1. Siemens Phase II: Using the IT Audit as a Springboard for Continuous Controls Monitoring Ryan Teeter, Ph.D. Student, Rutgers University Rod Brennan, Director of IT Audit, Siemens Corporation

2. Implementation of CCM at Siemens PLM Rules were created in Approva BizRights based on ~300 audit action sheets provided by Siemens Siemens Corporation wants universally-adaptable sets of rules and control tests for use in different divisions

3. Successes Initially approximately 63% of controls automated Rules were used to provide support for the IT audit Initial evaluation of cost savings (A&D PL specific) 1 : o For 3 of every 4 years, eliminate ~ 500 man-hours of IT GCC and application control testing (@ $137/hr = $68,750/year) o With system certified, 80% reduction in 500 man-hours of annual external IT audit hours (@ ~$200/hr, $80,000/year) 1 Siemens IT audit pool billing rate is $137/hour; Approx $200/hr Big 4 blended rate.

4. Successes ModuleTotal Controls Authoriza tions Controls Percent Automated (%) Business Process Controls Percent Automated (%) Overall Percent Automated (%) Basis System (BC)10420100%8444%55% Financial Accounting (FI)558100%4751%58% Asset Accounting (AA)264100%2264%69% Sales and Distribution (SD)215100%1650%62% Materials Management (MM)328100%2454%66% Project System (PS)329100%2370%78% Human Resources (HR)14 100%N/A 100% Total28468100%21652%63%

5. Challenges Audit priority o Non-applicable rules ignored because of time constraints CCM platform issues o Bugs or unimplemented features o Identified when comparing automated with manual results o Vendor vs. auditor priorities o Issues addressed in future releases Properly functioning controls o Control failure resulted in lack of support for the audit

6. Conclusion The IT audit is a feasible starting point for CCM implementation o Existing audit plan o Knowledge of experienced auditors o Real-time performance comparison 63% of audit controls automated o 100% of authorizations, which comprise 30-35% of audit commitment o vs. 75% proposed by Alles et al. (2007)