ARMI - KN

Everyone loves setting New Year’s Resolutions. Given my history having a heart attack in 2019, I encourage you to set goals arounds eating healthy and consistent exercise (link to January newsletter story).

New Year – New Me….

In the new year, we like to focus on new goals, new aspirations, even “a new me”. But how do you face the new year when life’s inner struggles impact your mind? Having a traumatic, life-changing medical issue changes you and can challenge your faith in God.  In March 2019, I had a heart attack that should have rendered my wife a widow. The arterial wall in my Left Anterior Descending (referred to as the LAD) artery ruptured during a triathlon in 2019. I had a heart attack that they refer to as ‘the widow maker’ because a high percentage of heart attacks in these circumstances cause sudden cardiac distress leading to death.

Application Access Controls form the foundation of your control environment in your ERP system.  However, these new SaaS systems have become quite complex. And organizations tend not to have a program to develop and manage these controls. This is why more and more organizations are partnering with outside advisory firms to help. So, what are your options?

The lack of maturity of external auditing procedures is finally attracting more of the attention it deserves. The US’s Public Company Accounting Oversight Board (PCAOB) and the UK’s Financial Reporting Council (FRC) are publicly challenging external auditors to improve their processes.

In part 1 of this article series, I postulated that there is a systemic issue related to management override of controls. More concerning than the existence of this issue is that it isn’t being addressed by management or the audit community. This issue is systemic. Let’s discuss what changes we would need to see to correct the current situation.

The latest U.S. Securities and Exchange Commission (SEC) guidance on Cyber Security risks have “Cyber” firms buzzing.  Those that thought this would be the equivalent of Sarbanes Oxley must have been seriously disappointed.  There was no mandatory audit of Cyber risk included.

Written By Fred Roth, CISA, Sr. Adjunct Lecture at ERP Risk Advisors

I wrote an article called “Why Access Controls Must Be Tested for All In-Scope Systems,” and the feedback has been shocking. I have a decent network of auditors throughout external audit firms who regularly comment “off the record” when I am drafting or have published something. Honestly, I didn’t think the article was that revolutionary, however I am now realizing otherwise based on the feedback I heard. Publishing that article has uncovered a systemic issue in the internal and external audit industries I didn’t know existed.

Organizations using SaaS Applications are encountering an increase in fraud risks that traditional cyber security firms are failing to recognize. Most organizations focus on protecting the perimeter and risks related to ransomware and data theft, leaving the organization vulnerable to attack in neglected areas. Internet facing applications such as ERP Cloud, NetSuite, and Workday allow easy access and administration in our work-from-home world. Properly securing the applications means far more than securing the perimeter.

Sarbanes-Oxley and control design best practices require access controls be tested for every in-scope ERP system within an organization’s Risk and Control Matrix (RACM). While this may not be the standard for external auditors, let me attempt to make a case.