Title slide for on-screen presentation (default type = 60

Transcript Title slide for on-screen presentation (default type = 60

Internal Controls & Compliance using Oracle Applications

Ohio Valley Oracle Application Users Group

Jeff Taylor Pathik Mody Deloitte & Touche LLP January 26, 2007

Agenda

• Sarbanes-Oxley Overview • Internal Controls, Compliance, & Technology • SOX Tools • Segregation of Duties • Process and Financial Statement Certifications • Continuous Control Monitoring • Case Study • Questions Copyright © 2006 Deloitte Development LLC. All rights reserved.

Sarbanes-Oxley Overview

Background of Sarbanes-Oxley

• Passed by Congress on January 23rd, 2002 and signed by President Bush on July 30th, 2002 • Named after Senator Paul Sarbanes (D-MD) and Representative Michael Oxley (R-OH) • Governs publicly traded firms, including all overseas firms traded on the US markets Copyright © 2006 Deloitte Development LLC. All rights reserved.

Regulatory Background

Sarbanes-Oxley Section 302 and 404 Internal Control Requirements

Requires the CEO and CFO of a public company to certify quarterly and annually that they:

      Are responsible for disclosure controls, Have designed controls to ensure that material information is known to them, Have evaluated the effectiveness of controls, Have presented their conclusions in the filing, Have disclosed to the audit committee and auditors significant control deficiencies and acts of fraud, Have indicated in the report significant changes to controls.

Requires the CEO and CFO to annually:

 State their responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting,  Conduct and provide an assessment of the effectiveness of the enterprise’s internal controls.

Requires the external auditor to:

 Attest to management’s assertion.

Internal Controls, Compliance & Technology

What is an Internal Control?

Providing reasonable assurance of: • Effectiveness and efficiency of operations • Reliability of financial reporting • Compliance with laws and regulations or else… Copyright © 2006 Deloitte Development LLC. All rights reserved.

Compliance Steps

Policy & Procedure Standards Enforcement SOX 404 COSO COBIT FDICIA ISO Common Configuration Standards and Operational Policies Automated Enforcement and Configuration Monitor Auditing Monitoring Reporting

Current Situation Analysis

• Companies today are thinking beyond initial compliance requirements – Focusing on achieving sustained compliance – Establishing systems to support compliance in year three/four and beyond that are integrated into their ongoing operations • Technology plays a key role in helping companies sustain compliance effectively and efficiently • Most companies adopted interim solutions to support their compliance efforts • However, companies need an efficient and sustainable environment to enable the documentation, monitoring, assessment and reporting on internal controls Copyright © 2006 Deloitte Development LLC. All rights reserved.

End-State Architecture for Sustaining Compliance

CIO Business Unit Field Audit (404 App) Internal Audit External Audit Disclosure Committee Audit Committee HR/ Training Sarbanes PMO CEO/CFO Integration and Collaboration Security Internal Control Documentation & Assessment Financial Reporting Control Monitoring Systems Mgmt Content & Records Mgmt Compliance related applications and systems Financial Systems Supply Chain HR CRM Databases Hardware/Operating System/Network Infrastructure Document Retention Financial and related systems, platforms and databases – holds data, transactions and records

The Compliance Direction

Detective Manual Fragmented Local Preventive Automated Integrated Global

SOX Tools Oracle Internal Controls Manager

Sarbanes-Oxley Section 404 Tools

• Many commercially available products offer integrated technology functionality • Vendors offer different approaches to implementing and managing internal controls in their products.

• There are a number of option available in the market from ERP vendors, large integrated software vendors and specialty vendors and more should be expected in the future • Many of these products can provide product functionality such as Integration with ERPs, financial reporting systems, and other backend systems that can support SOX sustained compliance efforts • The ERP vendors are expected to possess an advantage for companies that already use their systems • However, companies must consider their technology environment and business requirements to determine which option is best • With most product in the market, companies should be able to migrate their risk and control information to vendors’ product through the use of a variety of export/import tools Copyright © 2006 Deloitte Development LLC. All rights reserved.

Sample Vendors and Products

ERPs Large Software Vendors ICM ICE MIC Specialty Vendors

What is Oracle Internal Controls Manager?

• ICM is a application developed to facilitate the collection, management, testing and remediation of control data and risk related efforts.

•

ICM Integrates seamlessly with your ERP Oracle application!

Monitor

• ICM is a tool that can be used by:

Experts

• Controllers, Internal Auditors, Operational Managers, and External Auditor to perform assessments, review and monitor ongoing compliance • Process Owners to document and validate business processes and track issues • Signing Officers to certify financial statements

Test ICM Document

Why Implement ICM?

• Organizes process documentation • Organizes risk assessments and control evaluations • Identify control weaknesses more easily • Provides flexibility to tailor audit process • ICM’s flexibility enables reporting from different points of view (e.g., financial, operational, organizational) • Segregation of Duties, IT Audit Capabilities • Integrates with Oracle Financials Suite • Useful for all levels of managements Copyright © 2006 Deloitte Development LLC. All rights reserved.

Oracle ICM Process

Define Organizations Data Repository Define Parent Processes Define Processes Define Risks Define Controls Define Audit Procedures Audit Results Conclude Findings / Remediation Certify Audit / Review Process Administration, Security Roles and Access, Reports

Oracle ICM Current Features

Populating the Data Repository

Processes Risks Understand the Business processes that run the business

• Create Business process using • Web ADI • Workflow • Tutor • Associate procedures to processes • Link Key accounts to Processes • Associate Risks, Controls, and Audit Procedures with processes • Map Processes to Organizations

Process are exposed to various risks

• Import risks using • Import process (Web ADI) • Identify the risks associated with each business process • Classify each risk for its probability and impact • Create/maintain a library of reusable risks Copyright © 2006 Deloitte Development LLC. All rights reserved.

Controls are put in place to mitigate risks

• Import controls using • Import process (Web ADI) • Associate controls with risks • Capture Control Objectives, control assertions, and physical evidence detail • Categorize controls using control type

Controls Audit Procedures Audit procedures test the effectiveness of controls

• Import Audit Procedures using • Import process (Web ADI) • Keep track of audit history for each procedures • Procedures provide detailed steps to be performed during the audit field work • Procedures can be setup to verify design, operational effectiveness or both 18

Documenting Processes, Risks and Controls

Processes – Sub Process Risk & Control Association

Process Details

Process Control Objective Risk

Control Activity

ICM Other Features

• Process associated with audit procedures • Audit procedures associated with control • Create Audit Engagement • Add Organization and Process to an Audit Engagement • Associate process to an Audit Engagement • Create/Add procedure to an Audit Engagement • Document findings and remediation Copyright © 2006 Deloitte Development LLC. All rights reserved.

Segregation of Duties

SOD Features and Benefits

Features

– Constraints for Incompatible Responsibilities/Functions – Waivers for Users or Responsibilities – Spreadsheet Upload for Constraints – XML Publisher Report for Constraint Violations

Benefits

– Segregate Duties by Operating Units – Allow Super Users to be Exempted from Constraints – Reduce Implementation Effort in Constraint Set Up – Facilitate Sharing of Constraint Violation Report Copyright © 2006 Deloitte Development LLC. All rights reserved.

Incompatible Responsibilities/Functions

SOD – XML Reports

Process and Financial Statement Certifications

Business Process Certification Dashboard

Financial Statement Certification Dashboard

Certifying Compliance Dashboard

What reports are available?

• Reports – Design Assessment – Operating Effectiveness – Risk Assessment – Control Testing – Open Issues / Findings – Control Gaps • Dashboard • Several XML reports Copyright © 2006 Deloitte Development LLC. All rights reserved.

What We Learned

• Reduce the scope of the effort by focusing on key processes, transactions and controls • Grow into extensive ICM functionality • Ensure management understands the level of involvement required throughout the organization • Standardize compliance process throughout the organization • Spend time upfront loading Risk Library • Leverage software to monitor the compliance effort, document testing and promote management responsibility Copyright © 2006 Deloitte Development LLC. All rights reserved.

Continuous Control Monitoring

Controls Automation & Monitoring

• Why Controls Automation and Continuous Controls Monitoring are Important – Reduces effort, cost, and reliance on external consultants by increasing control reliability and efficiency.

– Enhances the effectiveness of Internal Audit and line manager/staff.

– Provides real-time information for proactive preventive measures.

– Leverages real-time information and compliance investment for business value generation.

– Provides a sustainable and repeatable process to enable data and control quality improvement.

– Decreases learning curve and training requirements.

Controls Monitoring

Category Transaction Monitoring Master Data Monitoring Features

• • • • Identify suspicious transactions Identify suspicious transactions for further review Flag anomalies for investigation Isolate transactions not in compliance with business rules • Monitor changes to master data files (e.g., Supplier Master) for suspicious activity

Benefits

• • Identify inappropriate flows (e.g., duplicate payments) Provide evidence of control operation / quickly identify issues

Access Control Monitoring Segregation of Duties Monitoring Configuration Monitoring

• Monitor changes to user access / roles • • Identify SOD violations Detect executed transactions that violate SOD rules • Detect changes to system configurations that may increase risks of fraud & error

Manual Process & Control Monitoring

• Ensure the initiation and completion of manual business & IT processes & controls

IT General Controls

• • Identify and address suspicious changes to master data Detect stale master file records • • Detect unauthorized modifications to user access / roles Monitor access to sensitive transactions and data • Prevent SOD conflicts that increase the risk of fraud & error • Demonstrate the continued effectiveness of application controls • • Provide an audit trail for manual processes Increase effectiveness & efficiency of manual business & IT processes and controls • Enable increased reliance on automated business process controls 34

Oracle Application Controls Manager

• • • • •

Detect fraud or errors by tracking changes to Oracle Applications control settings Assess the current state of the Oracle Application control environment Confirm that Oracle Application control settings remain to industry standards Detect Oracle Application control settings changes by user id and date. Identify configuration mismatches across instances

Recommended Control Settings

Once recommended values have been setup, they are displayed in the ‘Application Control History’ pages along with the change history. This screenshot shows comparison between the recommended values and actual parameter settings. Non-conforming values are highlighted with a red icon. Copyright © 2006 Deloitte Development LLC. All rights reserved.

Oracle – Database and Audit Vault

• Specialized warehouse for audit data • Leverages Database vault security to block DBA from viewing audit data • SOD / Defined roles • Audit vault and Compliance report • Setup Audit Alerts • Restrict the DBA and other privileged users from accessing application data • Protect the database and applications from unauthorized changes • Enforce strong controls over who, when, and where application can be accessed Visit: Oracle .com/security Try Software: OTN: OTN.Oracle.com

Case Study Integrating Security & Controls

Client Background

• $12 billion global technology manufacturing • Primary legacy Oracle 10.7 character system • Other Oracle legacy instances on various versions • Located in 70 countries • North America, EMEA, APAC, and LATAM regions • Over 10,000 users • Re-implementing Oracle 11.5.10 platform • Phased functionality deployment approach • Extensive application footprint Copyright © 2006 Deloitte Development LLC. All rights reserved.

Implementation Scope

HR including Self-Service Accounts Receivable TeleSales Cash Management Procurement Contracts Advanced Benefits Service Contracts Accounts Payable General Ledger Fixed Assets Inventory Warehouse Mgt Advanced Supply Chain Planning Learning Mgt Scripting Spares Mgt Knowledge Mgt Incentive Comp ICM iSupplier Proposals Field Service

Implementation Scope

Advanced Pricing Order Management Purchasing Projects Costing Projects Billings Cost Management Configurator Work in Process Mobile Field Service Quality iExpense Time and Labor iProcurement Engineering Projects Mgt TeleService Projects Resourcing Advanced Scheduling iSupport Demand Planning Install Base Trading Community Architecture (TCA) Bill of Materials Shipping Advanced Budgeting & Planning Treasury Quoting Advanced Inbound Depot Repair Collaborative Planning CRM Foundation Copyright © 2006 Deloitte Development LLC. All rights reserved.

Engagement Objectives

• Deloitte was engaged to • Design, build, and implementation of the application security model for a global deployment of Oracle 11i.

• design and implementation of new global

Oracle 11i Security Responsibilities

for new functionality and users. • Identify and document the

Oracle 11i automated controls

. • Design a global Oracle security structure that incorporates appropriate

segregation of duties, controls compliance, administration efficiencies, standardization, and flexibility to adapt to on-going business and technology changes.

Security & Controls Objectives

• Elimination of significant segregation of duty conflicts in the Oracle 11i application • Completion of SOX documentation as it relates to Oracle 11i automated control implementation (i.e. control matrices) • Standardization of the Oracle 11i security practices/procedures, including naming conventions • Ease of compliance enforcement for the Oracle 11i system and on-going SOX compliance • Security staff trained in the new Oracle 11i security practices/procedures • Internal control and regulatory compliance concerns appropriately addressed Copyright © 2006 Deloitte Development LLC. All rights reserved.

Contact Information

Jeff Taylor, Sr. Manager, Deloitte Consulting [email protected]

Pathik Mody, Manger, Deloitte & Touche, LLP [email protected]

About Deloitte

Deloitte refers to one or more of Deloitte Touche Tohmatsu, a Swiss Verein, its member firms and their respective subsidiaries and affiliates. Deloitte Touche Tohmatsu is an organization of member firms around the world devoted to excellence in providing professional services and advice, focused on client service through a global strategy executed locally in nearly 150 countries. With access to the deep intellectual capital of 120,000 people worldwide, Deloitte delivers services in four professional areas, audit, tax, consulting and financial advisory services, and serves more than one half of the world’s largest companies, as well as large national enterprises, public institutions, locally important clients, and successful, fast-growing global growth companies. Services are not provided by the Deloitte Touche Tohmatsu Verein and, for regulatory and other reasons, certain member firms do not provide services in all four professional areas.

As a Swiss Verein (association), neither Deloitte Touche Tohmatsu nor any of its member firms has any liability for each othe Touche Tohmatsu, or other related names.

r’s acts or omissions. Each of the member firms is a separate and independent legal entity operating under the names Deloitte, Deloitte & Touche, Deloitte In the US, Deloitte & Touche USA LLP is the US member firm of Deloitte Touche Tohmatsu and services are provided by the subsidiaries of Deloitte & Touche USA LLP (Deloitte & Touche LLP, Deloitte Consulting LLP, Deloitte Financial Advisory Services LLP, Deloitte Tax LLP and their subsidiaries), and not by Deloitte & Touche USA LLP. The subsidiaries of the US member firm are among the nation's leading professional services firms, providing audit, tax, consulting and financial advisory services through nearly 30,000 people in more than 80 cities. Known as employers of choice for innovative human resources programs, they are dedicated to helping their clients and their people excel. For more information, please visit the US member firm’s web site at www.deloitte.com/us.