Part of our 2024 Resovolutions is to revolutionize the way organizations identify, manage, and mitigate risk in their ERP systems. Application security design and management risks produce a significant, immature control within organizations. Management knows these risks are often not being managed properly. The benefits seem to outweigh the risks when you consider:
Application Access Controls form the foundation of your control environment in your ERP system. However, these new SaaS systems have become quite complex. And organizations tend not to have a program to develop and manage these controls. This is why more and more organizations are partnering with outside advisory firms to help. So, what are your options?
The lack of maturity of external auditing procedures is finally attracting more of the attention it deserves. The US’s Public Company Accounting Oversight Board (PCAOB) and the UK’s Financial Reporting Council (FRC) are publicly challenging external auditors to improve their processes.
Sadly, we see another significant, and successful cyberattack with MGM Resorts being the latest victim. What we understand from the information available, is the breach could have a material impact on the company’s financial results. Additionally, this is the first major corporate breach since the SEC guidance on cyber risk which was published in late July. [See reference article here]
The latest U.S. Securities and Exchange Commission (SEC) guidance on Cyber Security risks have “Cyber” firms buzzing. Those that thought this would be the equivalent of Sarbanes Oxley must have been seriously disappointed. There was no mandatory audit of Cyber risk included.
August 7th, 2023: ERP Risk Advisors, a pioneering risk content company committed to identifying, managing, and mitigating ERP risk, and HALEY Consulting and Advisory Services, a leading provider of innovative solutions ensuring seamless SOX compliance backed by PCAOB standards, proudly announce their strategic collaboration. This dynamic partnership sets the stage for enhanced risk mitigation and content utilization, specifically targeting organizations running Oracle ERP systems.
ERP Risk Advisors, the leader in risk content in the Oracle applications space, is pleased to announce a partnership with Excelencia Consulting, an Oracle Solutions company headquartered in Austin, TX, with offices in UK, Canada and India.
ERP Risk Advisors, the leader in risk content in the Oracle applications space, is pleased to announce a partnership with Project EIDOS an established UK IT Service Consultancy with a primary focus on providing technical support and enhanced solutions for EBS and Cloud since 2016.
Despite having been in the Oracle applications space for over 20 years it is still a mystery to me what external auditors do or don’t do in their audit. Recently on vacation I ran into an IT auditor from a big four firm who specializes in SAP. I took the opportunity to help me better understand if there were differences in how they audited various ERP systems. In most ERP systems there are security objects (T-Codes for SAP, privileges for ERP Cloud, Functions for E-Business Suite) that allow a user to bypass workflow approval processes. If an organization is relying on workflow processes, yet someone can enter a transaction or maintain master data that bypasses the workflow, the IT application control (ITAC) design may not be deemed to be reliable. For example, if the system has been configured to have all purchase orders (PO) go through a workflow approval process, yet an IT user or end user could upload an approved PO (that isn’t subject to the workflow approval process), then that user would have the ability to bypass the design of the ITAC – effectively undermining the ITAC design. The same can be true for journal entries, requisitions, suppliers, supplier bank accounts, orders, invoices, etc.
UK Police Department using ERP Cloud given “Significant Deficiency” by Grant Thornton partially due to “Segregation of Duties” issues and system accounts.