Segrega&on of Du&es (SOD): Is Your Company at Risk? Erich Heneke Senior Manager Mayo Clinic Supply Chain Management

Transcription

1 Segrega&on of Du&es (SOD): Is Your Company at Risk? Erich Heneke Senior Manager Mayo Clinic Supply Chain Management

2 About Mayo First & largest integrated, not- for- profit group in the world Employs 60,000+ across three campuses and 20+ health system sites Flagship campus in Rochester, Minnesota

3 About Supply Chain 400+ employees across dozens of campuses recognized as premier Supply Chain in healthcare Revenue ($14M+ annually) Houses separate business development team

4 About my team Added as a recommenda@on from Internal Audit arer a widespread fraud Reports directly through Mayo Supply Chain Management Responsible for audit, control and GL func@ons across enterprise Sox compliance, internal audit projects, direct fraud monitoring/detec@on

5 Audience Par&cipa&on - SOD What are your past experiences (posi@ve or nega@ve) with SOD? What types of controls do you put in place to ensure proper SOD? What gaps do you suspect you may have regarding SOD?

6 Agenda Brief overview of SOD rules of the road pi`alls of SOD oren hidden in Mayo s solu@on to address system access and poten@al SOD risk

7 Rules of the Road What does of mean? Procedurally How does one address SOD risk? Automated controls Manual controls controls of risk Ignore

8 SOD piialls Small number of staff wearing many hats Perceived controls do not as assumed or intended No controls exist (ignoring or being unaware of the risk) of controls (reckless behavior, fraud, with intent) access

9 Mayo s Solu&on Background Internal Sarbanes Oxley Process

10 Mayo s Solu&on SysA SysB SysC

11 Mayo s Solu&on Ques@on: How do you address risk across mul@ple systems, mul@ple users, mul@ple people, mul@ple func@ons performing mul@ple tasks? Answer: Iden@fy risks, score the risks, sum and iden@fy high risk profiles.

12 Mayo s Solu&on Brainstormed 24 different risk factors as it related to healthcare, Supply Chain and Mayo Examples (access can): Alter payee or remit of a payment Can process invoices Has access to sensi@ve protected health informa@on (PHI) Add or modify a vendor in the vendor master Influence inventory (fill rates, orders, replenishment levels, etc) Has access to HR data

13 Mayo s Solu&on Scoring the risk factors Somewhat arbitrary Agempted to keep risk factors independent of one another

14 Mayo s Solu&on

15 Mayo s Solu&on Data request to system owner in order out risks with roles Very challenging Highly manual required common formajng Roles were subject to interpreta@on Some roles were duplica@ve Most difficult consuming por@on of the exercise

16 Mayo s Solu&on

17 Mayo s Solu&on What now? Reducing system access (some roles were swapped across employees) Refinement/repriori@za@on of roles Assump@on of risk Compensa@ng controls were considered throughout the process Admin roles were toughest to address

18 Mayo s Solu&on End result sizeable reduc@on of roles cri@cal to address SOD risk systema@cally Healthy discussions around process SOD risks realignment of func@ons in some cases Ease at leadership level about systema@c risks and possibility of other peripheral systems being added to the division

19 Lessons Learned Decentralized system management created barriers Non- standard ways of delivering data Varying levels of knowledge on system roles & risks Discussion of risks and SOD is easier with some, tougher with others roles create a unique problem in reducing roles (the just in case effect) solu@ons outside of removing roles must be considered

20 Where do we do from here? Next steps for Mayo Supply Chain: Refresh results from last year Automate the process end- to- end Require standard submission of data elements More engagement of system owners and even vendors Automated refresh of scores every 6 months without interven@on Work toward up- front solu@on when adding new users to systems risk analysis and decision making

21 Contact info Erich Heneke Senior Manager Supply Chain Management Mayo Clinic