CSAE 3416 Views from a Service Provider FMI PD Day – May 19, 2016 Tricia Goulbourne

Who are we? Central Agency Cluster Shared Systems (CAC-SS) CAC-SS provides maintenance development and support, including help desk and training services for SAP and Cognos BI software for 9 organizations and 11 company codes Corporate Financial Systems Team Projects, Operations and Maintenance division which is responsible for the functional capabilities of the system, including maintenance and development activities. Client Relationship Management division which is responsible for all areas that deal with end-user directly, including training, Help Desk, user documentation and end user communications Technical Support – BASIS and BI Admin

The Road to 3416 Internal & External Audits Cluster members rely on Service provider to meet TB Policy on Internal Control (ITGC) over SAP system Cluster members rely on Service provider to provide assurances on controls over SAP system to OAG & other external providers Audited Financial Statements Some Cluster members have audited financial statements – additional rigor may be required to provided assurance Challenge & Decision Several different auditing bodies here all year around for various purposes CSAE 3416 – most stringent and meets the needs of everyone

Keys to Success: First year - CSAE 3416 Recognizing initial effort Dedicated Resources Flexibility & Collaboration First year is most complex; itemizing controls, developing system schematics. Require dedicated and knowledgeable resources to work with auditors, develop controls, answer questions & provide documentation Focus on being flexible and working with others to establish scope and create robust controls. Goal: To obtain assertion on the suitability of the design and effectiveness of the controls to achieve the stated objectives

Questions