Leverage InformationTechnology: Turn Risk into Reward ™ Copyright ©. Fulcrum Information Technology, Inc. Top Five Reasons for Automating Application Controls Application Controls Monitoring Best Practices Adil Khan, Sr. Client Director Fulcrum Information Technology, Inc.

Top 5 Reasons for Automating Application Controls Introduction IT Governance Risk and Compliance Needs Fulcrum-IIA Controls Survey IT Controls Framework Application Controls Overview Auditing Challenges Automation Approach Access Controls Automation Example Case Studies Top Five Reasons AGENDA

About Fulcrum We are a Leading provider of Governance, Risk and Compliance solutions for enterprise customers. Our solutions focus on: Enterprise Application Controls Monitoring GRC Process Management GRC Intelligence FulcrumWare GRC Tools include Content and On-line services to rapidly reduce risks such as Segregation of Duty violations in Enterprise Systems such as Oracle E-business Suite, PeopleSoft, JD Edwards, SAP and other Legacy Apps FulcrumWay Professionals are leading experts with real world experience in Internal Audit, Enterprise Systems and GRC Process Management. FulcrumPoint Insight provides the latest trends, best practices and thought leadership through regional and national conferences held by OAUG, IIA, ISACA Privately Held Delaware corporation with US presence in: New York, Texas and California International Presence in UK and India

Fulcrum Credentials Media and Entertainment Financial Services Healthcare Natural Resources Life Sciences Industrial Manufacturing Defense/ Aerospace Retail Construction High Technology Readers Digest Retail Food

FulcrumPoint Insight Thought Leadership - Events Compliance Week Magazine - Healthcare Firm Aligns Compliance Efforts, Cuts Costs Economist Magazine –Compliance Guide for Enterprise Systems POD Cast – How Automating the Enterprise Risk Management Process helps organizations comply with regulations OAUG - Impact of AS5 for Oracle Enterprise Customers IIA – Top Five Reasons for Automating Application Controls Oracle Open World – Annual GRC Dinner, GE and Birds Eye Case Study Web casts – GRC Best Practices, Trends and Expert Insight.

IT Governance, Risk and Compliance Needs Common Compliance Needs Mandate Processes and Risk Management Enterprise Content Management Security and Identity Management Learning Management Cross Industry Sarbanes-Oxley Act XXXX HIPAAXXX California Senate Bill 1386 XXX International Accounting Standards XX EU Data Privacy Directive XXX Federal Sentencing Guidelines X Industry-Specific Basel II XXXX Gramm-Leach Bliley XXX Payment Card Industry Data Security XXXX FDA 21 CFR Part 11 XXX Freedom of Information Act XX USA PATRIOT Act XXX Multiple Compliance Needs

Demographics Fulcrum Survey

Results – Financial Reporting Process Fulcrum Survey

Results – Internal Controls Fulcrum Survey

IT Controls Framework IT organizations should consider the nature and extent of their operations in determining which, if not all, of the following control objectives need to be included in internal control program: PLAN AND ORGANIZE ACQUIRE AND IMPLEMENT DELIVER AND SUPPORT MONITOR AND EVALUATE IT Controls

What are Application Controls? Application controls apply to the business processes they support. These controls are designed within the application to prevent or detect unauthorized transactions. When combined with manual controls, as necessary, application controls ensure completeness, accuracy, authorization and validity of processing transactions Control objectives can be supported with automated application controls. They are most effective in integrated ERP environments, such as SAP, PeopleSoft, Oracle, JD Edwards and others. Examples:  Orders are processed only within approved customer credit limits.  Orders are approved by management as to prices and terms of sale.  Purchase orders are placed only for approved requisitions.  Purchase orders are accurately entered.  All purchase orders issued are input and processed.  All recorded production costs are consistent with actual direct and indirect expenses associated with production.  All direct and indirect expenses associated with production are recorded as production costs. Application Controls Overview

Risk Assessment The IT organization has an entity- and activity-level risk assessment framework, which is used periodically to assess information risk to achieving business objectives. Management’s risk assessment framework focuses on the examination of the essential elements of risk and the cause and effect relationship among them. A risk assessment framework exists and considers the risk assessment probability and likelihood of threats. The IT organization’s risk assessment framework measures the impact of risks according to qualitative and quantitative criteria. The IT organization’s risk assessment framework is designed to support cost-effective controls to mitigate exposure to risks on a continuing basis, including risk avoidance, mitigation or acceptance. A comprehensive security assessment is performed for critical systems and locations based on their relative priority. Application Controls Overview

Control Activities An organization has and does the following : A system development life cycle methodology that considers security, availability and processing integrity requirements of the organization. This ensures that information systems are designed to include application controls that support complete, accurate, authorized and valid transaction processing. An acquisition and planning process that aligns with its overall strategic direction. Acquires software in accordance with its acquisition and planning process. Procedures ensure that system software is installed and maintained in accordance with the organization’s requirements. Procedures ensure that system software changes are controlled in line with the organization’s change management procedures. Ensures that the implementation of system software do not jeopardize the security of the data. Application Controls Overview

Control Monitoring Changes to IT systems and applications are performed and designed to meet the expectations of users. IT management monitors its delivery of services to identify shortfalls and responds with actionable plans to improve. IT management monitors the effectiveness of internal controls Monitoring in the normal course of operations through management and supervisory activities, comparisons and benchmarks. Serious deviations in the operation of internal control, Monitoring including major security, availability and processing integrity events, are reported to senior management. Internal control assessments are performed periodically, using Monitoring self-assessment or independent audit, to examine whether internal controls are operating satisfactorily. Application Controls Overview

Stages of Application Controls Implementation Automation Approach  Define: Define Audit Units, Application Environments, and Controls in-scope for Audit Testing  Detect: Analyze Control Violations based on risk, impact. Eliminate false-positives, exceptions  Remediate: Resolve Control Violations  Prevent: Automated Controls deny unauthorized access, transactions and system changes in real-time  Monitor: Analytics to notify management of all control violations

Establish Rules Repository Detect Violations Analyze Issues Remediate Issues Implement Changes Monitor Application Environment Determine Scope by Application Extract ERP Data Manage Exceptions Setup Preventive Controls Application Control Teams Corporate Access Controls Business Process Teams IT Management Establish Test Environment Application Controls Management Best Practices Automation Approach

Achieving regulatory compliance requires more than IT policies and process documentation Effective application audit planning requires mapping controls over application test environments, audit units and significant business processes based on risk likelihood and impact to thousands of functions and activities accessible through many roles, menus and functions. Detecting users that have unauthorized access to one or more critical business functions such as purchase to pay requires business analytics based on application control rules. Compensating controls are needed for certain users and transactions where business constraints require exceptions. Remediation effort requires strong collaboration among Audit, IT and Business stakeholders to reconfigure security, reassign users, prevent configuration changes, monitor transaction thresholds. ERP Access Provisioning and Configurations must be approved in “real time” to keep up with business needs. Auditing Challenges

Rules Library is the master repository that contains all SOD Rules stored in Access Control

User can create multiple access control tests to detect SOD violations. Violation Results are stored in the database for analysis and change management

Security Managers can assign remediation requests and monitor progress to ensure “Closed-Loop” detection to remediation cycle

Access provision requests is key financial systems can be process quickly while complying with SOD Policies

Analytics to monitor SOD violations and notify management

A. Case Study – Improve User Provisioning Company Overview Wholly owned subsidiary of Fortune 500 focused on communication and information technologies for security, safety and lifestyle enhancements. Operations in more than 30 countries Oracle E Business Suite GRC Challenges/Opportunities Comply with SOX Needed to automate a manual and labor- intensive process to define and approve user access. Segregation of Duties Concerns Oracle E-Business Environment –40 Modules –2500 Users, user responsibilities GRC Solutions Automate User Access Provisioning Compliant with SOD Policies Results Implemented access provisioning solution to identify users violations and allow auditable override capability for authorized access. Security provisioning time reduction Management Commitment to GRC SOD Rules Content jump started the process Detected over 5,000 violations Reduced access provisioning time from 14 days to 4 hours Trained Process Owners through online self-service portal

B. Case Study – Remediate Access Control Deficiency Company Overview Leading manufacturer of electrical and mechanical motion control products Growing Rapidly through acquisitions Manufacturing and service facilities are located worldwide Multiple Enterprise Applications GRC Challenges/Opportunities Remediate Significant Deficiency identified by external Auditor Needed a central system to detect over 5000 user access violations and implement new roles across multiple systems within 90 days Limited IT Audit Resources – One Full Time Equivalent (FTE) GRC Solutions Risk Analytics Service Access Policies Detection and Remediation Service Results Completed First Test in 24 hours No time or resources wasted on additional IT Infrastructure with the On Demand Web Service Setup Compensating Controls for Waived Users Preventive Controls Functions reduced the risk of security violations in real time. Fully Compatible with all Enterprise Systems Access Controls Content helped management define risk likelihood and impact Faster Remediation through Analytical Reports and Filters What-if Analysis Improved Self- Service User Provisioning Process

C. Case Study – Reduce Expense through Configurable Controls Company Overview World’s pre-eminent gold producer, with a portfolio of 27 operating mines Many advanced exploration and development projects located across five continents The largest gold reserves in the industry GRC Challenges/Opportunities Need to reduce SOX Compliance Audit expense Implement continuous controls monitoring Baseline ERP Configurable Controls for AS5 GRC Solutions Identify Controls for full or partial automation. Benchmark ERP Configurations Setup audit logs on all configuration changes. Results Analyzed over 1,000 controls Application Audit Portal provides audit trail on all configuration changes in ERP Systems Track changes to key application setup data and code. Approval workflows and notifications facilitate change management without negatively impacting core business operations. Increase visibility into the actual operations of the controls environment Reduced Testing Time by 30%

Scope application control rules based on IT/Business Risk Likelihood and Impact. Create application test environment based on a central Master Control Content Library. Maintains Change Controls over Test Plans to manage changes in application environments. Top 5 Reasons to Automate Controls Reason #5: Build Effective Test Plan

Top 5 Reasons to Automate Controls Remove false-positives e.g. view-only, hidden or excluded functions. Exclude control violations where business constraints require “waivers”. Track exception justifications and test compensating controls. Analyze direct violations within user/role and indirect violations across multiple roles assigned to user. Reason #4: Detect Control Violations Accurately

Top 5 Reason to Automate Controls Document and assign remediation tasks to Application and Process Owners. Perform “what-if” analysis to identify business impact of control operation. Promote successfully tested application controls to production application environment without error prone manual entries. Reason #3: Faster Remediation Time Reduces Business Risk

Top 5 Reason to Automate Controls Identify Control Violations based on pre-defined IT Policies to prevent Segregation of Duties Violations, Unapproved Configuration Changes and Erroneous Transactions. Improve Application Change Management Process through electronic approval workflow. Restrict Access to Sensitive Data. Reason #2: Achieve Sustainable Compliance with Preventive Monitoring

Reduce Internal and External Application Testing effort by auditing changes to Application Baseline. Improve Detection to Remediation Cycle through electronic workflow management of control violations. Reduce Cost of Compliance by replacing manual detection, remediation and prevention activities with streamlined and automated processes. Reason #1: reduce Auditing Time and Expense Top 5 Reasons to Automate Controls