guidance relevant to fraud and corruption risk oversight

Association of Certified Fraud Examiners. Occupational Fraud Reports and anti fraud control guidance

Get the latest in corporate governance, risk, and compliance on Twitter

How Taxes Are Computed by SAP FI-AP/AR

Article by Prof. Hernan Huwyler, MBA, CPA, CAIO
AI GRC Director | AI Risk Manager | Quantitative Risk Lead
Speaker, Corporate Trainer and Executive Advisor

Top 10 Responsible AI and Risk Management by Thinkers360

How SAP Computes And Posts Taxes: A Technical Guide For Auditors And Financial Controllers

Why Tax Processing In SAP Requires Audit Attention

Tax computation in enterprise resource planning systems is one of the most configuration-dependent and jurisdiction-sensitive areas of financial processing. In SAP, the tax calculation is not hardcoded into the system. It is driven by a configurable rules engine that determines what tax applies, at what rate, on what base, and to which general ledger account the result is posted. The accuracy of every tax-related financial statement balance, every VAT return, every withholding tax certificate, and every jurisdiction-level tax filing depends on the correctness of this configuration and the integrity of the master data and transaction data that feed into it.

For internal auditors, SOX compliance teams, and financial controllers, understanding how SAP computes taxes is essential for several reasons. Tax configuration errors can produce material misstatements in the financial statements through incorrect tax accruals, understated or overstated tax receivables and payables, and erroneous cost allocations when non-deductible tax is improperly treated. Tax compliance failures can result in regulatory penalties, interest charges, and reputational harm from late or incorrect filings. And the tax configuration represents a control environment that must be tested and monitored as part of the organization's internal control framework, particularly under SOX Section 404 where the controls over tax computation and reporting are within scope of management's assessment of internal control over financial reporting.

The COSO Internal Control Integrated Framework of 2013 identifies information processing controls, including automated controls embedded in application systems, as a critical component of the control activities that management designs and implements to achieve its control objectives. Tax computation in SAP is precisely this type of embedded application control, and its effectiveness depends on the accuracy of the configuration, the integrity of the master data, and the appropriate restriction of access to the configuration and master data transactions that govern how taxes are calculated and posted.

This guide explains the technical architecture of tax computation in SAP, the configuration elements that drive the calculation, the processing logic for accounts payable and accounts receivable transactions, the handling of multi-jurisdiction taxes, the integration with logistics and sales modules, and the special scenarios that auditors must understand. Each section identifies the relevant SAP transaction codes with their full transaction names, the key tables used for data extraction and audit evidence, and the control considerations that auditors and controllers should evaluate.

 

Offshoring Finance Activities in Buenos Aires (Shared Services Centers)

Article by Prof. Hernan Huwyler, MBA, CPA, CAIO
AI GRC Director | AI Risk Manager | Quantitative Risk Lead
Speaker, Corporate Trainer and Executive Advisor

Top 10 Responsible AI and Risk Management by Thinkers360

Shared Services Strategy And GRC Considerations: Lessons From Buenos Aires As A Regional Hub

The Strategic Logic Of Shared Services Centers

Organizations pursue shared services strategies to achieve three interrelated objectives: the integration of fragmented operational processes across business units and geographies, the consolidation of transactional activities into centralized operations that benefit from scale and specialization, and the standardization of processes to eliminate duplication, reduce variation, and enable continuous improvement. These objectives are not new. They reflect the fundamental operational principle that repetitive, rules-based, high-volume transactional activities can be performed more efficiently and more consistently when they are concentrated in purpose-built operations rather than distributed across multiple business units, each with its own processes, systems, and staffing models.

The functions most commonly migrated to shared services centers include finance and accounting (accounts payable, accounts receivable, general ledger, fixed assets, intercompany accounting, financial reporting, and tax compliance support), human resources and payroll (employee data management, payroll processing, benefits administration, and recruitment support), information technology (infrastructure management, application support, help desk operations, and development services), procurement (purchase order processing, vendor management, and invoice verification), and supply chain support (logistics coordination, inventory management, and order fulfillment support).

The migration of these functions from corporate headquarters and local subsidiaries to a shared services center follows a structured transition process. Activities are documented and mapped in their current state, redesigned for standardization and efficiency, migrated to the shared services operation, and then continuously improved through process optimization, automation, and performance measurement. The objective is not merely to relocate activities to a lower-cost location but to fundamentally improve the quality, consistency, and efficiency of the processes through standardization and scale.

 

Location Selection: The Factors That Determine Success

The selection of a shared services center location is one of the most consequential decisions in the shared services strategy because location determines the labor market available for staffing, the cost structure of the operation, the regulatory and tax environment, the infrastructure quality, the time zone alignment with supported operations, and the operational risk profile of the center.

The factors that organizations typically evaluate in location selection include the following.

Labor market quality and availability. The shared services operation requires a sustained supply of qualified professionals with the functional expertise, language capabilities, and educational background needed to perform the center's activities. For finance and accounting shared services, this means professionals with training in accounting principles, familiarity with the relevant accounting standards such as US GAAP or IFRS, and the analytical capabilities needed for financial reporting and analysis. For IT shared services, this means professionals with the relevant technical certifications, programming skills, and systems knowledge. The depth of the local labor market, the quality of local educational institutions, and the competition from other employers for the same talent pool directly affect the center's ability to recruit, retain, and develop its workforce.

Language capabilities. Shared services centers that support multi-regional operations require staff who can communicate effectively in the languages of the regions they serve. Centers serving Latin American, North American, and Southern European operations benefit from a labor market with strong bilingual English and Spanish capabilities, and in some cases trilingual capabilities including Portuguese or Italian.

Cost competitiveness. Labor costs represent the largest component of shared services operating costs, and the differential between labor costs in the shared services location and the locations from which the activities are migrated is a primary driver of the financial business case. However, cost should be evaluated on an all-in basis that includes not only direct compensation but also social charges, benefits, facilities, technology infrastructure, management overhead, and the transition costs associated with migration and stabilization.

Time zone alignment. Shared services centers that support operations in multiple regions benefit from time zone positions that enable overlap with the business hours of the regions they serve. A location positioned between the time zones of Europe and North America, for example, can provide real-day support to both regions without requiring extensive shift work.

Infrastructure quality. The physical and telecommunications infrastructure of the location determines whether the center can operate reliably, securely, and with the connectivity required for real-time system access and communication with supported operations. Power reliability, internet connectivity, office space availability, and transportation infrastructure for employee commuting all affect operational viability.

Regulatory and business environment. The local legal, regulatory, tax, and labor law environment affects the center's operating costs, its flexibility in staffing and organizational design, and its compliance obligations. Employment law provisions regarding termination, working hours, collective bargaining, and social security contributions vary significantly across jurisdictions and directly affect the center's cost structure and operational flexibility.

Quality of life and cultural alignment. The ability to attract and retain talent is affected by the quality of life in the center's location, including safety, healthcare, education, cultural amenities, and the overall living standard. Cultural alignment between the shared services workforce and the headquarters and subsidiary cultures that the center supports facilitates communication, reduces friction, and improves the quality of service delivery.

Buenos Aires has been selected by numerous multinational organizations as a location for shared services centers serving regional and global operations. The city's selection reflects its strong position across multiple location factors, including a large and well-educated professional workforce, widespread bilingual English and Spanish language capabilities, competitive labor costs relative to North American and European alternatives, favorable time zone positioning between European and North American business hours, well-developed commercial infrastructure, and a cultural orientation that aligns with Western European and North American business practices. Major energy companies, technology firms, consumer goods companies, professional services firms, and industrial conglomerates have established shared services operations in Buenos Aires to support finance and accounting, HR, IT, procurement, and customer service functions across Latin American, North American, and European operations.

 

The GRC Perspective On Shared Services

From a governance, risk management, and compliance perspective, shared services centers create both opportunities and risks that the GRC framework must address.

The governance opportunity is that centralization enables the organization to implement consistent processes, controls, and policies across the activities performed by the shared services center. When accounts payable processing is performed in twenty different subsidiaries, each with its own process variations, system configurations, and control practices, the organization's control environment is inherently inconsistent and difficult to audit. When the same activity is performed in a shared services center with a single standardized process, a common system configuration, and a unified control framework, the control environment is more consistent, more auditable, and more amenable to continuous improvement.

The compliance opportunity is that centralization creates a single point at which regulatory compliance requirements can be embedded into standard processes. A shared services center that processes invoices for multiple jurisdictions can implement anti-corruption screening, sanctions checking, and tax compliance validation as standard steps in the centralized process, ensuring that every transaction passes through the same compliance controls regardless of which business unit or jurisdiction originated the transaction.

The risk management opportunity is that the concentration of transactional data in a shared services operation creates a rich data environment for analytical monitoring, exception detection, and continuous auditing. The earlier posts on detecting illegal payments, SAP transaction codes for auditing, and continuous controls monitoring all described analytical techniques that are more effective when applied to centralized data than to fragmented data distributed across multiple systems and locations.

However, shared services also create specific risks that the GRC framework must address.

Concentration risk arises from the dependence of multiple business units and regions on a single operational center. A disruption to the shared services center, whether from a technology failure, a natural disaster, a political or economic event in the host country, a pandemic, or a labor action, can simultaneously affect all of the business units and functions that the center supports. Business continuity planning for shared services centers must address these concentration risks through redundancy arrangements, geographic diversification, and defined recovery procedures.

Segregation of duties risk may be elevated in shared services environments because the standardization and efficiency objectives of shared services can conflict with the separation of functions required for effective internal controls. When a shared services center processes high volumes of transactions with a relatively small number of specialized staff, the pressure to maintain processing efficiency can lead to the assignment of incompatible functions to the same individual. The earlier post on segregation of duties conflicts in SAP addressed the specific transaction combinations that create SoD risk, and these conflicts must be specifically evaluated in the shared services context where staffing constraints may create pressure to consolidate functions.

Data privacy and cross-border data transfer risk arises when the shared services center processes personal data, financial data, or other sensitive information for operations in jurisdictions with data protection regulations that restrict the cross-border transfer of such data. The GDPR in Europe, the LGPD in Brazil, and numerous other data protection laws impose specific requirements on the transfer of personal data to jurisdictions that may not be deemed to provide adequate data protection. Organizations must ensure that their shared services arrangements comply with applicable data transfer requirements, including the use of standard contractual clauses, binding corporate rules, or other approved transfer mechanisms.

Regulatory compliance risk in the local jurisdiction affects the shared services center itself. Employment law, tax obligations, social security requirements, and local regulatory obligations apply to the center's operations and workforce, and the organization must maintain compliance with these requirements alongside the compliance obligations of the regions it serves.

Service quality and transition risk arises during the migration of activities from business units to the shared services center. The transition period, during which activities are being transferred, staff are being trained, and the new processes are stabilizing, represents a period of elevated operational risk. Transaction processing errors, reporting delays, and control gaps are common during transition and must be managed through structured transition governance, parallel processing, and enhanced monitoring during the stabilization period.

Vendor and third-party risk applies when the organization supplements its shared services workforce with outsourced or contracted resources. The earlier posts on FCPA audit procedures and global compliance program design addressed the compliance obligations associated with third-party relationships, and these obligations apply with equal force to outsourced resources within the shared services operation.

Internal Audit And Assurance Over Shared Services

Internal audit plays a critical role in providing assurance over shared services operations. The centralization of transactional activities into a single operation creates both the opportunity for efficient audit coverage and the obligation to ensure that the concentrated activities are adequately controlled.

Scope of assurance. Internal audit should provide assurance over the design and operating effectiveness of the controls embedded in the shared services center's processes, the adequacy of segregation of duties within the center, the security of the technology environment including ERP access controls and data protection measures, the quality of the transition and stabilization process for newly migrated activities, and the center's compliance with applicable local regulations and with the organization's global policies.

Coordination with external audit. When the shared services center performs financial accounting and reporting activities that are relevant to the organization's consolidated financial statements, the external auditor must evaluate the controls at the shared services center as part of the audit of internal control over financial reporting. Internal audit should coordinate its shared services audit coverage with the external auditor to ensure consistent coverage, avoid duplication, and share relevant findings. This coordination is consistent with the assurance mapping principles discussed in the earlier post on coordinating risk oversight.

SOX compliance considerations. For organizations subject to SOX Section 404, the controls performed by the shared services center are within the scope of management's assessment of internal control over financial reporting. The key controls over accounts payable, accounts receivable, general ledger, fixed assets, and financial reporting that are performed by the shared services center must be documented, tested, and assessed for operating effectiveness. The earlier posts on key controls versus non-key controls and on what SOX auditors test in SAP provide the frameworks for determining which shared services controls are key and how they should be tested.

Continuous monitoring. The concentration of transactional data in a shared services operation creates ideal conditions for continuous controls monitoring, as discussed in the earlier post on integrating GRC controls through business intelligence. Automated monitoring of transaction patterns, exception rates, processing timeliness, and control effectiveness indicators can provide real-time assurance over the shared services operation and can identify emerging control weaknesses or process deterioration before they produce material errors or losses.

The Strategic Decision: Build, Partner, Or Outsource

Organizations establishing shared services operations must decide whether to build and operate the center with their own employees (captive shared services), to partner with a third-party provider that operates the center under the organization's direction (managed services), or to outsource the activities entirely to a business process outsourcing provider (BPO).

Each model carries different implications for governance, risk management, and cost structure. Captive shared services provide the greatest control over processes, data, personnel, and the control environment, but require the organization to invest in facilities, technology, management, and local operational expertise. Managed services transfer operational responsibility to a partner while retaining varying degrees of control and oversight, but introduce vendor management complexity and dependency risk. BPO provides the most immediate cost benefit and scalability but creates the greatest governance, compliance, and data security challenges because the organization's transactional activities are performed by an external party with its own processes, systems, and control environment.

The GRC implications differ significantly across these models. Captive shared services centers are subject to the organization's own governance framework and control standards, and internal audit has direct access to the operation. BPO arrangements introduce the need for service organization control reports (SOC 1 Type II reports, formerly SAS 70) to provide assurance over the controls at the service organization, the establishment of contractual service level agreements and right-to-audit provisions, and the implementation of vendor risk management and oversight processes.

The selection among these models should be informed by the organization's risk appetite, its capability to manage third-party relationships, the sensitivity of the activities being centralized, the regulatory requirements of the jurisdictions involved, and the organization's strategic assessment of whether shared services management is a core competency that should be retained or a support function that can be effectively delegated.

From Operational Efficiency To Governance Advantage

Shared services centers, when designed and governed effectively, provide benefits that extend well beyond the cost savings that typically justify the initial investment. The standardization of processes creates a more controllable and auditable operational environment. The centralization of transactional data creates opportunities for analytical monitoring that are impractical in distributed operations. The concentration of specialized expertise creates a professional community that can develop deeper functional knowledge and more effective control practices than individual business units can achieve independently.

However, these benefits are realized only when the shared services strategy is accompanied by a governance framework that addresses the concentration risks, the compliance obligations, the data protection requirements, and the control environment challenges that centralization creates. A shared services center that achieves cost savings while introducing segregation of duties conflicts, data transfer violations, or business continuity vulnerabilities has not achieved a net improvement in the organization's risk profile.

The organizations that derive the greatest strategic value from shared services are those that treat the governance and risk management dimensions of the shared services strategy with the same rigor as the operational and financial dimensions, and that view the shared services center not merely as a cost-reduction mechanism but as a platform for control environment improvement, compliance standardization, and analytical capability development that strengthens the organization's GRC framework as a whole.

What Companies Typically Look For In An SSC Or BPO Location

When companies evaluate a location for shared services or outsourcing, they usually look at a combination of factors.

They assess whether the labor market provides sufficient talent in finance, accounting, IT, operations, and language support. They examine whether the workforce can operate in multilingual environments and support international service standards. They consider communications infrastructure, business continuity, cybersecurity readiness, and operational resilience. They also look at wage competitiveness, labor flexibility, management depth, regulatory complexity, inflation exposure, tax conditions, and the practical ease of building or scaling an operation.

Buenos Aires has often been considered attractive because it can support relatively sophisticated business services while offering strong professional talent and useful geographic positioning. That said, any location assessment should also consider macroeconomic volatility, labor market dynamics, currency issues, and operational risk. No location is attractive on strengths alone.

Ranked Outsourcing Companies

1	ExxonMobil	Buenos Aires (Catalinas)	580 professionals since 2004; handles controlling (accounting, fixed assets, AP/AR), procurement, HR for global affiliates.​
2	Google	Buenos Aires (Puerto Madero)	100+ professionals; supports AdWords billing, finance, customer care for LATAM, Europe; top-ranked employer.​
3	IBM	Martinez	300 professionals since 2000 (recent growth); service delivery for IT and back-office, migrating more activities.
4	Chevron Texaco	Buenos Aires	Shared Services Center since 2007; accounting posting/reconciliation for LATAM, UK, US with SOX/US GAAP expertise.
5	McDonald's	Martinez	Centro de Servicios Compartidos since 2007; AR/AP, accounting, reporting, planning for LATAM.
6	SAP	Buenos Aires (Puerto Madero)	40 professionals since 2007; billing, procurement, AR/AP, customer care for North America/LATAM.
7	Cargill	Not specified	Shared Services for regional HR and payroll.
8	JPMorgan	Not specified	Outsourcing presence in finance/IT (details limited).
9	Deloitte	Not specified	Big Four firm; global audits and outsourcing services.
10	Capgemini	Not specified	IT consulting and back-office outsourcing.
11+	Others (DHL, Philip Morris, Huawei, Accenture, Quilmes/Inbev, SC Johnson, TMF Argentina, Axial Analytics)	Various (Buenos Aires focus)	Import/export (DHL), back-office/consulting (Accenture, others); Big Four expanding audits/outsourcing.

 Why Finance And Accounting Work Often Moves First

Finance and accounting are among the most common functions to migrate into shared services models because the work is process intensive, scalable, and highly sensitive to standardization. Activities such as accounts payable, accounts receivable, billing, reconciliations, fixed assets, intercompany accounting, payroll support, close support, reporting preparation, and master data maintenance are all well suited to centralization when processes are stable enough and control design is strong.

Argentina has historically been attractive for this type of work because of the depth of accounting and finance talent and the ability to support multinational processes in both regional and cross regional settings. In some cases, organizations also use such hubs for internal control support, SOX related documentation, reporting analytics, and selected audit support services.

The control implication, however, is important. A finance SSC is not just an efficiency platform. It becomes part of the internal control environment. That means service design, governance, escalation, access controls, supervision, and process ownership all need to be clear from the start.

What A Strong Shared Services Strategy Should Actually Achieve

Many organizations describe shared services in terms of cost reduction. That is too narrow. A mature SSC strategy should aim to improve process quality, increase standardization, strengthen data consistency, reduce local fragmentation, improve service levels, and create a clearer basis for automation and control monitoring.

Done well, shared services can streamline handoffs, reduce non value added activity, improve control visibility, and support stronger process ownership across geographies. Done poorly, they can simply centralize broken processes, create distance from the business, and introduce new operational, conduct, and compliance risks.

That is why the strongest SSC designs are built around service architecture, controls, governance, and customer orientation rather than labor arbitrage alone.

Why Governance And Control Matter In Location Decisions

A common weakness in outsourcing and shared services decisions is that organizations focus heavily on cost and talent while underestimating governance and risk. This is especially dangerous in finance, payroll, procurement, HR, and IT support activities where process errors can quickly become financial reporting issues, data protection incidents, compliance failures, or operational disruptions.

When evaluating a location or provider, companies should assess not only service capacity but also business continuity, access governance, data privacy controls, fraud risk, legal enforceability, regulatory exposure, incident response capability, internal control maturity, and the quality of management oversight. They should also understand whether key controls remain with the business, move into the SSC, or become split across teams in ways that create accountability gaps.

This is particularly relevant in any location with macroeconomic volatility or evolving regulatory conditions. The right response is not to avoid such environments automatically. It is to design the control model with that reality in mind.

Why Buenos Aires Has Been Used For More Than Basic Back Office Work

One of the more important insights in your original draft is that Buenos Aires has not only supported transactional processing, but also more skilled work. That remains an important point.

In many cases, operations based in Buenos Aires have supported multilingual service delivery, financial reporting support, intercompany processes, procurement support, data analysis, IT support, internal control related activities, and regional or cross regional customer operations. This is one reason the city has remained relevant. It is not only a low cost processing location. It has often been used as a talent platform for broader business support.

The more credible way to state this in a timeless article is not to anchor the argument in the headcount of specific companies at a specific moment. It is to note that a range of multinational companies across energy, technology, consumer, logistics, industrial, and professional services sectors have historically used Buenos Aires as part of their global service delivery footprint.

What Types Of Services Are Most Commonly Supported

The service mix typically associated with Buenos Aires and similar hubs includes finance and accounting support, payroll and HR administration, data processing, procurement support, reporting services, customer support, IT support, analytics, and selected professional service activities.

Finance and accounting services often include billing, payment processing, reconciliations, reporting preparation, fixed asset support, close support, intercompany accounting, and control documentation. Back office support may include data entry, document management, CRM support, order administration, and service desk work. IT related support may range from staff augmentation and application support to selected managed services or development support depending on the operating model.

The specific service mix depends heavily on the maturity of the company’s process model and the complexity it is willing to centralize.

What Organizations Should Watch Closely

A balanced thought leadership view should also address the watchpoints.

Companies using Buenos Aires or any similar location should pay close attention to inflation and currency effects, wage competitiveness over time, retention in critical skill pools, regulatory and tax changes, data transfer requirements, labor law considerations, and concentration risk if too much work is centralized in one city or region.

They should also examine whether the service model has enough resilience. A location may appear efficient in steady state but become fragile if the company has not built adequate continuity planning, leadership depth, process documentation, and cross training.

This is where GRC leaders should be active. Outsourcing and shared services decisions are operating model decisions, but they also have direct implications for internal control, data governance, resilience, and compliance.

Why The Decision Should Be About Operating Model Fit, Not Only Cost

The strongest companies do not ask only whether a location is cheaper. They ask whether it is the right fit for the work, the control environment, the talent model, and the customer service expectations they need to support.

In some cases, Buenos Aires may be highly attractive for finance, multilingual support, analytics, and professional back office work. In other cases, the right answer may be a more diversified hub model across several locations. The decision should be based on service criticality, risk appetite, continuity needs, and the maturity of the company’s process architecture.

That is the difference between tactical outsourcing and strategic shared services design.

Final Perspective

Buenos Aires has remained relevant as a shared services and outsourcing location because it offers more than labor cost advantage. It has historically provided educated talent, language capability, and the ability to support relatively sophisticated business processes for multinational organizations.

The strategic question for companies is not simply whether the city is attractive in general. It is whether the location fits the specific service model, control requirements, resilience expectations, and governance design the company needs.

That is how location strategy becomes part of enterprise operating model design rather than just a sourcing decision.

References

Leading market practice in shared services strategy, global business services design, and outsourcing governance

Publicly available provider reviews and market observations from sourcing and BPO directories, to be used cautiously and supplemented with direct due diligence

Professional services guidance on shared services operating models, control design, and service governance