Paul Linkchorst

4. SAP’s GRC module may be important and effective, but can the cost of GRC be justified? Explain

GRC is a SAP module that is utilized to centralize and link the business risks, controls, and operations of an organization. Like other SAP implementations, implementing the GRC module can be a costly task. However, SAP states that this module c…[Read more]

3. A person’s character is very crucial in the audit industry. How would you build your reputation and maintain a good ethical character in this industry?

Overall, ethics is a big area in the audit environment and something that should frequently be reinforced. In the case of an external auditor, credibility, integrity, and objectivity p…[Read more]

2. In the Real-World Control Failures we’ve reviewed, describe the character of the leaders involved. Is it a root of the control failures?

In a majority of the control failures that I have been exposed too in reading and through the class presentations, it would seem that the leaders involved did lack character. In my control failure p…[Read more]

1. How much of automated controls should be desired? Is it beneficial to consider controls at the initial design phase or controls are introduced as and when needs arise?

I think that in cases where it will be reasonable for a control to be automated, then there is a preference for that control to be automated than a manual control. The major…[Read more]

Hi Jaspreet,

I would agree that a better GUI that is more intuitive will likely help SAP compete with other ERP platforms. In my experience using SAP, the program isn’t the most straightforward and can be clunky at times. For some organizations, this might be a turn off. If SAP or another ERP system utilized a user interface like that of o…[Read more]

Hi Said,

I can see your point as to why it might not be the smartest idea to train all employees about how SAP goes about controlling certain processes. It might be better off training only employees with a management or governance responsibility; one who is accountable to make sure fraud and errors don’t occur within a process. By training t…[Read more]

Hi Binu,

I think you are right that small businesses often overlook compliance, but as you stated, I think compliance regulations are not often targeted toward these smaller organizations. Two larger compliance regulations that we discussed throughout this program are Sarbanes Oxley (SOX) and the Payment Card Industry Data Security Standard…[Read more]

4. What aspect of compliance should an organization put the most effort into ensuring their controls are adequate? What factors about an organization (it’s industry, profit / non-profit, international, …) would drive this answer?

I think the one aspect of compliance that an organization should put the most effort into depends entirely on the…[Read more]

3. When is the cost of implementing a compliance control higher than the benefit obtained? What should an organization do to ensure efficiency and profitability?

In my opinion, I think the cost of implementing a compliance control is higher than the benefit obtained when the cost is higher than the impact of a threat/risk. When performing a…[Read more]

2. (Updated Nov 30) The ERP systems market is very competitive. What should SAP and other ERP systems providers be focusing on to make their systems more competitive in the future?

I believe that one of the ways SAP or other ERP systems providers can become more competitive is by allowing an ERP system to be constructed like building blocks or…[Read more]

1. (Updated Nov 30) SAP is a world class ERP system provider. If you are an SAP customer – what would you expect them to provide to support your company’s internal controls?

I think one of the expectations I would have of SAP in helping support my company’s internal controls, is by them assisting in identifying any processes that can be autom…[Read more]

Hi Jaspreet,

You bring up a good point about lawsuits. From the plaintiff’s perspective, if the defendant has not followed best practices, which more or less are compliance controls, this can open up an avenue for the plaintiff to use negligence in their lawsuit. Since these controls are required by law, failure to comply could lead to an e…[Read more]

Hi Annamarie,

I had a similar experience to you. When I did my Internal Audit internship, the Internal Audit manager sat myself and another intern down for about 3 hours and stressed how important independence is when performing the function. It was also one of the reasons why we were picked for the position. The company has a record of…[Read more]

Hi Deepali,

The overall process for these audits I would say were the same. We started by reviewing previous audits and documentation to learn the process, met with process owners/managers, requested documentation, tested the documentation, conducted follow up meetings, and finally came to a conclusion/recommendation. For starters, the…[Read more]

3. When is the cost of implementing a compliance control higher then the benefit obtained? What should an organization do to ensure efficiency and profitability?

In my opinion, I think the cost of implementing a compliance control is higher than the benefit obtained when the cost is higher than the impact of a threat/risk. When performing a…[Read more]

2. How is independence maintained when working for the company as an internal auditor?

I suppose there is a natural conflict of interest having members of a company perform audits on its IT and operations. With that being said, there are several actions that a company can do in order to maintain independence. First off, Internal Audit…[Read more]

1. Have you ever been involved with an internal audit or audit of your process / project? Briefly describe.

One of my previous internships included a year working with the Internal Audit department of Munich Reinsurance America Inc. in Princeton, NJ. Over that time span, I worked on several audits from both the IT side and operational side.…[Read more]

4. Next week we have the privilege of having real world auditors join us for our discussions. What questions would you like to ask the Auditors to answer for us?

The only question that I have is what are some of the more specialized skills that an auditor can acquire?

1. What are the key components of SAP change management controls you would expect the auditor to review? Why?

Change management is the process of making sure changes to a system are properly managed to reduce the risks of actions such as unauthorized access to business processes, unintended side effects to changes in code, inability to respond…[Read more]

3. How have you seen change management work in your organization? What improvement recommendations do you have?

Unfortunately, my experiences with change management have been limited. I have not had any experience with the change management process with the organizations that I have worked with. However, I have experienced the audit of an…[Read more]