APG Maturity Model - Test Survey

Welcome to APG Maturity Model Survey!!!

In this survey, you will be asked to complete a set of questions about your existing state and expected future state of policies and processes. It will take approximately 20 minutes to complete the survey.

Your participation in this survey is completely voluntary. There are no foreseeable risks associated with this survey. However, if you feel uncomfortable answering any questions, you can withdraw from the survey at any point. It is very important for us to learn your opinions.

Your responses will be strictly confidential and will be reported only in the aggregate. Your identity will remain confidential. Thank you very much for your time and support. Please start with the survey now by clicking on the Continue button below.

How often does your organization review its existing policies to assess policy needs relating to changes in the business and/or to respond to changes in authoritative/regulatory guidelines?

Current State

Expected Future State

Organization has not performed a review of existing policies in recent history, nor recognizes the need for periodic review.

Organization has not performed a review of existing policies in recent history, however does recognize the need for periodic review.

Organization reviews existing policies periodically, considering changes in the business and/or changes in authoritative/regulatory guidelines, however has not established minimum review procedures defining the appropriate period after which policies should be reviewed.

Existing policies are categorized by risk. High risk policies are reviewed at least annually to assess whether review is required in response to both changes in the business and changes in authoritative/regulatory guidelines. Medium risk policies are reviewed every two years and low risk policies are reviewed every three years.

What are the common triggers that lead to policy development? Are policies typically created in a reactive manner or proactive manner?

Current State

Expected Future State

Policies are developed once significant issues are identified, typically by the auditor (i.e., material misstatements, control issues, significant audit adjustments, etc.).

Policies are developed in response to issues identified by business units during their periodic review.

The organization's technical accounting group monitors changes in authoritative guidance to assess whether new policies require development.

In addition to monitoring new and/or revised authoritative guidance, the organization's technical accounting group reaches out to business units periodically to request input regarding potential policies requiring development.

Are all existing approved policies valid in the current business environment? Are there any policies that are no longer utilized or require updating to be relevant?

Current state

Expected Future State

Over 80% of the organization's policies are no longer relevant or used by business unit personnel.

Over 40% of the organization's policies are no longer relevant or used by business unit personnel.

Over 80% of the organization's approved policies remain relevant and are often consulted by business unit personnel.

All of the organization's approved policies remain relevant and are often consulted by business unit personnel.

Are policies aligned between the corporate function and business units throughout the organization?

Current state

Expected Future State

There is no alignment between policies at the corporate and business unit level.

Business unit management are requested by corporate to align their policies to those issued by corporate, however business unit policies are not reviewed by the corporate function.

The corporate function assists business unit management in developing policies that are aligned with corporate policies.

Only one set of policies exists within the organization, including corporate policies, and addendums for nuances at the business unit level.

Have you received any feedback regarding the quality, usability, relevance, or ease of implementation of existing policies?

Current state

Expected Future State

The organization does not have a formal method to obtain or measure feedback on existing policies.

Some negative feedback has been received in the last year.

Some positive feedback has been received in the last year. Minimal negative feedback has been received.

In addition to positive feedback received regarding existing policies, management does not typically receive questions requesting clarification on existing policies.

How does your organization benchmark its existing policies against similar sized organizations in your industry?

Current state

Expected Future State

The organization does not benchmark its existing policies against similar sized organizations in its industry.

The organization does benchmarks its existing policies against publicly available policy disclosures from similar sized organizations in its industry.

The organization does benchmarks its existing policies against publicly available policy disclosures from similar sized organizations in its industry, and also obtained benchmarking information from its auditors.

In addition to benchmarking activities, the organization participates in a working group with similar sized organizations in its industry where technical accounting topics and policies are discussed.

Do your organization’s policies comply with GAAP, IFRS, and/or prevailing regulatory requirements?

Current state

Expected Future State

Many of the organization's policies are out of date and do not comply with GAAP, IFRS, and/or regulatory requirements.

Some of the organization's policies are out of date and do not comply with GAAP, IFRS, and/or regulatory requirements.

All of the organization's policies comply with GAAP, IFRS, and/or regulatory requirements.

All policies comply with GAAP and/or IFRS and include supplemental information to comply with regulatory requirements and statutory reporting requirements, as applicable.

Are they user friendly? Do they contain uniform headers that are appropriate? Are they the right length?

Current state

Expected Future State

There is no standard policy template used to facilitate usability of policies. Business unit finance personnel have raised issues with respect to the usability of policies in the past.

While there is a standard policy template used to facilitate usability of policies, business unit finance personnel have raised issues with respect to the usability of policies in the past.

A standard policy template exists and is utilized by finance personnel.

A standard policy template exists and incorporates feedback from business unit finance personnel and other policy end-users.

Are they written in plain English to effectively bridge the gap between rules and business practices?

Current state

Expected Future State

Policies are essentially copies of authoritative guidance.

Policies are summaries of authoritative guidance.

Policies include a summary of authoritative guidance and plain English explanation of the relevance to the organization with some relevant examples.

Policies include a summary of authoritative guidance and plain English explanation of the relevance to the organization with a significant number of tailored, specific examples.

Are they linked to standard operating procedures (and desk instructions) to form a policy framework that supports the control environment?

Current state

Expected Future State

The organization does not have standard operating procedures or desk instructions.

The organization has standard operating procedures (and desk instructions), however these are not linked to the organization's policy documents.

The organization has standard operating procedures (and desk instructions), that are linked to the organization's policy documents.

The organization has standard operating procedures (and desk instructions), that are linked to the organization's policy documents and these documents were developed concurrently by the same owner/working group to mitigate the risk of misalignment.

Does your organization have a “policy on policies” that defines when to create, revise or decommission policies, identifies process owners, and sets approval requirements?

Current state

Expected Future State

The organization does not have a “policy on policies” and has not considered when to create, revise or decommission policies, identifies process owners, and required approval requirements.

The organization does not have a “policy on policies” but has considered when to create, revise or decommission policies, identifies process owners, and required approval requirements.

The organization has a “policy on policies” that defines some considerations relating to when to create, revise or decommission policies, identifies process owners, and sets approval requirements.

The organization has a “policy on policies” that defines when to create, revise or decommission policies, identifies process owners, and sets approval requirements.

How are working groups formed and who is included on them? How are work plans and timelines created?

Current state

Expected Future State

Working groups are not used to develop policies.

Working groups are assembled in an ad-hoc basis, with no formal PMO function.

Working groups are assembled for each policy development process. An owner is assigned to run PMO and be ultimately accountable for the development of the policy.

Working groups are assembled for each policy development process including policy end-users and appropriate subject matter resources. An owner is assigned to run PMO and be ultimately accountable for the development of the policy.

Who approves major /minor changes? How is consensus and stakeholder alignment achieved?

Current state

Expected Future State

No formal approval requirements exist.

All policy changes are approved by an executive within corporate finance.

A policy committee exists with members from a sufficiently executive level, who review and approves all major changes to policies. An executive within corporate finance is required to approve minor policy changes that are not submitted to the policy committee.

A policy committee exists with members from a sufficiently executive level, who reviews and approves all major changes to policies. Policy changes require consensus within the policy committee, who are given a chance to consult with appropriate stakeholders, end-users, and subject matter resources. An executive within corporate finance is required to approve minor policy changes that are not submitted to the policy committee.

How are policy changes communicated to the organization and implemented?

Current state

Expected Future State

The organization relies on the policy owner to communicate policy change to the organization.

The organization provides training and education to a select group of employees. Attendance at training sessions is not monitored.

The organization communicates policy changes through email alerts to all impacted employees and provides training and education to a select group of employees. In certain cases, attendance at training sessions is monitored.

The Organization has multiple venues of communication that are simultaneous with the policy change including: internal webinars; education & training seminars and email alerts. The organization monitors employees attendance at education and training events and follows up where impacted employees have not attended training sessions.

When are external resources used to aid with drafting accounting policies?

Current state

Expected Future State

The organization does not utilize external resources and has little documentation supporting accounting policies.

The organization drafts only its significant accounting policies which are reviewed by its auditors.

The organization drafts all of its accounting policies which are reviewed by its auditors.

The organization drafts all its policies and consistently seeks external assistance on highly technical issues to ensure policies are current and relevant.

Are your policies centrally accessible to employees?

Current state

Expected Future State

The organization has a shared network drive that is accessible by only certain employees and is not properly maintained or policies are not centrally accessible.

The organization has a shared network drive that is properly maintained, but is not accessible by all relevant employees.

The organization has a central repository that is properly maintained, but is only accessible to certain employees.

The organization maintains a central repository for its policies that is accessible by all employees.

How is training provided to employees upon issuance of new and/or revised policies?

Current state

Expected Future State

The organization does not provide formal training, but relies on management's ability to communicate policies to employees.

The organization provides training on new and/or revised policy but it is not timely and/or not monitored for attendance. Training is not accessible if it is missed.

The organization provides training in a timely manner to all employees. Training is limited to certain times and follow-up training is limited.

Employee are provided training upon the issuance of new or revised policies in a variety of venues such as webinars, live seminars, and knowledge sharing. Training is also available by way of replays.

How are existing policies communicated to new hires and/or employees taking on new roles and responsibilities?

Current state

Expected Future State

New hires and employees changing roles are directed to the policy manual (if applicable). Supervisors monitor compliance and answer questions.

Supervisors play an active role in educating employees on existing policies and responsibilities. Supervisors are accountable for the employee's compliance with company policies.

The organization provides formal on-board training to new hires and supplemental training to employees taking on new roles. The company has established policies accessible online.

The organization provides formal on-board training to new hires and supplemental training to employees taking on new roles. The company has established policies accessible online. The organization has continuing education requirements.

How does your organization communicate new and/or revised policies to employees?

Current state

Expected Future State

The organization communicates new and/or revised policies to its management group and relies on them to communicate to its employees. There is no method in place to monitor communication.

The organization communicates new and/or revised policies to its management group and relies on them to communicate to its employees. Management monitors the communication.

The organization communicates new and/or revised policy changes through email alerts only and provides access to education.

Employees are alerted to new and/or revised policies through a variety of communications: email alerts, training and education events, and webinars.

How is training monitored? What types of follow-up occur where employees do not attend relevant training sessions?

Current state

Expected Future State

The organization has no formal method to monitor or follow-up relevant training sessions.

The organization utilizes manual sign-in attendance sheets. The presentation is provided to the employee as a take-away from the training session.

The organization has established learning requirements for employees that electronically monitors employee CE. The company provides replays and training material take-aways.

The organization has established learning requirements for employees that electronically monitors employee CE. The organization provides taped replays of the session. Also, the employee receives alerts for required learning elements.

When are external resources brought in to assist in the creation and delivery of training?

Current state

Expected Future State

The organization creates and delivers all of its training sessions.

The organization establishes work groups to develop and deliver training sessions. Third party resources are not consulted.

The organization establishes subject matter expert work groups to develop and deliver training sessions. Third party resources are consulted on highly technical material.

The organization establishes a committee to work with third party providers to develop and deliver relevant training.

Does the Organization have a method to assess whether global policies are aligned?

Current state

Expected Future State

The organization does not have any method of aligning global policies. Many policies are not properly documented.

The organization periodically reviews its policies, but does not assess alignment with the organization's global policies.

The organization has established a work group focused on policies that regularly monitors the company's global policies to ensure that they not only meet the specific jurisdiction requirements, but also are properly aligned within the organization.

The organization has a established a work group focused on policies that regularly monitors the company's global policies to ensure that they are not only relevant, but also meet the specific jurisdiction requirement and are properly aligned within the global organization.

Does the organization have a method to assess its policies when material weaknesses and/or significant deficiencies have been identified?

Current state

Expected Future State

The organization does not have a formal method to review policies; when MW and/or SD's are identified the organization revises the appropriate policies.

The organization reviews its policies on a regular basis. When a MW and/or SD occurs the organization revises the appropriate policy and seeks third party review.

The organization formally reviews its policies on a regular basis and when MW and/or SD is identified the organization reviews the root cause and revises the policy if necessary and seeks third party consultation.

The organization maintains appropriate policies and procedures for review. When policies are associated with identified MW and/or SD, the organization reviews the root cause and takes appropriate action (i.e. training and education, update policies, etc.).

Have there been restatements and /or significant audit adjustments?

Current state

Expected Future State

The organization does not have a formal method to review policies when restatements and/or significant audit adjustments occur.

The organization reviews its policies on a regular basis. When a restatement and/or significant audit adjustments occurs the organization revises the appropriate policy and seeks third party review.

The organization formally reviews its policies on a regular basis and when a restatement and/or significant audit adjustments occurs. The organization reviews the root cause and revises the policy if necessary and seeks third party consultation.

The organization maintains appropriate policies and procedures for review. When policies are associated with a restatement and/or significant audit adjustment, the organization reviews the root cause and takes appropriate action (i.e. training and education, update policies, etc.).

How does the Company address SEC comments regarding accounting policies?

Current state

Expected Future State

The organization address SEC comments internally.

The organization drafts replies to SEC comments. The organization reviews and revises the policies as deemed necessary.

The organization has an established work group that reviews all SEC comments. Comments associated with a breakdown in policy are elevated to the policy owner to respond to the SEC. The policy is revised as deemed necessary and the revision is communicated to the employees.

The organization drafts the reply to SEC and seeks third party consultation. The organization establishes a work group that reviews all SEC comments. Comments associated with a breakdown in policy are elevated to the policy owner to review the policy. The policy is revised as deemed necessary and the revision is communicated to the employees. Employees are trained on the revised policy.

Is the governance process aligned to existing internal control and risk management framework?

Current state

Expected Future State

The organization has no formal method to monitor the alignment of governance process with its existing control and risk management framework.

The organization has a formal method to monitor the alignment of governance process with its existing control and risk management framework but does not review regularly.

The organization maintains work groups that periodically monitor the alignment of its governance process to the internal controls and risk management framework.

The organization maintains work groups that regularly monitor the alignment of its governance process to the existing controls and risk management framework. The group is responsible for assessing the impact of new regulatory and compliance matters.

APG Maturity Model