Best Practices for Implementing Third

Party Software to Monitor SOD and User

Access ControlsPresented by:

Jeffrey T. Hare, CPA CISA CIA

ERP Seminars

© 2008 ERPS

Overview:IntroductionsSuccess Factors Identifying RequirementsRFP ProcessLikely RequirementsPreventive Control TechnologiesAudit Trail TechnologiesQ&APublic Domain CollaborationOracle Apps Internal Controls RepositoryOther ResourcesContact Information

Presentation Agenda

© 2008 ERPS

IntroductionsJeffrey T. Hare, CPA CISA CIA•Founder of ERP Seminars and Oracle User Best Practices Board

•Written various white papers on SOX Best Practices in an Oracle Applications environment

•Frequent contributor to OAUG’s Insight magazine

•Experience includes Big 4 audit, 6 years in CFO/Controller roles – both auditor and audited perspectives

•In Oracle applications space since 1998– both client and consultant perspectives

•Founder of Internal Controls Repository - public domain internal controls repository for end users

© 2008 ERPS

Success Factors

Here are a few success factors for the acquisition and implementation of third party software:

•Management support – financially and physically

•Define requirements using a risk-based assessment process

•Choose an experienced partner to help you through the RFP process

•understands the requirements and can help add to requirements

•can help you differentiate the requirements in the RFP process

•will help you determine which technologies will best meet your requirements

•Choose an experienced partner to help implement the software

© 2008 ERPS

Identifying Requirements

Use a risk-based approach to identify the requirements that:

•Identifies risks with a user having access to a function or two functions – segregation of duties, access to a sensitive function or sensitive data

•Takes into account risks in the system as well as considers the process holistically – from manual process outside the system through process in the system; for example, supplier entry process

•Takes into account current controls in making an assessment of the residual risks

•Identifies risks that need monitoring, auditing, prevention for the software (may also identify other requirements such as additional manual controls, forms personalization, documentation or testing of non-key controls)

© 2008 ERPS

RFP Process Here are some success factors for the RFP Process:

• Use proven RFP template or partner with firm with experience in the space

• Make sure the demo scripts help delineate the technology differences between the various vendors

• Make sure that all interested parties are present at the demos

• Insist on preventive controls to reduce internal and external audit costs

© 2008 ERPS

Likely Requirements

Here are some likely requirements that will come from a proper risk assessment process:

• Robust monitoring and reporting for initial remediation process to identify current conflicts

• Preventive controls – user provisioning, menus, responsibilities and related function and menu exclusions, functions, forms, and request groups

• Auditing of activity to track activity such as SQL forms, remit-to addresses, banks, suppliers, and profile options

© 2008 ERPS

Pros and Cons of Various Preventive Control Technologies:

•Forms Personalization

•Custom.pll

•Triggers

Preventive Control Technologies

© 2008 ERPS

Audit Trail Technologies

Pros and Cons of Various Audit Trail Technologies:

•Standard database fields – created by, creation date, last updated by, last updated date

•Log files – network and database

•Triggers

Q & A

© 2008 ERPS

Public Domain Collaboration

What is needed are standards for collection of:

•Tables to audit as data is migrated (for example banks)

•Additional functions and functionality is added

Internal Controls Repository: http://tech.groups.yahoo.com/group/oracleappsinternalcontrols/

•Publishing list of critical forms, tables, columns to audit prioritized by risk

•Promoting use of our risk assessment process as the standard in the industry with agreement on language and mapped to the function level

Public domain collaboration will insure consistency and quality

© 2008 ERPS

Oracle Apps Internal Controls Repository

Internal Controls Repository Content:

•White Papers such as Accessing the database without having a database login, Best Practices for Bank Account Entry and Assignment, Using a Risk Based Assessment for User Access Controls, Internal Controls Best Practices for Oracle’s Journal Approval Process

•Oracle apps internal controls deficiencies and common solutions

•Mapping of sensitive data to the table and columns

•Identification of reports with access to sensitive data

•http://tech.groups.yahoo.com/group/oracleappsinternalcontrols/

Other Resources

© 2008 ERPS

•Oracle Users Best Practices Board: www.oubpb.com•Cam’s white paper on Auditing the DBA at: http://www.absolute-tech.com/products/whitepapers.htm•Integrigy white papers at: http://www.integrigy.com/security-resources •Solution Beacon: http://www.solutionbeacon.com/security.htm •Oracle internal controls and security public listserver: http://tech.groups.yahoo.com/group/OracleSox/

© 2008 ERPS

Best Practices CaveatBest Practices Caveat

The Best Practices cited in this presentation have not been validated with your external auditors nor has there been any systematic study of industry practices to determine they are ‘in fact’ Best Practices for a representative sample of companies attempting to comply with the Sarbanes-Oxley Act of 2002 or other corporate governance initiatives mentioned. The Best Practice examples given here should not substitute for accounting or legal advice for your organization and provide no indemnification from fraud or material misstatements in your financial statements or control deficiencies.

© 2008 ERPS

Contact InformationJeffrey T. Hare, CPA CISA CIA Phone: 602-769-9049 E-mail: jhare@erpseminars.com Websites: www.erpseminars.com, www.oubpb.com Oracle SOX eGroup at

http://groups.yahoo.com/group/OracleSox Internal Controls Repository

http://tech.groups.yahoo.com/group/oracleappsinternalcontrols/

Cam Larner Phone: 888.270.3012 Website: www.absolute-tech.com