Mansi Paun

Very well written, Alex. And I agree with you and scalability and ease of use being important criteria for ERP systems. Organizations must not undermine both these points as to a certain extent, they do affect customer’s view points while selecting an ERP system to use for their business. For eg., companies will be hesitant to buy an erp package…[Read more]

I agree with your view point, Magaly. Organizations should put more efforts into ensuring their systems are compliant with regulatory standards. Ofcourse the costs associated with building compliant systems will eventually be passed on to the customers. You rightly pointed out that the type of Industry would drive the controls and selection of…[Read more]

Excellent point about the ‘web-deployed ERP systems’, Said. The reduced initial costs would certainly be a leverage where they are trying to lure SMB market customers. However the vendor company must ensure they have proper security controls in place as security would be of prime concern where the vendor company is hosting the ERP system and data.

Rightly said, Deepali. You mentioned a very good point about miscalculating Return on investment. It never occurred to me that miscalculating ROI was a possibility. Besides these, the compliance cost could be higher than the financial benefits when it comes to implementing regulatory compliance controls. Since many of these controls are to…[Read more]

2. The ERP systems market is very competitive. What should SAP and other ERP systems providers be focusing on to make their systems more competitive in the future?

2. While there are many SAP and ERP systems out there which offer superior benefits when compared to others in the market, below are the ones that stand out.

• Better I…[Read more]

I agree with you, Daniel – Regulatory controls more often than not, are actually costlier to implement as compared to the benefits realized upon implementing the specific controls. This is mostly because regulatory authorities are entrusted with the responsibility of ensuring that all parties involved are safeguarded when it comes to a…[Read more]

Rightly said, Annamarie – auditors should report directly to an Audit committee rather than a Company executive who’s position and interests could end up affecting the Auditor’s assessment. Since you have been an Auditor / on an Audit team, could you tell if the organization had a culture whereby Auditors were encouraged to act and assess independently ?

Very well written, Binu. You’ve mentioned all the possible ways which could affect an Internal Auditor’s independence – which is noteworthy as one often tends to forget that individual relationships could also affect Audits. Just recently, 2 E&Y former Partners were charged with violating Auditor independence rules due to close personal…[Read more]

Very interesting, Deepali. I’m curious to know how you were encouraged or assured to maintain independence during these internal audits. Was the organization itself that mature that you didn’t fear retaliation of reporting any findings or did your own objectivity help you to report your assessment accurately ?

2. How is independence maintained when working for the company as an internal auditor?

2. When working for a company as an Internal Auditor, it is of utmost importance to maintain independence and objectivity. Independence can be maintained by ensuring that the Auditor reports directly to the Audit committee and not to a position which could…[Read more]

Well said, Annamarie – there is no one “correct answer” to which transaction is the most sensitive as it would purely depend and differ on factors like department, time of the year, specific role or position and the type of organization. From SAT Audit perspective however, I believe that any transaction that enables users to modify the G/L…[Read more]

Very informative, Paul. After reading your answer, I did a bit of research on Data stewards and found that data stewards play a significant role identifying what data needs to be collected, from where and possibly how it can be done more efficiently. He or She can crafts use policies so that excessive unnecessary data can be limited. From…[Read more]

Great insight, Abhay. You’re right in saying that most companies use one of the Master Data Management softwares to integrate and make Master data available to different processes and parts in an organization. MDM enables organizations to consolidate the critical Master data to one Master file. It also provides well streamlined data sharing and…[Read more]

Rightly pointed out, Deepali. Inaccurate data straightaway hits the infrastructure systems objective of Integrity.
Further to what you mentioned, I’d like to add that most Business decisions are a refined outcome of data therefore, if the data itself is inaccurate, we can be certain that the business decisions that follow using that data would…[Read more]

3. Which is more of a risk to a company: inaccurate data or excessive repetitive data? Explain
3. I personally find that inaccurate data is a bigger risk to a company than excessive repetitive data. This is because inaccurate data would go completely against most of the company’s objectives. Inaccurate data would mean a huge negative impact in…[Read more]

Absolutely, Deepali…and great example that you shared. I like that your example shows the interdependency between Identity and Access management. You can’t have one of it done right and miss the other one as the overall solution will fail. To put it better, a company can’t afford to have identity management implemented well and do a poor job at…[Read more]

Identity management refers to the administration of individual identities for different systems within an organization such that each individual user or employee has a unique identity. The creation, maintenance and deletion the identities forms the bulk of Identity Management. Access Management refers to the administration or management of…[Read more]

Hi Paul,
Your post made me recall a project that I worked on where a similar process was followed for deprovisioning – the Staffing Manager would share an updated list of employees supporting the project which was verified by the line managers. In case any employee had moved to a different role or out of the organization, the line manager was…[Read more]

*In that scenario, the controls would be more of a supervisory or accountability nature.

Great point about Prioritization, Annamarie. Now-a-days, with increasing number of security related incidents and greater emphasis on reducing the workforce, employees are often time-crunched. Therefore it is extremely important that the individual responsible for security can identify and differentiate a critical incident from a non-critical…[Read more]