Case Studies in Implementing & Sustaining Continuous Controls Monitoring Programs Across ...

183 Pages·2007·10.12 MB·English

Case Studies in Implementing & Sustaining
Continuous Controls Monitoring Programs
Across Diverse IT Environments
©2006 Approva Corporation. All rights reserved.
Automating Controls
• Featuring
– Jeff Skelly
VP Western Region
[email protected]
– Mike Snodgrass
Senior Solutions Consultant
[email protected]
– Marc Saalberg
Regional Director
[email protected]
– Objectives
- Understand controls automation and the business drivers
- Apply a maturity model for automating controls
- Understand a framework for automation
- Review case studies for controls automation (UGS, Limited Brands,
Honeywell)
2
5/11/2007 (c) OCEG 2
About Approva
Approva provides market-leading continuous monitoring and
audit software that enables finance, business, IT and audit to
automate and strengthen business controls.
Continuous,
On-Demand Closed-Loop Preventive Exception-
Testing Remediation Controls Based
Monitoring
With unique focus and approach…
Standard Integration
Independent
for Companies with the Extreme
Enterprise
and Controls Customer Care
Application
Auditors Ecosystem
3
Company Background & Market Alignment
Audit Firms
(cid:131) Founded in December 2001;
Headquartered in Reston, VA
(cid:131) Experienced Management Team & Board
(Harvey Pitt, Former SEC Chairman; Phil Livingston,
SOX co-draftee, Rick Steinberg, co-author COSO
Framework)
Platform Partners
(cid:131) 200+ Employees; Over Half in Product
Development
(cid:131) Rapidly Growing Customer Base of
Global 2000 Companies
Compliance ISVs
(cid:131) 500+ Approva Certified Professionals
(ACPs) across major audit firms
Documentation: Identity Management:
• OpenPages • Sun
• Axentis • IBM
• SAP • Oblix/Thor (Oracle)
• Oracle • BMC
4
• Others… • Others…
Who Are These Guys?
5

Types of Controls
• Identify control problems
• Immediately alert control owners of
exceptions
Detective
• Serve as brakes on day-to-day
business processes
• Preventing unwarranted activity and
Preventive
actions
• Counterbalance the potential effect
on an internal control weakness
Compensating
• Usually a manual process or review
7
Types of Controls
Manual Automated
Manual Automated
Joe Examines Sample of CCM System Analyzes
50 POs per Month to All POs; Exceptions to
Ensure Policy Adherence Policies Are Fagged
Detective
Provisioning System
Sally Reviews & Signs Off
Reviews ERP User
on Every ERP User Access
Access Requests
Request for Finance Users
Preventive Against Pre-Set Rules
Manager Reviews CCM System Monitors
Transactions for Employees User Activity; Notifies
With Sensitive Access Manager of Sensitive
Compensating
Transactions
8
CCM = Continuous Controls Monitoring
Moving Towards Automated Preventive Controls
Existing Controls Eliminated Controls Newly Implemented Controls
9
Source: KPMG LLP
Moving Towards Automated Preventive Controls
Existing Controls Eliminated Controls Newly Implemented Controls
10
Source: KPMG LLP