Shifting roles across advisory, assurance and compliance

Ask an organisation what it needs to strengthen compliance, and the answer is often a system: a new ERP, a compliance platform or an AI tool.

The instinct is understandable. Regulatory requirements are becoming more demanding, particularly around governance, risk management, controls, reporting and accountability. The EU’s Digital Operational Resilience Act (DORA), which has applied to financial entities since 17 January 2025, places clear responsibilities around the governance and management of ICT risk. Malta’s transposition of the NIS2 Directive, in force since 23 January 2026, similarly strengthens expectations around cybersecurity risk management, governance and senior management accountability across a range of sectors.

These regulations help explain why organisations need stronger processes and controls. They do not, however, determine which technology an organisation should implement.
That decision should come later.
In our work with public and private sector clients, projects can sometimes begin with the tool before the organisation has fully agreed how the relevant regulatory requirements should be met in practice: who owns each process, which controls are required, who approves what, what evidence needs to be retained and what must be reported.

A system implemented before these questions are answered does not automatically create stronger compliance. It can simply automate existing inconsistencies and leave controls without clear ownership.

The starting point should therefore be the business requirement. Organisations first need to understand which obligations apply, translate those obligations into appropriate processes and controls, and establish clear accountability. Technology can then be selected or configured to support that operating model.

Process, data and governance come first

Beneath the technology discussion, three issues regularly emerge.

The first is process. Within financial and related operational processes, many organisations still rely on spreadsheets, manual reconciliations and the knowledge of a small number of key individuals, with different departments sometimes working in different ways. These are often the points where controls are applied inconsistently, bypassed or become difficult to evidence when an auditor or regulator asks.

The second is data. Systems that do not integrate can produce multiple versions of the same information. The question of “which report is correct?” becomes more than an operational issue when that information is being used for management or regulatory reporting.

The third is governance and change. Unclear ownership, deferred decisions and limited adoption following implementation can leave new systems underused and expected benefits unrealised.

This is where regulations such as DORA and NIS2 are particularly relevant. They reinforce the need for organisations to establish appropriate governance, risk management processes, controls and accountability. The regulatory requirement creates the need for an effective control environment. It is then for the organisation to determine how its processes should operate and what technology, if any, is required to support them.

Technology therefore becomes an enabler of the compliance framework rather than the starting point for designing it.

When technology is more directly part of the requirement

There are also regulatory developments where technology plays a more direct role in enabling compliance.

The EU’s VAT in the Digital Age (ViDA) package provides a clear example. From 1 July 2030, new Digital Reporting Requirements based on e-invoicing will apply to certain cross-border B2B transactions.

Meeting requirements of this nature will depend more directly on whether organisations have systems capable of generating, processing and reporting the necessary information in the required format and timeframe.

Even in these cases, however, implementing technology should not be treated as a standalone exercise.

Businesses will first need to understand which transactions fall within scope, what information must be captured, who is responsible for the underlying processes and how the information should flow through the organisation. Systems can then be configured to support those requirements effectively.

ViDA therefore illustrates an important distinction. Regulation may create the compliance requirement and, in some cases, make digital capability necessary to meet it. But the organisation must still define how compliance will work operationally before deciding how technology should support it.

Defining requirements before choosing technology

This is also why the lines between advisory, compliance and assurance are shifting.

Advisory work increasingly begins earlier, helping organisations understand regulatory requirements and translate them into operating models, processes, controls and data requirements before systems are selected or configured.

Compliance functions should be involved when these requirements are being defined rather than only at the final sign-off stage. Assurance can then assess whether the processes and controls put in place are operating as intended and whether the organisation can produce the evidence required.

For organisations considering a new system, the practical starting points are therefore relatively straightforward:

• Identify the regulatory and compliance requirements relevant to the organisation.
• Define how those requirements should be met through processes and controls.
• Establish clear ownership and accountability.
• Determine what information and evidence needs to be captured and retained.
• Map those requirements to the technology and systems that can support them.
• Establish reliable and governed sources of data for management and regulatory reporting.
• Treat training, adoption and change management as part of implementation rather than an afterthought.

Technology remains an essential enabler. In some areas, such as e-invoicing and digital reporting, it will increasingly become fundamental to meeting regulatory requirements.

But systems should support the compliance framework, not define it.

The business must first understand what it needs to achieve, how its processes and controls should work and who is accountable. Technology can then be selected and configured to enable those requirements effectively.

RSM Malta’s Digital Advisory team supports organisations in translating regulatory and business requirements into effective processes, controls, data flows and technology solutions.

To discuss how your organisation can better align its systems with business and compliance requirements, contact RSM Malta’s Digital Advisory team.

Sources

• DORA, Regulation (EU) 2022/2554, applies from 17 January 2025; Article 5(2) covers management body responsibility: EUR-Lex, MFSA notice
• NIS2, Directive (EU) 2022/2555; Article 20 covers governance and management body liability: EUR-Lex
• Malta NIS2 transposition: Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (S.L. 460.41), Government Gazette No. 21,418 of 8 April 2025; brought into force by commencement notice, Government Gazette No. 21,575 of 23 January 2026: L.N. 71 of 2025, L.N. 22 of 2026
• ViDA package: Council Directive (EU) 2025/516 of 11 March 2025, amending Directive 2006/112/EC as regards VAT rules for the digital age: EUR-Lex, European Commission

Article written by Simren Vijay Elantholy – Analyst, Digital