Liz Piteo Native Controls in a Microsoft Dynamics Environment

@GPUG Introduction  About Me – Certified in Microsoft Dynamics GP – Certified in Risk and Information Systems Control – 16 years experience in Microsoft Dynamics GP  About Fastpath – Audit and security solutions for Microsoft Dynamics – Over 1000 installations in 30+ countries – Named 2013 Industry Leader by Institute of Internal Auditors

@GPUG Agenda  Security Model  Security Reporting  Administrative Access  Segregation of Duties  Audit Trails  Workflow  Surviving the Audit

@GPUG Security Model

@GPUG Security Model Role > Task > Object POWERUSER Password complexity integrated with AD  New for GP – Limited user 2013 Limited to Inquiry and Reporting New flag on all forms to limit access – Self Service 2015 – Enable/Disable User – Alt/Mod Profile Revert to Default

@GPUG Security Reporting  Standard role/task/user reports  Build a Smartlist  Support debugging tool  Converted GP 9 roles  hp hp  POWERUSERS don’t show on access reports

@GPUG Support Debugging Tool  Available on Partnersource for now  There will be a fee for the product but it’s free now  Some great features include – Easy way to know you’re in a test company – Quickly and easily see security information regarding specific windows (roles and tasks) – screenshots of your open windows along with dex.ini and dynamics.set files – And many more!

@GPUG Using Smartlist for Security Reporting  Build a Smartlist – 2 new ones included in GP 2013  Smartlist example

@GPUG Security Reporting  Knowledgebase article – Frequently asked questions about role-based security in Microsoft Dynamics GP 10.0 and Microsoft Dynamics GP 2010 (Article )  Minimizing the use of ‘sa’ – paper-minimizing-the-use-of-sa-in-microsoft-dynamics-gp paper-minimizing-the-use-of-sa-in-microsoft-dynamics-gp  Support Debugging Tool  Security Information  Security Profiler  Table Import/Export for security 

@GPUG Administrative Access  POWERUSER Role – Programmatic role – Try to limit access by creating your own admin role  ‘sa’ and DYNSA – ‘sa’ no longer required for GP admin activities  Sqladmin role – Assign to GP user to elevate SQL privileges – User provisioning, maintenance, and company creation

@GPUG Segregation of Duties  No standard functionality  Build a rule set for your risk profile  Balance preventative with productivity  SQL queries to pull critical access

@GPUG Audit Trails  No standard functionality  Activity Tracking – Log in log/out tracking – Successful attempts to open a window – DYNAMICS..SY05000 – 3rd party Audit Trail solutions – Build your own audit trail

@GPUG Workflow  New to GP 2015 Workflow now inside GP  Requires Sharepoint services GP 2012 and prior  Standard templates available (POs, batch approval, etc.)  Custom workflow possibility

@GPUG Workflow

@GPUG Surviving the Audit  Be proactive – Define corporate risk  Design reports and reviews – Periodic and consistent  Provide evidence  Who has access?  What did they do with that access?

@GPUG  Questions?

Liz Piteo Best Practices for setting up Audit Trails in Dynamics GP

@GPUG Agenda  How to determine what to audit  Organization’s risk profile/high risk areas  Setting up audit trails  Pitfalls and practices to avoid  What do you do with the audit data after you collect it

@GPUG Determining what to audit  Organizational risk  Segregation of duties  Outside controls  High $ impact  Audit requirements

@GPUG Risk profile  Where are your high risk areas?  Do you have adequate segregation of duties around those risk areas?  What types of risk do you have  Can you qualify and quantify these risks?  Identify probability and impact of risks

@GPUG Audit Trail Best Practices  Base your audits on your risk profile  Find the right balance  Use your reports to filter out information  Start small  Put the ownership of the product/reports into the hands of the BPOs  Review, review, review!!!

@GPUG Pitfalls!!  “I want to audit EVERYTHING”  Using audit trail reports as a substitute for operational/financial reports  Inefficient audit reports  500 vs 1,000,000

@GPUG What do you do with the data after it’s collected?  Review, review, review!  Who owns the data?  Are the reviews being done in a timely fashion?  Visibility to the who, what, where, when and how