Businesses may not have control over the economic environment, but they do have a tool that can help: improving efficiency.

In recent months, companies have seen their operating costs rise to varying degrees as wages have escalated, input prices have soared and financing costs have increased. If they want to curb profit margin erosion, their only alternative is to become more efficient.

While influencing the cost of resources (raw materials, equipment, labour, etc.) is not within a company’s power, measuring how it uses these resources and optimizing them is possible. Unfortunately, too few SMEs analyze their processes to identify potential waste. This makes it difficult for them to get an accurate picture of their operational performance and identify areas for improvement.

Identifying key optimization opportunities

You need to review all your processes to see where there is room for improvement. For example, here are some key questions to determine operational efficiency and understand the profit shortfall:

• Are employees maximizing their work time?
• Do they need to wait for raw materials or move around the plant unnecessarily?
• Is insufficient maintenance causing equipment stoppages?
• How much are you losing because of a quality problem?

Tracking performance indicators

Achieving your objectives means using relevant performance indicators and well-designed dashboards for both internal and external comparisons. Tracking should be done regularly. The frequency depends on the indicator, it can be daily, weekly, annually or even in real time. Checking indicators at the right time significantly increases the chances of correcting the situation.

Controlling production costs

Another essential factor in reaching your business objectives is to improve your production costs. A good costing model makes it possible to calculate all the direct or indirect expenses (production costs, supply costs, administrative costs, etc.) required to produce a product or service so that a profitable price can be determined.

This exercise must be repeated at least once a year and as the company changes. Furthermore, with significant inflation, part of the increase in input costs has to be passed on to products and services. The other part should be offset by improving efficiency.

Consider a factory that is unable to operate at full capacity because it does not have enough people. Instead of spreading its costs over 10,000 production hours, it must now amortize them over 9,000 hours, which necessarily increases its production cost.

To improve its results, it will have to make choices. It may have to increase its selling price, reduce or eliminate some expenses, optimize processes, or refocus its activities on certain products or services.

The company can also measure the profitability of its customers. In one study, researchers Cooper and Kaplan showed that, on average, 20% of customers generated 225% of a company’s profits, while 70% generated no profit. The remaining 10% were much more costly, accounting for 125% of losses.

Although this study was published in the 1990s, our experience shows that this calculation is still valid and that the gaps tend to become even wider in some sectors.

In tangible terms, this means that a company with a profit of $100,000 could potentially increase its profit to $225,000 if it had a better understanding of its costs and profitability.

Using such an analysis, the company can make more informed decisions, whether it be to work differently with certain customers or renew their customer base.

By taking action on specific aspects of their activities, managers can quickly adapt to the situation and improve their performance despite a less favourable context.

Updated on February 19, 2024

Assessing treasury operations provides an opportunity to analyze your overall IT vulnerabilities across the board.

Statistics show that, just like cyber risk, the greatest fraud threat to businesses often comes from within and originates from users, accounts and endpoints.

IT security is therefore an extremely important aspect that should not be overlooked when evaluating and modernizing your current treasury operations systems.

Here are the different points to examine and consider in your improvement plan.

Identify your vulnerabilities

Examine your system infrastructure, processes and delegation of responsibilities to determine potential threat sources.

Take your methods to the next level

Find simple ways your organization can move away from high-risk payment methods to reputable, electronically traceable payment methods.

Improve your cybersecurity posture

Boost your overall digital security posture with some essential cybersecurity basics.

Minimize your fraud exposure

Automate processes to reduce your exposure to fraud and human errors.

Protect your endpoints and access

Ensure that your endpoints, communication channels and platform access are properly protected.

Implement best practices

Apply best practices to your accounts. For example, use unique and complex passwords for the platform, ideally relying on a password manager, and enable the use of multi-factor authentication.

Protect your managed endpoints

At the same time, you should consider implementing a managed endpoint protection (XDR) solution, since a compromised endpoint could allow an attacker to exploit your own active sessions.

Install an email filtering solution

An advanced email filtering solution is also highly recommended. Emails remain a key attack vector for attackers, and you should be properly protected so that your colleagues are less exposed to social engineering, phishing, spam or other email threats.

Implement a managed treasury solution

Using managed solutions will give you a stronger security posture, with no additional burden on your teams, and help improve your organization’s efficiency and resilience.

Leverage internal training

Even if your organization updates its policies and governance during this modernization, you should support your security improvement efforts with a cybersecurity awareness training campaign to ensure everyone is up to speed on the latest best practices.

To ensure that you make the right choices among the proposed solutions, get an expert who understands your needs and will steer you in the right direction.

Your organization is required to comply with Law 25 and implement an information governance program. What exactly are your obligations?

In Québec, any private enterprise that collects, processes or communicates personal information is covered by this law. It is therefore likely that it applies to you!

Let’s take a look at the main provisions of Law 25 and what they mean for your business.

What is Law 25?
What are a private business’s obligations under Law 25?
Why have an information governance program?
How can you create an effective governance program?

What is Law 25?

The Act respecting the protection of personal information in the private sector, also known as Law 25, is designed to protect the Québec population by making organizations accountable for the personal information they hold.

Some provisions of the new legislation came into effect on September 22, 2022. Others will come into effect in September 2023 and 2024, including the requirement to implement a personal information governance policy.

The Commission d’accès à l’information du Québec is the agency responsible for monitoring compliance with the law. The Commission can impose significant penalties for non-compliance, up to $25 million or 4% of a company’s worldwide sales.

What are a private business’s obligations under Law 25?

Since September 22, 2022, Law 25 imposes a number of responsibilities for private enterprises in Québec, regardless of their size.

Appoint a Privacy Officer

The enterprise must appoint a Privacy Officer to ensure compliance with the law. This role will fall to the person with the highest authority in the organization, but some or all of the duties can be delegated to another individual. Their title and contact details must be published on your website.

Maintain a register of confidentiality incidents

It is also necessary to keep a register of confidentiality incidents. You must be able to provide a copy of this register to the Commission d’accès à l’information at its request. In addition, if an incident occurs that poses a serious risk of harm, you are required to notify the Commission and the individuals involved.

Forward information under certain conditions

Lastly, new rules allow you, under certain conditions, to disclose personal information without the consent of the individual concerned when concluding a commercial transaction. You should make sure that the supplier to whom you are disclosing this information complies with the obligations set out in the law.

For a detailed description of your current and future obligations, consult the Commission d’accès à l’information’s checklist (French only).

Why have an information governance program?

New provisions of Law 25 will come into effect as of September 22, 2023. Among them: the obligation to have established policies and practices regarding personal information governance.

There are several advantages to creating an information governance program, beyond compliance with legal obligations. Here are a few of them.

Clearly defining everyone’s responsibilities and obligations

The information governance program is designed to ensure that privacy responsibilities and obligations are clearly defined and understood by all.

Better protecting information

It helps protect the information within the organization by making it accessible only to those who need it.

Reacting efficiently

It is a tool that fosters a quick response in the event of a confidentiality incident despite the preventive measures in place.

Showcasing your organization’s diligence

This program also serves as proof that the organization has acted diligently if a privacy incident occurs that poses a serious risk of harm.

Not only can a privacy incident be costly to your organization, it can also damage its reputation or compromise profitability. That’s why it is important to have an information governance plan with adequate protection for the organization.

How can you create an effective governance program?

To build an effective information governance program, it is important to take an inventory of the personal information your organization holds. You should also map out how this information flows through the organization. Among others, this will allow you to identify the type of information you collect, define the activities for which it is used and determine who should have access to it.

During this process, you may also discover unnecessary information. For example, if your company only has about 30 workers, having more than 500 employee records in your system is not normal. If you find that you have retained personal information that is no longer useful, it is important to destroy it.

Set a data retention schedule

This is one of the reasons why it is advisable to prepare a data retention schedule, which states that after a certain date, the information you have collected will be destroyed. For example, at the end of a hiring process, you will need to delete or anonymize personal information contained in the resumes you received.

These are just a few of the factors to consider when developing an effective information governance plan. Other aspects you should address include:

• Setting up an incident management plan;
• Introducing surveillance measures;
• Documenting staff roles and responsibilities.

For advice on implementing an information governance program tailored to your organization, contact our team of experts.

This article was written with Sébastien Meunier, Vice-President of information governance at Raymond Chabot Grant Thornton.