ARMI - KN

Organizations using SaaS Applications are encountering an increase in fraud risks that traditional cyber security firms are failing to recognize. Most organizations focus on protecting the perimeter and risks related to ransomware and data theft, leaving the organization vulnerable to attack in neglected areas. Internet facing applications such as ERP Cloud, NetSuite, and Workday allow easy access and administration in our work-from-home world. Properly securing the applications means far more than securing the perimeter.

Sarbanes-Oxley and control design best practices require access controls be tested for every in-scope ERP system within an organization’s Risk and Control Matrix (RACM). While this may not be the standard for external auditors, let me attempt to make a case.

Despite having been in the Oracle applications space for over 20 years it is still a mystery to me what external auditors do or don’t do in their audit.  Recently on vacation I ran into an IT auditor from a big four firm who specializes in SAP.  I took the opportunity to help me better understand if there were differences in how they audited various ERP systems.  In most ERP systems there are security objects (T-Codes for SAP, privileges for ERP Cloud, Functions for E-Business Suite) that allow a user to bypass workflow approval processes.   If an organization is relying on workflow processes, yet someone can enter a transaction or maintain master data that bypasses the workflow, the IT application control (ITAC) design may not be deemed to be reliable.  For example, if the system has been configured to have all purchase orders (PO) go through a workflow approval process, yet an IT user or end user could upload an approved PO (that isn’t subject to the workflow approval process), then that user would have the ability to bypass the design of the ITAC – effectively undermining the ITAC design.  The same can be true for journal entries, requisitions, suppliers, supplier bank accounts, orders, invoices, etc.

This article is long overdue, but still one I have been dreading to release.  I know the audit firms could come under significant additional scrutiny from regulators such as the PCAOB.  However, there are significant risks organizations are facing because of poorly designed controls and inadequate audit procedures.  We’re now more than 20 years post-Sarbanes-Oxley, and it is time to shine the light on areas that board members and investors would be appalled by if they understood this topic.  With this said, here is my article…