We are witnessing the most significant digital transformation in global history – surpassing the massive Y2K tech boom. This shift is largely driven by evolving cyber security risks in our work from home era and modernization of business processes.
“The definition of insanity is doing the same things over and over again but expecting different results”.
Disruption in the risk advisory industry has influenced industries time and time again over the years.
Having been in this space for over 25 years, I have seen the good, the bad, and the ugly. The deck is stacked against a secure and compliant ERP system implementation. Most publicly traded organizations implementing a new ERP system likely will have one or more “Significant Deficiencies” in the first year that should be reflected in audit findings. However, auditor ignorance often prevents these from being recognized.
A digital revolution is upon us! We are witnessing the greatest digital transformation since Y2K thanks to perpetual patch cycles within SaaS Applications. Organizations are ridding themselves of building and managing data centers by moving their legacy applications to hosted data centers. And thus moving many of their legacy applications to modern SaaS applications.
Organizations are implementing new SaaS ERP systems to modernize their enterprise. Traditional cybersecurity risks are being outsourced to the software provider, yet certain cybersecurity risks still need to be addressed by management.
Having been in the Security and Controls space for far too long, I have witnessed and am still witnessing a phenomenon that needs to be addressed. Auditors talk WAY too much about Segregation of Duties.
From our Cyber Security technical expert, Connor Thompson, CIA CISA
![Lack of Software to Test Access Controls is Systemic and Why It Matters [Part 2]](https://7552374.hs-sites.com/hubfs/Imported_Blog_Media/Lack-of-Software-to-Test-Access-Controls-Web-Photo.png)
In part 1 of this article series, I postulated that there is a systemic issue related to management override of controls. More concerning than the existence of this issue is that it isn’t being addressed by management or the audit community. This issue is systemic. Let’s discuss what changes we would need to see to correct the current situation.
![Lack of Control Performer Independence Testing is a Systemic Issue and This is Why it Matters [Part 1]](https://7552374.hs-sites.com/hubfs/Imported_Blog_Media/Lack-of-Control-Performer-Independence-Testing-is-Systemic-and-This-is-Why-it-Matters-Part-1.jpg)
I wrote an article called “Why Access Controls Must Be Tested for All In-Scope Systems,” and the feedback has been shocking. I have a decent network of auditors throughout external audit firms who regularly comment “off the record” when I am drafting or have published something. Honestly, I didn’t think the article was that revolutionary, however I am now realizing otherwise based on the feedback I heard. Publishing that article has uncovered a systemic issue in the internal and external audit industries I didn’t know existed.