How to Select Audit Trail Software for Microsoft Dynamics NAV

Transcription

1 How to Select Audit Trail Software for Microsoft Dynamics NAV A Best Practice Guide

2 Table of Contents 1. Introduction 2. Default Functionality 3. Software Setup Time 4. Performance 5. Audit Management and Capability 6. Final Thoughts 7. Get Audit Trail For NAV

3 Introduction Today's Business Environment The current business environment is one of increasing regulation and compliance requirements. It doesn t matter if we are discussing Sarbanes-Oxley for public companies in the U.S., the similar Bill 198 for Canadian issuers, the EU's directive 8, HIPAA privacy regulations, or a multitude of state, local and bank requirements, the control and accuracy of financial data is more important than ever. This regulatory burden is matched against increasing incidents of corporate fraud as a struggling economy puts pressure on executives to perform and employees to survive. These factors combine to make maintaining control of the information in accounting systems more important than ever. A key component of that control is auditing changes in a company s accounting system. Purpose The purpose of this guide is to provide an understanding of what options to consider when selecting audit trail software for Microsoft Dynamics NAV. About the Author Mark Polino is a Certified Public Accountant with additional AICPA certifications in information technology (CITP) and financial forensics (CFF). Mark is the author of 8 ERP focused books and a regular speaker on the topic of ERP security. He works as the Director of Client Services for Fastpath.

4 Default Functionality Microsoft Dynamics NAV users have long tried to use NAV s Change Log functionality as an audit tool. This functionality is woefully inadequate for true audit requirements. The Change Log feature inside of Microsoft Dynamics NAV was designed as a tool to troubleshoot who is changing what values in the system rather than as a true audit tracking tool. Change Log allows the user to select a table and the fields within the table to track. There is the option to track inserting, modifying and deleting of data. The NAV Change Log doesn t provide reports and frequently experiences performance issues as more tables and fields are tracked. Change Log can only track changes that are made through the NAV user interface and can t track changes made to the data through SQL. This is a big gap from an audit perspective. Auditing transactions is not something that should be taken lightly. There can be significant business and system performance ramifications for unnecessary over tracking. As a result, the Microsoft offering should be evaluated against all other third party options to ensure that firms choose the right solution for their needs.

5 Finally, starting with SQL Server 2008, Microsoft introduced the option of auditing tables as part of SQL Server. For most companies, this is a poor option for financial data since it would require the company to essentially build both an auditing and reporting solution from scratch. Providing the tools is not the same thing as providing a solution. In addition, industry leading solutions are regularly seen and accepted by auditors, giving them confidence in the performance of those solutions. Building an audit solution from scratch may actually increase audit fees and time as the auditors evaluate the effectiveness of the home grown auditing solution.

6 Software Setup Time One of the keys to the successful use of auditing software is fast setup. This should not be a long and involved process. Common fraud and control points are well known by auditors and provide an easy starting point for setup. For example, vendor setup is typically audited to provide some prevention for false vendor creation. Similarly, vendor address changes are normally audited to help prevent the fraudulent redirection of legitimate payments. These are common control points that should be virtually automatic. Solution providers should be able to provide a fast setup based on these best practices using templates or a similar mechanism to select the appropriate data to audit. Setup should allow for easy customization from a standard template to enable a company or auditor to meet specific requirements. Experienced vendors know what auditors are looking for and they know how to quickly and effectively apply their solution.

7 Performance The flip side to setting up audit trail software is performance. All audit trail software will create records, usually (hopefully!) in a database. Recording information is, of course, the purpose of audit trail software. The problem comes when companies over-zealously try to audit everything, bringing the accounting system to a crawl. It is much easier to audit when the system is so slow that users can t enter data, however, it s not terribly productive. Typically, firms need to start by auditing master record creation, changes and deletions. This includes customers, vendors, inventory items, etc. Controlling master records is critical to controlling an accounting system, but auditing master records usually doesn t kill performance. Similarly, auditing changes to system settings has little or no negative effect on performance because changes are small and rare. Auditing transactions however, can dramatically slow down a system. This leads to my three keys of audit trail system performance: 1. Select an audit trail system designed for high performance 2. Only audit those items that are truly necessary, especially when it comes to transaction auditing 3. Select an audit trail vendor with the experience and audit background to provide guidance on the most effective setup Though it may be counter intuitive, the inclusion of notes in auditing software does relatively little, but adds unnecessary data to the system. The notes aren t authoritative so auditors generally give them no weight and ignore them. Users who need to be reminded of the reasoning behind a transaction find it better to attach their notes to the transaction in Dynamics NAV.

8 Audit Management and Capability Data Management As I mentioned before, auditing software creates records that need to be stored and ultimately, managed. Audit trail software needs to be able to accommodate large amounts of accumulated data and have processes to archive, backup and preserve that data. Often courts and regulatory agencies are years behind in their enforcement efforts so truncating or erasing records is a poor option. It s important to understand how various audit trail software options deal with data growth over time. Companies should include long term data management in their auditing software criteria. Reporting Audit trail software really needs to do two things, track data and report on that data. Too often software companies treat reporting as an afterthought, but reporting is absolutely a key element for auditing software. Any audit trail solution needs to provide robust, flexible and easy reporting with standard reports that auditors expect, as well as the ability to deliver on unusual requests. In every industry, there is always standard information required, but in every audit, someone wants something special. This is where flexibility in reporting is a key element. It also provides confidence to auditors when companies can quickly and efficiently deliver on non-standard data requests. As an example, we once had a case where an AP clerk improperly dated and posted AP transactions one hour before the company finalized the year end close. They were faced with a choice of spending several hours fixing it via the interface or changing the data in SQL Server.

9 The solution was to turn on auditing temporarily to capture the effects of the SQL change. This provided the basis for reporting what was done and why, for both the internal and external auditors. Everyone was fine with the solution under the circumstances and the auditors were thrilled the solution could so accurately document and report on what was done, even though the change was made at the SQL level. Flexibility An element that is often overlooked or undervalued when selecting auditing software is the flexibility. Companies often select software just for Dynamics NAV and then realize that there are other systems or custom applications they need to audit. There was a case where a company created a custom built payroll tracking solution that integrated into Dynamics NAV from a completely different server. Since this solution drove both payroll and billing calculations it was critical that it be audited as part of the financial management ecosystem. An audit trail system needs to be able to access the separate database.

10 Auditing software needs the flexibility to adapt to new components introduced into a company including off-the-shelf solutions, customizations or completely custom applications. Additionally, audit trail software should be able track system changes like upgrades, service packs or add on solutions. On a related note, it s important that audit software capture changes at the database level, not just via the interface. Users with database access shouldn t have the ability to make changes that aren t captured by audit trail software.

11 Final Thoughts Vendor Reputation Vendor reputation is the final component of audit trail software selection. It s important to select a company with a strong track record of working with auditors to help design their product, standard setups and reporting. Leading vendors know the types of information that both internal and external auditors need. They can help setup a system to provide that information with minimum work but with the flexibility to adjust to a company s specific needs. Conclusion Audit trail software is important, but it doesn t have to be complicated or difficult to implement. It does need to be effective, meaning that is doesn t slow down the system, is flexible and delivers the reporting that organizations need. There are a number of choices out there for Dynamics NAV and hopefully this guide will help you select the best one for your organization.

12 Get Audit Trail For NAV Fastpath Audit Trail can fulfill your needs for tracking everything you need in NAV and more. Schedule a DEMO