Jaspreet K. Badesha

3. When is the cost of implementing a compliance control higher than the benefit obtained?  What should an organization do to ensure efficiency and profitability?
A cost if implementing compliance controls is higher than the benefit obtained when the fine for not having the control is significantly less (for an extended period of time) than that…[Read more]

2. (Updated Nov 30) The ERP systems market is very competitive.  What should SAP and other ERP systems providers be focusing on to make their systems more competitive in the future?
Since the ERP systems market is so competitive SAP should focus on updating the interface of their ERP systems making them more intuitive and easy to use. They s…[Read more]

.1. (Updated Nov 30) SAP is a world class ERP system provider.  If you are an SAP customer – what would you expect them to provide to support your company’s internal controls? Yes. I would expect support for my company’s internal controls because I am paying for a ERP system and that should entail some type of pre-configured internal control…[Read more]

Having worked in a compliance department for a healthcare organization I can tell you from experience that skimping on compliance controls is very very costly to an organization not just revenue-wise but reputational wise as well. You can also lose all of the funding you receive form the government and certain patient segments would not be able to…[Read more]

I agree Mansi, I have referenced similar items in my post for how an internal auditor maintains their independence. I particularly liked when you mentioned the following “He/she must understand the importance of keeping an objective view and ensure that any findings are reported and worked on. ” This is an integral part of keeping independence……[Read more]

2. How is independence maintained when working for the company as an internal auditor? If you do not report to anyone you are auditing, you can maintain a level of independence. When you end up reporting to someone who is responsible for the function you are auditing then it becomes very complicated and it gets hard to separate the truth from…[Read more]

1. Have you ever been involved with an internal audit or audit of your process / project?  Briefly describe.
Yes, at my previous job I was apart of the Compliance department and handled analytics on training metrics. I created my own access data base to manipulate the data to get it into the correct format for reports for managers and above as…[Read more]

Hi Sean,

This is a very very good post. I particularly like the fact that you stated ‘Many times changes were put in place, and training was conducted to highlight the changes themselves, but very little was ever explained as to the why of the changes’. This happens in many organizations and causes a big gap in the process and acceptance of the…[Read more]

4. In future weeks we may have the privilege of having real world auditors join us for our discussions.  What questions would you like to ask the Auditors to answer for us?
1. What questions are the safest questions to ask when starting out as an Auditor?
2. How do you build a relationship with members of the project you are working on to get v…[Read more]

3. How have you seen change management work in your organization?  What improvement recommendations do you have?
The one issue that we have with our change management process in our organization is that it happens in ‘hallway’ conversations and isn’t done through proper channels. Or the fact that the project team is the last to find out theref…[Read more]

2. In your company, do you use any blueprints as documentation?  Why are process blueprints important in the documentation?
Yes, in my company we use project request blueprints in which we have an outline of information required to start a project. This helps us understand the scope and business reason for the project and all functional…[Read more]

1. What are the key components of SAP change management controls you would expect the auditor to review?  Why?
The key components of SAP change management controls I would expect the auditor to review are the following:
• Change management policies and procedures
o These are formally documented processes and ensures that the processes are bei…[Read more]

3. Which is more of a risk to a company: inaccurate data or excessive repetitive data?  Explain
Inaccurate data is more of a risk than excessive repetitive data. Repetitive data as long as its accurate can be cleaned up easily. However, if data is inaccurate is will be building a wrong record and adding to the incorrect record throughout the e…[Read more]

1. Master data in an ERP system is highly integrated with various processes and effects many parts of the organization. How does an organization assure this integration works well for all?
Master data is an integral part of the ERP system and is the foundation to most processes. Therefore, there need to be controls in place that allow accurate…[Read more]

ignore this it is not a reply but a post.

1. Master data in an ERP system is highly integrated with various processes and effects many parts of the organization.  How does an organization assure this integration works well for all?
Master data is an integral part of the ERP system and is the foundation to most processes. Therefore, there need to be controls in place that allow accurate…[Read more]

Yes, I agree. In a particular example this is true is my cousin worked for a pharmacy and did data entry. When the data entry was completed it went to a second person to review the information and then a third to validate and then sign off on all of the information to ship the item, The reason why they have so many people validate information is…[Read more]

2. Security in an ERP system (e.g. SAP) is complex.  What is the most fuzzy, difficult to understand component?  Explain
ERP systems can be large and complex. The most ‘fuzzy’ portion of that is how to ensure security over the entirety of the system itself when you are most likely not aware of each component of the system and all of the vulner…[Read more]

Tiesha, this is very true. In my company when code needs to be moved to production it needs to be approved by QA (after thorough testing) as well as through User Acceptance Testing by the business when applicable. Otherwise the code cannot be moved to production. Also once the code is moved to production it needs to be thoroughly tested by QA and…[Read more]

job function meaning a specific task is broken into multiple roles.