Binu Anna Eapen

Mansi, I like the point about setting the tone in an organization. The tone has to be set by the senior management and should be reflected through out the organization. Tone can be analyzed in 3 different ways: 1. internal controls 2. ethical values 3. culture and behavior. Setting the tone has a great impact in the overall organization and…[Read more]

Well said Abhay. GRC helps to control the risks to a great extend. Nice point about the Fraud management. Fraud has become a global concern for all the companies. SAP provides SAP Fraud Management which helps companies analyze and manage information that pertains to fraud risk. This capability gives management the ability to quickly identify and…[Read more]

Great points Priya. One of the common concern that any organization has is that the cost of ensuring that their systems are compliant with internal as well as external requirements especially as companies expand and change their IT landscape through acquisition and divestment. The compliance of the new systems with the existing requirement can be…[Read more]

I agree with Sean. Integrity is a quality that should be in an auditor. An auditor should not be biased and be truthful to both to the organization and client. .Two qualities I would like to add here are assertiveness and being independent.

An auditor should be assertive as he/she must be able to establish confidence with the auditee and…[Read more]

1. How much of automated controls should be desired? Is it beneficial to consider controls at the initial design phase or controls are introduced as and when needs arise?
Ans: Automated system control provide strong internal control environment as it increases the efficiency of the operations improving accuracy and thus reducing the fraud/human…[Read more]

I agree with you Vu Do. Security is one of the biggest concern for any growing/ established organization. ERP today has undergone transformation which makes it highly integrated, more intelligent, more collaborative, web-enabled and even wireless or cloud based too. The ERP system is hence becoming highly vulnerable and needs to maintain high…[Read more]

Well wriiten Deepali.. While the miscalculating compliance cost can be one of the reason why the compliance costs more than anticipated I believe mostly small scaled business tend to overlook compliance as it sometimes can be too costly for them. It may not be required for them by the law sometimes but it is always recommended. If there are any…[Read more]

Great points Daniel. I agree that employee training and patch updating regularly are very important and needs to be done to ensure security. But I am not sure if I would want SAP provider to have access control rights for role delegation and granting permission. This would mean giving control to an external organization. I would want internal team…[Read more]

I agree with you Daniel about any ERP system should be customer oriented and should have flexibility in terms of customer being able to customize the product as per the customer need. Flexibility and adaptability are two important factors the ERP system market should keep in mind.as companies grow and are prone to new changes, The ERP system be…[Read more]

2. The ERP systems market is very competitive. What should SAP and other ERP systems providers be focusing on to make their systems more competitive in the future?
ERP system should be chosen based on specific industry’s need. An efficient, integrated system is important for the company so that communication is efficient and error/fraud c…[Read more]

Well written Yu Ming. I agree with you completely and I also like the fact that you specified about the functions of IT Auditor. It is important that IT auditors are not influenced or influence other functions. The same way even IT Auditor also should not be given right to make any changes in production, development or quality assurance. Their…[Read more]

Nice example Daniel. In order to legally operate, businesses must comply with certain requirements regarding the company’s transactions, labor practices and safety procedures. Before launching any business, the appropriate regulations for that industry must be studied and ensure to keep log of any costs and dates related to their compliance. I b…[Read more]

I agree with you that internal auditor must have an unbiased judgement while auditing any business functions an auditor should not share or reveal the data to anyone. I would rather say that independence needs to be maintained by not having to return favors to the team for any reason. The work has to kept professional and independent to correctly…[Read more]

Nice point on risk assessment. The concept of risk is understood in terms of the probability and magnitude of impact it can have on the business. Controls are placed to mitigate or transfer or accept the risks based on the decision made by the organization based on the cost involved to mitigate it. And placing these controls mean that each…[Read more]

2. How is independence maintained when working for the company as an internal auditor?

An internal auditor should establish independence by dual reporting relationship: one with the management (senior most executive/CEO) for assistance in establishing direction, support and administrative interface for the day to day administrative purposes and…[Read more]

4. In future weeks we may have the privilege of having real world auditors join us for our discussions. What questions would you like to ask the Auditors to answer for us?
1. What are the biggest challenges you have faced as an auditor?
2. What is the best way to confront a party or management who you think will not reciprocate well to…[Read more]

I agree Daniel. Even in bigger organizations blueprint is necessary for most processes. For example a blueprint of the network topology of an organization will give the picture for an administrator/auditor or anyone working on the site to fully understand and take necessary action based on the need. In-case the employee or the network admin leaves…[Read more]