Abhay V Kshirsagar

Good post, Blake. I was surprised with the high percentage of the insider mistakes as well. That reminded me of a project I did in my undergraduate class, where the breached happened only because of an insider not doing their job properly. I am sure we all have heard about the Target’s data breach. Target wasn’t breached because it didn’t invest…[Read more]

Good post, David.

I, myself, have been targeted once back in my undergraduate years. I am an international student and I received a call from a fraudster claiming that he was calling from USCIS. He said that I was going to get deported since I had failed to pay some immigration fees that is to be paid by international students for their SEVIS…[Read more]

Interesting post, Priya.

It made me to think that if 26% reported that the similar attacks were taken place on the same assets that sort of says that either the person who is accountable is just not doing their job efficiently and lack of ability to put in security control points towards their lack of ability as well. It’s interesting that one…[Read more]

A person’s character is very crucial in the audit industry. How would you build your reputation and maintain a good ethical character in this industry?

The corporate scandals have damaged people’s confidence and credibility, which resulted into massive criticism towards corporations. So, building reputation and credibility is certainly a c…[Read more]

In the Real World Control Failures, we’ve reviewed, describe the character of the leaders involved. Is it a root of the control failures?

In real world control failures, we saw the example of Ramalinga Raju in Satyam case. He committed fraud by creating fictitious transactions in order to assert that the company’s balance sheet was strong. I t…[Read more]

Good post, Priya.

I would like to add another module to the list, the security module. The top issue that organizations see is reactionary to audit findings. A lot of times the issue is about excessive access users have, ability for users to perform multiple functions in a system that organizations want to further restrict. Also, auditors want…[Read more]

Interesting points. I think the fundamental idea of machines replacing human work force is based on the idea that machines can do it better and cheaper. Just a general observation, a simple job of picking fruits is still not replaced (at least from what I have seen) the machines are still having a hard time to visually locate the fruits and then…[Read more]

SAP’s GRC module may be important and effective, but can the cost of GRC be justified? Explain

SAP GRC, although expensive is crucial to navigate different risks and manage controls, compliance with governance, risk and compliance solutions.

The cost is justified as it will help organizations integrate and automate important GRC a…[Read more]

Dan,

Good point. Also, another reason for ensuring that the compliance regulated by the government is satisfied is the fact that now-a-days companies are doing businesses with other companies by factoring in this exact point. For instance, if I am a communication company like T-Mobile, I would certainly want the company that does credit check…[Read more]

Yu Ming,

Great point about mobile devices. In this mobile-first world, it will be very important for ERP vendors to understand the customer’s pain points. Gartner says that 70% customers will interact with their enterprises through mobile devices. So, for being a successful vendor it is also crucial to predict the customer’s needs in time and…[Read more]

When is the cost of implementing a compliance control higher than the benefit obtained? What should an organization do to ensure efficiency and profitability?

The controls are in place to ensure that an organization is following safer ways to conduct business so that its stakeholders aren’t harmed in any way. Eg: There aren’t any breaches, fra…[Read more]

The ERP systems market is very competitive. What should SAP and other ERP systems providers be focusing on to make their systems more competitive in the future?

From my own experience, two things, if changed can change the game for ERP vendors is the user interface design and the customization depth. First, I have often heard people…[Read more]

SAP is a world class ERP system provider. If you are an SAP customer – what would you expect them to provide to support your company’s internal controls?

Now-a-days regulatory pressures for different businesses are increasing and the cost of compliance are rising and data is expanding in volume. In this time, as a SAP consumer, I will alw…[Read more]

Good Point. I think understanding different key business process of a company in a short period of time is challenging and in addition, if the documentation that is needed for the audit isn’t properly dated then it can be a nightmare for the audit team during the evidence gathering stage.

Good post, Yu Ming.

I think with the points you made, it is also important that the internal auditor doesn’t have any personal involvement with the client personnel for the audit area. This can certainly influence the audit process as conflicts of interest can arise. The auditor may be tempted to ignore or be lenient about negative audit…[Read more]

When is the cost of implementing a compliance control higher then the benefit obtained? What should an organization do to ensure efficiency and profitability?

The controls are in place to ensure that an organization is following safer ways to conduct business so that its stakeholders aren’t harmed in any way. Eg: There aren’t any breaches,…[Read more]

From a different perspective, It is also important for the audit committee to ensure that they are doing a good job to receive unbiased view from their internal auditors. At the end of each audit committee meeting, there is always a session between internal audit committee and head of internal audit to have a very candid conversations of things…[Read more]

How is independence maintained when working for the company as an internal auditor?

The internal audit function itself should be independent all the times. It has to be independent of the management team because they are really working for the audit committee. It’s also a difficult relationship sometimes, when you are on the pay roll of the…[Read more]

Just to add more about security evaluation. There should be an evaluation to determine who is authorized to do what. For example, as develop changes, approve testing of changes and authorize a particular change into production or even have employees having access to systems to make chances.

And of course, all this should be compared with the…[Read more]