CFIT Presentation Presented By: Sumit Nijhawan snijhawan@infogix.com 2008-09-25 Automated Information Controls Prepared for: Committee on Finance and Information Technology (CFIT) Presented By: Sumit Nijhawan snijhawan@infogix.com © 2008 Infogix, Inc.

What is a Top Concern for Financial Executives? CFIT Presentation 2008-09-25 What is a Top Concern for Financial Executives? Integrity of Information Analytical Information Access Rising IT Costs High/Rising SOX Compliance Costs 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Top Concerns for Financial Executives CFIT Presentation 2008-09-25 Top Concerns for Financial Executives Integrity of Information Analytical Information Access Rising IT Costs High/Rising SOX Compliance Costs Source: Technology Issues for Financial Executives 2008 Annual Survey Report 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Infogix Eliminates Information Errors CFIT Presentation 2008-09-25 Infogix Eliminates Information Errors Information errors is a pervasive and universal phenomenon especially in financial processes. Cost and impact of information errors can be small or catastrophic. Infogix is the company that has the expertise and technology to solve this problem. 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Integrated Application CFIT Presentation 2008-09-25 © 2008 Infogix, Inc. 5 2008-09-25 Managing Errors and Complexity Integrated Application No Controls Manual Controls Spreadsheets Programming Logic 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Infogix helps you eliminate information errors with CFIT Presentation 2008-09-25 What We Do Infogix helps you eliminate information errors with independent, automated, and continuous Infogix Controls™. 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Benefits of Infogix Controls CFIT Presentation 2008-09-25 Benefits of Infogix Controls Reduce Costs Eliminate duplicate payments Eliminate SLA penalties Eliminate billing errors Reduce Risk Protect company brand Avoid litigation Avoid catastrophic errors Streamline Compliance Eliminate reporting errors Reduce audit time and costs Increase controls effectiveness Improve Processes Eliminate manual controls Eliminate rework, re-runs Standardize controls Infogix Controls help you increase profits. Every dollar of cost that Infogix Controls helps you avoid improves your bottom line. The cost savings come from elimination of manual information validation activities. Manual controls that are automate free up the manual resources. Reallocate to other opportunities / projects. When errors happen, they cost money and time to deal with. Rework, re-runs (of statements, invoices, GL, 1099s, W2s, reports, etc.) IT and business fire drills distract people from pursuing business objectives and goals. Eliminate the errors and get things done right the first time and save money and time. Eliminate the cost of duplicate payments, recovery fees, etc. Meet the SLAs that you have agreed to and avoid refunds and penalties. Eliminate billing errors and the costs associated with them. Bill for all of the services that you are providing. Infogix Controls provide more effective regulatory compliance while driving down audit costs. When independent automated controls are validating 100% of your transactions as they happen instead of people manually validating sample sets of transactions quite some time after they’ve happened, you get more effective compliance. Since the controls provide a fully verifiable audit trail of execution results, you can prove compliance and streamline audits. Further, you can implement Infogix Controls to eliminate errors in compliance related reportings. Infogix Controls also help you reduce risks. By detecting and eliminating errors as early in the process as possible, you get early notice of error detection and the ability to correct errors before they propagate downstream and do damage. Protect your companies brand from the risks of systemic errors. Avoid the costs of litigation from catastrophic errors. Infogix Controls improve processes. Simplify and speed processes by automating manual steps and manual validations. Standardize controls across the enterprise, throughout all of your business processes. Infogix Controls increase profits by reducing costs, ensuring regulatory compliance, reducing risks, and improving processes. Infogix Controls increase profits. 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Infogix Controls Can Be Used Throughout Your Enterprise CFIT Presentation 2008-09-25 Infogix Controls Can Be Used Throughout Your Enterprise General Ledger Statutory Reporting SOX and Other Compliance Efforts Electronic Payments Accounts Payable Accounts Receivable Data Warehouse/BI/CPM Statement Generation Claims Processing Inventory Replenishment Billing Payroll Expense Management Commissions Infogix Controls improve information intensive processes. 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

The Infogix Difference CFIT Presentation 2008-09-25 The Infogix Difference Automated Validate all transactions instead of manual sampling Independent Validate processes/information independent of controlled systems Continuous Continuously available controls execute as often as needed Verifiable Audit trail of control results ensures compliance and speeds audits Standardized Standardize controls throughout the enterprise Rule-based Implement and maintain controls without software developers Non-intrusive Capture controlled information in existing formats and locations End-to-End Validate information between applications across the enterprise Automated – once implemented, does the solution automatically check all instances of controlled information/transactions? Independent – does the implementation of the control system operate independent of the system being controlled? (algorithms, platforms, design, etc) ? Continuous – does the implemented control system operate continuously (24.7.365)? Or must it run at distinct time points either due to its limited architecture or range or applicability? Verifiable – does the control system produce a set of industry recognizable control and user reports that enable electronically verifiable auditing of control results for all testable information/transactions? Standardized – can the controls solution be implemented in other processes, systems, departments, throughout the enterprise in a consistent manner thereby driving down costs of ownership and expansion? Rule-based – does the implemented control system consist of a set of control-specific rules that can be readily interpreted by business analysts? Non-intrusive – does the implementation of the control system require changes in the system being controlled? Or are source code and/or database changes required? End-to-end – can the control system test all of the elements of the content, process, and system without authoring additional source code or incurring additional information risk? --- Additionally… Data-driven – can control rules be easily authored to consider prior data history without authoring additional computer programs/source code or altering databases? Tech-agnostic – can the control system reach all applicable computing platforms without authoring additional source code or incurring additional information risk? App-agnostic – can the control system reach all applicable applications (both COTS and in-house) without authoring additional source code or incurring additional information risk? 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Gartner Report Cool Vendors, 2008: Innovations from Around the World CFIT Presentation 2008-09-25 Gartner Report Cool Vendors, 2008: Innovations from Around the World Infogix is “cool” because our solution “focuses primarily on data in flight” “can be implemented in an unobtrusive manner without changes to existing applications and databases” “enables auditing of data consistency in an independent manner” 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

How do Infogix Controls Work? CFIT Presentation 2008-09-25 How do Infogix Controls Work? © 2008 Infogix, Inc.

Business processes are complex. CFIT Presentation 2008-09-25 Business processes are complex. © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 The potential for information errors exists throughout the business process. © 2008 Infogix, Inc.

Infogix Controls monitor, detect, and prevent information errors. CFIT Presentation 2008-09-25 Infogix Controls monitor, detect, and prevent information errors. © 2008 Infogix, Inc.

Infogix Controls are deployed as control points. CFIT Presentation 2008-09-25 Infogix Controls are deployed as control points. Process A Process B Process C Discuss about different applications for step 1 and step 2 and step 3 Control Point 1 Control Point 2 © 2008 Infogix, Inc.

At each control point, the Infogix Control: CFIT Presentation 2008-09-25 At each control point, the Infogix Control: captures information, compares the information, controls the process, and communicates the control results. Control Point Discuss about different applications for step 1 and step 2 and step 3 Process Process © 2008 Infogix, Inc.

There are four steps to setting up an Infogix Control. CFIT Presentation 2008-09-25 There are four steps to setting up an Infogix Control. © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 1 First, you define the layout of the information to be captured at the control point. To do that, you specify the format of the source information, how it will be accessed, and where it is located. © 2008 Infogix, Inc.

Infogix Controls can capture data from a wide variety of sources. CFIT Presentation 2008-09-25 Infogix Controls can capture data from a wide variety of sources. financial and operational reports application files and proprietary formats databases XML Spreadsheets EDI web Steve – we need better icons for the ones that say “1.2.3” which will confuse finance audiences into thinking “Lotus 123” which they no longer use. I have some ideas. The XML icon needs to be less fuzzy. Create an EDI one that looks like the XML one, but vary the orange color. Create one for the web as well…. use the internet explorer icon for this one. © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 You specify the fields of information from your sources that the Infogix Control will capture. Layout Fields Layout © 2008 Infogix, Inc.

Infogix Controls may capture information from multiple sources. CFIT Presentation 2008-09-25 Infogix Controls may capture information from multiple sources. Layout Fields Layout © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 The layout definition also specifies the control fields into which the source information is captured. Layout Fields Control Fields © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 2 Second, you define the comparison rules the Infogix Control will use to compare the control fields. The rules can be simple or complex. © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 3 Third, you define control actions to be performed based on the result of the comparisons. Stop further processing of this transaction. Execute reconciliation controls. Record audit trail into control report. For example, you might want to halt further processing or to execute other Infogix Controls. © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 4 Finally, you define what and how you want to communicate about the results of the execution of the Infogix Control. For example, you may want to send alerts to specific people via pager, email, exception report, Infogix Inbox, etc. © 2008 Infogix, Inc.

Let’s Look at Examples. CFIT Presentation 2008-09-25 © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 Infogix Controls can automate, simplify and streamline daily or month-end financial accounting practices. Let’s look at a simplified General Ledger Application example. © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 On a daily basis, all Branch Teller Journal activity is received and tabulated based on Branch location in different regions of the country. On that same day, internal applications augment and centralize the information into Sub Ledgers prior to updating the General Ledger © 2008 Infogix, Inc.

CFIT Presentation 2008-09-25 Infogix Controls can automatically verify that transactions in the Teller Journal application are received and processed by the Sub Ledger and accurately posted to the General Ledger before any month-end information is generated. Teller Journal Sub Ledger General Ledger © 2008 Infogix, Inc.

Teller Journal Activity CFIT Presentation 2008-09-25 Teller Journal Activity Excel or XML File Layout Layout Fields © 2008 Infogix, Inc.

Sub Ledger Process Sub Ledger Transaction Capture Layout Fields CFIT Presentation 2008-09-25 Sub Ledger Process Sub Ledger Transaction Capture Layout Fields Sub Ledger Summary Capture Layout Fields © 2008 Infogix, Inc.

General Ledger Activity CFIT Presentation 2008-09-25 General Ledger Activity Excel or Database Layout Layout Fields © 2008 Infogix, Inc.

Teller Activity Posting Process Control CFIT Presentation 2008-09-25 Teller Activity Posting Process Control Results Teller Activity Detail Control Point 1 Sub Ledger Detail & Summary Control Point 2 Control Point 3 General Ledger Summary Postings © 2008 Infogix, Inc.

What about more complex processes….. CFIT Presentation 2008-09-25 What about more complex processes….. © 2008 Infogix, Inc.

General Ledger Controls CFIT Presentation 2008-09-25 © 2008 Infogix, Inc. 35 2008-09-25 General Ledger Controls Source Systems Sub Ledgers General Ledger Trial Balance LOB 1 Corporate GL Source Systems Sub Ledgers LOB 2 General Ledger Trial Balance Infogix Controls Balance Corporate General Ledger Reconcile all GL Accounts to Activity Within Accounts Reconcile General Ledger to Sub Ledgers Reconcile Trial Balance to GL Manage all Outstanding Inventory Items Manage Production of Posting Entries 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Loan Processing Controls CFIT Presentation 2008-09-25 © 2008 Infogix, Inc. 36 2008-09-25 Loan Processing Controls Vendor Charges Payments and Refunds Origination General Ledger Calculated Balance Loan Data Reference Sources Fee Tables Credit Cards Mortgage Processing Infogix Controls Validate Payments and Refunds Validate Vendor Charges Reconcile GL Posting of Loans Validate loans Reconcile Fees to Reference Sources 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Inventory Controls Receiving Inventory MRP Distribution Accounts CFIT Presentation 2008-09-25 © 2008 Infogix, Inc. 37 2008-09-25 Inventory Controls Receiving Inventory MRP Distribution Accounts Payable Cost Accounting Billing General Ledger Infogix Controls Account for all units from receiving to distribution Account for all costs posted to financial systems 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Complex Processes CFIT Presentation 2008-09-25 © 2008 Infogix, Inc.

Infogix Controls Platform CFIT Presentation 2008-09-25 Infogix Controls Platform Infogix Controls are Independent Automated Information Controls that are deployed to continuously verify, balance, reconcile, and monitor information flowing through a business process, application, or exchange. They can compare information against other diverse information sources or against prior recorded information. Control results can be used to generate alerts, halt erroneous transaction flows or error propagation, and generate reports. What Does an Infogix Control Do? An Infogix Control is always working to ensure that your information and the processes and systems that handle it are functioning as designed. Capture - Intercept or extract data from relevant sources: files, databases, reports, spreadsheets, messages, transactions, etc. Compare - Apply your user-defined business rules to detect information or process errors. Control - Interrupt or alter processes before incorrect information propagates further. Communicate - Provide alerts, notifications, reports and audit trails. ----- The Infogix Controls Platform is a comprehensive portfolio of automated information controls capabilities, including capabilities for information validation, exception management and a dashboard to view enterprise-wide controls deployment, operation and results. The information validation capabilities are: Verify: Validation of information content and format, detection of duplicates, validation of external files and checking of cross-references. Examples: Avoid duplicate entries into a system such as an inventory or claims system. Balance: Validation that the summary-level totals from two or more sources match either exactly or within a tolerance. The sources of information may be reports, files, databases, applications or processing runs including daily, weekly, monthly etc. Examples: Feeds to a GL system from various accounting applications or payroll. Reconcile: Matching and validation of detail-level information from multiple sources. Examples: Validating information in a data warehouse that was fed by multiple systems. Track: Validation of process integrity indicators such as process sequence, process delay, transaction path and transaction arrival time. Examples: Track a payment throughout the payment process The Exception Management capability includes the ability to route errors and exceptions from any of the validations to appropriate research and resolution functions and to track and report the status and disposition of those exceptions. The Controls Monitoring capability includes the ability to view the definition, status, results and history of all controls, by appropriately authorized personnel. Easy and Non-intrusive implementation leads to business benefits in several weeks. 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Infogix Eliminates Information Errors CFIT Presentation 2008-09-25 Infogix Eliminates Information Errors Information errors is a pervasive and universal phenomenon especially in financial processes. Cost and impact of information errors can be small or catastrophic. Infogix is the company that has the expertise and technology to solve this problem. 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

The Infogix Difference CFIT Presentation 2008-09-25 The Infogix Difference Automated Validate all transactions instead of manual sampling Independent Validate processes/information independent of controlled systems Continuous Continuously available controls execute as often as needed Verifiable Audit trail of control results ensures compliance and speeds audits Standardized Standardize controls throughout the enterprise Rule-based Implement and maintain controls without software developers Non-intrusive Capture controlled information in existing formats and locations End-to-End Validate information between applications across the enterprise Automated – once implemented, does the solution automatically check all instances of controlled information/transactions? Independent – does the implementation of the control system operate independent of the system being controlled? (algorithms, platforms, design, etc) ? Continuous – does the implemented control system operate continuously (24.7.365)? Or must it run at distinct time points either due to its limited architecture or range or applicability? Verifiable – does the control system produce a set of industry recognizable control and user reports that enable electronically verifiable auditing of control results for all testable information/transactions? Standardized – can the controls solution be implemented in other processes, systems, departments, throughout the enterprise in a consistent manner thereby driving down costs of ownership and expansion? Rule-based – does the implemented control system consist of a set of control-specific rules that can be readily interpreted by business analysts? Non-intrusive – does the implementation of the control system require changes in the system being controlled? Or are source code and/or database changes required? End-to-end – can the control system test all of the elements of the content, process, and system without authoring additional source code or incurring additional information risk? --- Additionally… Data-driven – can control rules be easily authored to consider prior data history without authoring additional computer programs/source code or altering databases? Tech-agnostic – can the control system reach all applicable computing platforms without authoring additional source code or incurring additional information risk? App-agnostic – can the control system reach all applicable applications (both COTS and in-house) without authoring additional source code or incurring additional information risk? 2008-09-25 © 2008 Infogix, Inc. © 2008 Infogix, Inc.

Discussion CFIT Presentation 2008-09-25 © 2008 Infogix, Inc. 42 2008-09-25 Discussion 2008-09-25 © 2008 Infogix, Inc. Infogix, the Infogix checkmark logo, Information With Confidence and Information Integrity are registered trademarks of Infogix, Inc. Other designated phrases and product names used here are the property of their respective owners. For a list of Infogix trademarks, visit www.infogix.com/legal © 2008 Infogix, Inc.