My understanding is that SAP user roles are difficult to design properly, and the review of user authorizations and access rights is equally challenging. I thought that I could use analytics to identify instances where a user had performed transactions that constituted a potential separation of duties (SOD) issues in the FI component and support management in their reviews to identify roles that were not designed properly. The analysis utilized…
A common refrain that I hear is, “We can’t rely on the data because it does not have integrity.” This raises a couple of questions in my mind and should in yours as well. First, what is management using to produce its reports and make decisions? Second, how accurate does your data have to be to allow you to perform analytics and arrive at valid recommendations/conclusions. The obvious answer to…
This is the next post in a series that discusses the importance of having a proper audit objective, defining the business goals and objectives, and the risks to the achievement of those objectives. This article will discuss the identification and assessment of risk. The next series of articles will look at the audit finding statement: Criteria, Condition, Cause, Impact and Recommendation. The focus will be on the use of data…
According to the Protiviti report, ‘SOX Compliance and the Promise of Technology and Automation1’ SOX compliance costs have shown year-over-year increases but are starting to level off. It also states that organizations are beginning to make greater use of technology and automation to support the compliance process. However, implementing automation in the SOX compliance process is difficult for many organizations. Understanding and defining requirements, getting stakeholder buy-in, and the investment…
The next area that will need to be address by CAEs is ensuring that risk-based audit plans are relevant and that selected audits provide maximum value to senior management. Today’s business environment changes rapidly to adjust to market conditions, evolving legislation and economic forces; and the risk-based audit plan must keep pace with this rapid change if it is to properly identify and assess emerging risks that can impact the…
Are you an IT auditor who takes comfort in your specialized knowledge and feels secure in assessing general and application controls – but does no more? Then you need to wake-up to today’s business environment and step out of your comfort zone. You also will probably need to pull the general auditor away from the safety of pure compliance audits. The notion of the integrated auditor was usually applied to…
It is always important to test controls when systems and/or processes change. Sometimes a current process may have adequate controls, but the new process may not be as secure. Equipment Serial Numbers A large company with several plants purchased expensive, highly specialized, equipment for use in its manufacturing plants. A central purchasing organization made all the purchases and the inventory held until required by a plant. The inventory manager was…
Second part of article on making IT Audits more effective and value-added …. The next area that will need to be address by CAEs is ensuring that risk-based audit plans are relevant and that selected audits provide maximum value to senior management. Today’s business environment changes rapidly to adjust to market conditions, evolving legislation and economic forces; and the risk-based audit plan must keep pace with this rapid change if…
Many audit shops rely on IT auditors to support their use of data analytics; however, the IT audits typically focus on general and application controls. Around this time I wrote an article for the EDPACS magazine which encouraged IT auditors to look beyond the black box – to look at how IT supports, drives, and impact business processes. I have included below. IT Auditors need to come out of the…