Deepali Kochhar

Great answer Magaly. Implementing SAP in itself demands a big cost. Looking at that cost, the cost of GRC is worst putting in in order to make sure a good ROI of the SAP tool. It provides good governance, risk and compliance control to monitor the activities and processes happening in SAP. This ensures that system is following compliance and also…[Read more]

Definitely Chen, automated controls helps:

Reducing errors
Reducing time and effort
Centralize the tasks
Helps in creating a sync in the processes
Managing complicated process in an easier way
Save cost

In my point of view controls such as quality assurance review can be manual where the reviewer evaluates the process and related…[Read more]

To add to your point Abhay,

The following character of the leaders were the root cause of most of the Control failure:

Lack of leadership

Improper accounting practice where leaders were involved

GAAP- Matching principle was broken by the leaders

Lack of full disclosure by the leadership

Improper controls and monitoring in…[Read more]

To add to your point Abhay, an auditor should not be biased based on his knowledge to report findings. He should first focus on organization culture, goals and needs to understand their business and based on those facts should report findings which are relevant. In short he should not generalize his technical knowledge to all organizations.

Good point made Vu Du. The leaders generally don’t consider the importance of implementation and maintenance of controls which leads to control failure. Even they don’t focus on providing training to the employees which become one of the main root cause of control failure and the employees are unable to sync themselves with the controls put in…[Read more]

Q.3. A person’s character is very crucial in the audit industry. How would you build your reputation and maintain a good ethical character in this industry?

It is very important to build reputation and maintain a good ethical character in the industry for an auditor. The auditor should have following skills to build a good person c…[Read more]

definitely Alex, spending must go on with the business objective in order to find good return. Spending high if not judged properly will increase the cost to business rather serving to get a good ROI

Great answer Fangzhou. To add to your point, I would also say that the cost to implement a SAP system is often too high for an organization to make a decision on whether to implement SAP or not. So as an SAP customer I would also expect them to provide my business solutions which can be customized and hence fix inside my cost budget.

Definitely Mansi, It is very important to understand the need of the organization before deciding which control to go for in order to derive the best return on investment. Implement unwanted controls will simply increase the cost without adding any value to the business and will rather lead to decrease in profitability.

Paul, you made a good point here. Definitely compliance regulations often don’t target small businesses and this is the reason small businesses cannot effort to implement those. This is one of the reason small business become less competitive against big business.

Sean,

You made a good point but don’t you think standardizing a control in every situation may also lead to increase in cost. Lets say we need a control for a temporary period, in that case spending cost to make it standardize will not serve the purpose. I Believe understanding the business need to implement a control is the most important…[Read more]

When is the cost of implementing a compliance control higher than the benefit obtained? What should an organization do to ensure efficiency and profitability?

The cost of implementing a compliance control may be higher than the benefits in the following case:

• When the Return on investment is miscalculated
• Not monitoring the total cos…[Read more]

Paul, great example. Can you share the difference in approach adopted towards both the audits you have been a part of? Both of them must have had different purpose. Was there a difference in the way of performing both the audits?

Great point Binu. Business goals plays a very important role in defining what findings should be noted and what not keeping the personal bias aside. Therefore the first job of an auditor is to understand the organisation’s culture, business, needs before starting an audit. Just having technical knowledge is not sufficient for an auditor to…[Read more]

Great question Mansi. So there were standard and policies which were defined to be followed for managing the CIA of the crucial data. the audit was based on those standards and policies. Any findings which were not following those standards and policies was questioned to the user and after that based on the reasons provided decision was made on…[Read more]

Another thing I would like to add to this is that auditor should only make recommendations towards the findings. They should not be biased while making any decisions. There personal point of view should not play any role while reporting the findings and it should be only on the basis of what is seen as an evidence. Because every organisation has…[Read more]

Definitely Abhay, I think the first step towards implementing a compliance control is to decide whether to accept, mitigate, avoid or transfer risk.
cost-benefit analysis must be performed to access if compliance control cost is higher then the benefit obtained.
The situation in which the compliance control cost is higher then the benefit…[Read more]

1. Have you ever been involved with an internal audit or audit of your process / project? Briefly describe.

I was working with a healthcare product based organization. One of my role was to perform internal audit for SSN. The purpose of the audit was to:
• Ensure that an individual’s Social Security number is not used for any purpose oth…[Read more]

4. In future weeks we may have the privilege of having real world auditors join us for our discussions. What questions would you like to ask the Auditors to answer for us?

I would like to ask following questions to the auditors:

What is the relationship between internal audit and the audit committee?
What is the difference in the approach…[Read more]

To add to your point Yu ming, inaccurate data may also lead to Invalid reports, Lower productivity and Loss in Revenue which ultimately leads to loss of business and finances. For this reason, it is very important to maintain data integrity which generating reports . This helps in evaluating the exact results for a business.