1. Presented by: Michele Foster
Surviving an Ax audit
Presented by: Michele Foster

2. Brief INTRO Michele Foster, G&A Applications Manager, IT
AX System Administrator
AXUG Board of Advisors member
External / Internal audit POC for 8 years (2 companies)
Audited by 2 of the big 4 audit firms
Depomed, Inc. – Specialty Pharma co
Highly Regulated
Publicly Traded
AX 2012, R2 platform

3. Discussion Disclaimer
Comments are based on annual SOX audit for Depomed
Your Company’s audit varies by:
External auditing team used
Business complexity and identified control matrix
Audit observations cover Depomed experiences with: IT
Finance

4. Recent changes in audit world
Recent increases in:
PCAOB requirements
Auditor’s understanding of AX
Audit requirements
New expectations around:
Documentation
User understanding
System changes
PCAOB = Public Company Accounting Oversight Board (the auditor’s auditor)

5. Ways DEPOMED ensures a successful audit (IT)
Providing complete code change list w/ approvals
Providing user access change list w/ approvals
Having clearly-defined change management policies
Performing periodic, signed review of application controls and changes
Having thorough understanding of AX functionality
Providing answers only to questions asked (no filler comments)
Periodicity of review depends on risk determined by company size, complexity, turnover, etc.

6. IT – Side of audit

7. Ways Depomed ensures a successful audit (finance)
Prep for walkthroughs prior to audit visit
Performance of periodic, signed access reviews to in-scope applications
Reviews of control narratives
Do the controls reflect business reality?
Are there any known control failures?
Providing documented validation of Key Control reports
Demonstrating thorough understanding of AX transactions
Providing answers only to questions asked
Walkthrough prep by employees with key responsibilities
Periodicity of reviews again depends on growth of company, number of users with high-risk access (Finance)

8. Complete code change list options
System-Driven list
Database Trace Log
Element Log or other exportable log
Project List (AOT)
Change Control Log (external to system)
Other ticketing system change list
Show Database Trace Log & Project List

9. User access controls System-driven list of changes Change approvals
Audit bolt-on used by Depomed
Change approvals
SOD Rules
Workflows for high-risk transactions
Security Groups to restrict approvals
Show sample change document
Database trace log (DAT) Company
ASM tool report
SOD Table

10. Clearly-defined change policies (IT)
Periodic change policy review
Consistent change documentation
Signatures / Dates consistent with changes
Proof of Testing (QA and UAT where required)
Show Sample change request template

11. Periodic review of application controls (IT)
Controls are
Different for each business
Defined by business
Controls (systematic or manual) ensure low-risk system use
Manual controls = very curious auditors
System controls = happy auditors
Show system controls

12. Finance – Side of audit

13. Key reports testing (Finance)
High-level and/or detailed snapshots of business operations
Used as a basis for management decisions
AX Key Report types
Canned / Standard (audited every 3 years)
Custom (audited annually)
Extracted spreadsheets (audited annually)
Testing must prove
Accuracy against system data
Completeness against system data
That changes to report are validated and approved
Show sample of custom report
Show change date in AOT that is reviewed by auditors

14. User (POC) system understanding (It & finance)
Walk-through contacts
Describe business process and related controls in AX
Walk through any major changes to system code, reports or configuration
Provide documentation
Transaction testing users (Finance)
Describe their function and use of AX
Perform observed transactional tests
Application testing users (IT)
Describe changes to the application
Perform observed application tests
Given example of when user understanding went wrong
Show typical application control test
Show typical transactional test

15. QUESTIONS?

16. Contact info
Michele Foster