In early January, FAA software caused US flight operations to halt for several hours. For a summary of the software failure, see Adam Levin’s Bloomberg article “FAA Computer File Caused by People Who Damaged Data File”. Source According to the article, a “data file” responsible for the chaos was damaged because of a failure to follow government procedures.
ERP software provides organizations with tremendous benefits including vast configurable processes and standard reports used for reporting on data. ERP software comes in two flavors: those that organizations need to manage their own infrastructure (on-premise software providers) and those where the infrastructure is managed by the software vendor (SaaS software providers).
I did it! My redemption race is done. I AM A IRONMAN!!! Two years, eight months and 20 days from my heart attack in the Oman 70.3 race, I completed my first full Ironman race in Arizona this past week.
Despite having been in the Oracle applications space for over 20 years it is still a mystery to me what external auditors do or don’t do in their audit. Recently on vacation I ran into an IT auditor from a big four firm who specializes in SAP. I took the opportunity to help me better understand if there were differences in how they audited various ERP systems. In most ERP systems there are security objects (T-Codes for SAP, privileges for ERP Cloud, Functions for E-Business Suite) that allow a user to bypass workflow approval processes. If an organization is relying on workflow processes, yet someone can enter a transaction or maintain master data that bypasses the workflow, the IT application control (ITAC) design may not be deemed to be reliable. For example, if the system has been configured to have all purchase orders (PO) go through a workflow approval process, yet an IT user or end user could upload an approved PO (that isn’t subject to the workflow approval process), then that user would have the ability to bypass the design of the ITAC – effectively undermining the ITAC design. The same can be true for journal entries, requisitions, suppliers, supplier bank accounts, orders, invoices, etc.
Last week I wrote a blog talking about how the System Implementation industry is biased against a “Complete and Secure” implementation. This week I’d like to address another elephant in the room – institutional bias in the External Audit community.
This article is long overdue, but still one I have been dreading to release. I know the audit firms could come under significant additional scrutiny from regulators such as the PCAOB. However, there are significant risks organizations are facing because of poorly designed controls and inadequate audit procedures. We’re now more than 20 years post-Sarbanes-Oxley, and it is time to shine the light on areas that board members and investors would be appalled by if they understood this topic. With this said, here is my article…