Maximize Your Internal Controls with Project Accounting

Transcription

1 Maximize Your Internal Controls with Project Accounting Cindy Kalkwarf, Costpoint Practice Director WJ Technologies LLC Bhavesh Vadhani, Director Risk Services Watkins Meegan LLC GC-259

2 Objectives TO UNDERSTAND How does IT (information technology) impact business? What are IT controls and the different types? What is the dependence of system application controls on general controls - the risk and reliance factors? What are the key processes in project accounting, their associated risks, and how controls in Costpoint help mitigate the risks? What tools are available to assist in identifying and managing risks and controls? 2 10/17/2012

3 Role of Information Technology Information technology and business are becoming inextricably interwoven. I don't think anybody can talk meaningfully about one without talking about the other. - Bill Gates - Microsoft Founder 3 10/17/2012

4 Common IT Risks Internal and external theft of data Misaligned with business objectives Confidentiality compromised Systems and data availability Data integrity Inaccurate reporting Privacy loss Inappropriate systems reliance Asset protection Loss of productivity 4 10/17/2012

5 Impact On Business Legal and Statutory Sanctions Competitive Disadvantage Inefficient Processes Loss of Stakeholders Confidence Reliance on Inaccurate Data and Systems RISKS are Inherent Obvious Invisible Accumulative Dynamic Global 5 10/17/2012

6 Types of IT Controls IT Controls General Application Preventive Detective Corrective Automated, Manual, IT Dependent Manual 6 10/17/2012

7 IT Controls IT General Controls IT General Controls are controls that span across IT Infrastructure within an organization and are essential to ensuring the confidentiality, integrity, availability, reliability, and quality of the systems and the underlying data. Application Controls Application Controls are either automated or IT-dependent manual controls that relate to the transactions and standing data appertaining to each computer-based application system. 7 10/17/2012

8 IT General Controls Entity Level IT Policies, Procedures, and Standards IT Organizational Chart; Roles and Responsibilities Access to Programs and Data Firewalls, routers, switches, network operating systems, servers and other related devices are used and configured appropriately to prevent unauthorized access Information Security NIST Program Development System Development Life Cycle Methodology 8 10/17/2012

9 IT General Controls (contd.) Program Change Change Management and Configuration Management Procedures Computer Operations Service Level Agreements Job Schedules Data Backup and Recovery Disaster Recovery/Contingency Planning Adequacy of Business Continuity Plan Testing of Disaster Recovery Plan 9 10/17/2012

10 Application Processes & Controls Embedded within software programs to prevent or detect unauthorized transactions Examples of application controls include data input validation, agreement of batch totals, encryption of data transmitted, etc. Ensure F/S assertions Completeness Accuracy Authorization Segregation of Duties 10 10/17/2012

11 Application Controls : Considerations Processes User Procedures Programs and Interfaces Transactions Data Files Environment Where is the application? Where is the data? Where are the transactions entered? Where are the exposures? 11 10/17/2012

12 Application and General Controls - Relationship R I S K S R E L I A N C E 12 10/17/2012

13 Project Accounting Application Transaction Life Cycle Project setup Compute rates, revenue, billing Bills, Project Status reports, burdened costs Origination Preparation & Entry Processing Transmission Recording & Reporting INPUT PROCESS OUTPUT 13 10/17/2012

14 Project Accounting Internal Controls: Getting Started Identify key business processes Identify the risk associated with the processes Identify key internal controls that address the risks 14 10/17/2012

15 Key Business Processes for Project-Based Businesses I. Perform Project Administration and Setup Process II. Manage Project Cost Buildup III. Determine Revenue and Billing 15 10/17/2012

16 I. Project Setup Risks and Controls What happens if? The project structure is not set up adequately Impact? Incorrect billing, revenue, cost management Controls? Use WBS with multiple levels to capture project costs in sufficient detail (Input Control) Restrict charging of costs by controlling whether project level is active and allows charging (Input Control) Restrict charging of costs by WBS element using Project Account Groups (Input Control) 16 10/17/2012

17 A Sample Costpoint Work Breakdown Structure Project Z3000 Define billing level Define revenue level Delivery Order/Phase Z3000.0A3 Z3000.0A4 Define cost collection level Define purpose of task and Task Z3000.0A3.01 Z3000.0A3.02 Z3000.0A4.01 types of acceptable costs Define periods of performance Define customer reporting requirements Define project manager s reporting needs 17 10/17/2012

18 Define Your Charging Rules Active and Allow Charging Project Account Groups Limiting Accounts, Orgs and Account/Orgs Owning Organization, Default to Owning Org CP6; Projects>Project Setup>Project Master> Maintain Project Master 18 10/17/2012 CP7; Projects>Project Setup>Project Master>Manage Project User Flow

19 What Is a Project Account Group? A Project Account Group is a set of accounts that can be used by a given project or projects Within each Project Account Group (PAG), you must select a function code for each account that tells Costpoint how the account will be used for the selected project. It is powerful! It helps prevent mischarging It points the revenue earned to the right revenue account It points the bills to the right A/R account It defines what is allowable and unallowable for the project 19 10/17/2012

20 How Do I Use Project Account Groups? Selecting the right PAG Which PAG is right for my project? Keep a list of what each PAG is designed to do Using PAGs to restrict accounts Can restrict charging to certain accounts Each task can have a different PAG Can help define indirect projects Can be used to restrict projects to labor only/material only Can be used to repurpose accounts 20 10/17/2012

21 What Are Account Function Codes? Why Do I Care? Function Codes tell Costpoint what accounts to charge and how to process certain types of data. There are 18 function codes, most common are: Revenue: What revenue account is used for the project when revenue is computed Unbilled: Account used by project to offset revenue and billing Billed A/R: Accounts receivable account for project when bills are posted or cash is received against a project Labor: Tells Costpoint to keep track of project hours. Critical for T&M; segregates cost in its own section on PSR Non Labor: Segregates cost in its own section on PSR Unallowable Labor: The only place that tells Costpoint that labor hours and cost are unallowable Unallowable Non Labor: The only place in Costpoint that tells Costpoint that a cost is unallowable 21 10/17/2012

22 I. Project Setup Risks and Controls (cont) What happens if? Access to accounting system is not adequately protected Impact? Incorrect or missing billing and revenue Potential for fraud Controls? Leverage the Segregation of Duties functionality Access to individual modules and functions can be restricted to individual users based on management authorization (General and Application Control) 22 10/17/2012

23 Segregation of Duties Segregation of Duties capabilities, with pro-active identification of violations and conflicts, as well as automated enforcement of internal controls CP7: Administration>Security>Segregation of Duties 23 10/17/2012

24 Segregation of Duties Configuration CP7: Administration > System Administrator > System Administrator Controls > Configure System Settings When the above box is checked, the system reviews user and user group rights before they become effective. If not checked, the system still examines user and user group rights for conflicts and produces a report listing conflicts, but won t disable user and user group rights /17/2012

25 Enhanced Security in Costpoint 7 Enhanced User Authentication: Single Sign On Active Directory Client Certificate Enhanced Authorization: Role-based security model which enables assignment of read, update, insert, and delete rights at the process and result set level 25 10/17/2012

26 User Security Hierarchy of Security Settings for Users Maintain Users (SYMUSR) [W_USER_UGRP_LIST, filter on TYPE = U] User Company Access [W_USER_COMPANY] Assign Groups to User [W_USER_GRP_USERS] Web Module Rights [W_MODULE_RIGHTS] Web Application Rights by Module [W_APP_RIGHTS] Result Set Rights by Application [W_RS_RIGHTS] Action Rights by Result Set [W_ACTION_RIGHTS] Report Rights by Result Set [W_RPT_RIGHTS] 26 10/17/2012

27 User Group Security Hierarchy of Security Settings for Users Maintain User Groups (SYMGRP) [W_USER_UGRP_LIST, filter on TYPE = G] Assign Users to Group [W_USER_GRP_USERS] Web Module Rights [W_MODULE_RIGHTS] Web Application Rights by Module [W_APP_RIGHTS] Result Set Rights by Application [W_RS_RIGHTS] Action Rights by Result Set [W_ACTION_RIGHTS] Report Rights by Result Set [W_RPT_RIGHTS] 27 10/17/2012

28 What happens if? II. Project Cost Buildup Risks and Controls Supplier invoices are not timely captured into a project's cost accounts Impact? Incorrect billing and revenue, uncollectible receivables, inaccurate project reporting Controls? All invoices are received and processed at a centralized accounts payable department (Manual Business Process Control) Costing information is automatically transferred from Purchasing to Vouchering to Billing (Input and Process Control) Monitor future financial obligations by project via Compute Purchasing Commitments (Output Control) Develop a system exception report to identify timing delays between data entry date and invoice date. Investigate timing delays (Output Control) Give warning for costs charged outside period of performance (Processing Control) 28 10/17/2012

29 II. Project Cost Buildup Risks and Controls (cont d) What happens if? All billable hours may not be accurately captured and allocated Impact? Incorrect billing and revenue, uncollectible receivables, inaccurate project reporting Controls? Use Project workforce and vendor workforce to ensure that only authorized workers can charge to specific projects (Input Control) Set up default billable labor categories for each person working on the project (Input Control) Utilize project budgets by labor category and compare actuals to budget (Output Control) Ensure that the Project Manager reviews bills for accuracy (Manual Business Process) 29 10/17/2012

30 Project Workforce CP6: Projects> Project Setup> Project Master> Maintain Project Master 30 10/17/2012 CP7: Projects>Project Setup>Project Master>Manage Project User Flow

31 What happens if? II. Project Cost Buildup Risks and Controls (cont) Indirect rates are not appropriately allocated to projects Impact? Lost indirect cost funding, incorrect billing and revenue, uncollectible receivables, inaccurate project reporting Controls? Set up pool structure to automatically apply indirect costs to projects based on both provisional and actual rates (Input Control) Reconcile the Statement of Indirects to the General Ledger as part of your month end close process (Output Control) 31 10/17/2012

32 III. Revenue and Billing Risks and Controls What happens if? Revenue and billing may be inaccurately computed Impact? Incorrect billing and revenue, uncollectible receivables, inaccurate project reporting Controls? Use the predefined revenue and billing formulas to automatically compute (Process Control) Make corrections to the underlying transactions using the original transaction entry source, e.g., Timesheets and A/P vouchers, not through Journal Entries or Revenue Adjustments (Business Process Control) 32 10/17/2012

33 Intro to Types of Revenue and Billing Formulas Transaction-based formulas calculate revenue and billing based on hours and/or costs charged to the project Examples: Time & Materials, Cost Plus Non-transaction based formulas require the user to enter data to record the revenue and billing. Examples: EAC, Fixed Amount, Scheduled Billings 33 10/17/2012

34 How Does a Cost Type Formula Work? Applies a fee % to allowable costs to arrive at revenue or billing Allowable costs Compares costs incurred to costs ceilings to arrive at allowable costs Fees Fees entered in Basic Revenue Info and Billing Info screen. Fee overrides and ceilings may be set Multiplies the fee % from the revenue /billing formula by allowable costs to determine the fee amount Revenue and billing Adds allowable fee to allowable direct costs to arrive at a current period revenue/billing amount Ceilings are applied based on ceiling rules 34 10/17/2012

35 How Does a Loaded Labor (T&M) Formula Work? Multiplies allowable hours worked by a rate plus applies a fee % to allowable costs to arrive at revenue or billing Allowable Hours worked Hours charged by an employee or contractor to the project, to an account with the Function Code of Labor, and to a project labor category (PLC) Compares hours incurred to ceilings to arrive at allowable hours Ceilings are set by employee, vender, and by labor category Rate Rates are identified for each Project Labor Category Allowable costs and fees Same logic as for Cost Type formulas 35 10/17/2012

36 Setting up Revenue and Billing Formulas in CP6 26 Revenue formulas 15 Billing formulas CP6: Projects>Billing>Billing Master>Project Billing Info CP6: Projects>Project Setup>Revenue Setup>Basic Revenue Info 36 10/17/2012

37 Setting up Revenue and Billing Formulas in CP7 26 Revenue formulas 15 Billing formulas CP7: Projects>Billing>Billing Master>Manage Project Billing Info CP7: Projects>Project Setup>Revenue>Manage Revenue Info 37 10/17/2012

38 III. Revenue and Billing Risks and Controls (con t) What happens if? Revenue may be computed in excess of funding/contractual amount Impact? Incorrect billing and revenue, uncollectible receivables, inaccurate project reporting Controls? Use Total Ceilings for Project Setup to prevent revenue and/or billings in excess of funding (Process Control) Use other types of ceilings to meet contract requirements: Direct cost, Burden, Direct Hours, Employee, Vendor (Process Control) Use Cost Fee and Burden Fee Overrides to meet contract requirements (Process Control) 38 10/17/2012

39 What Are Ceilings & Overrides? Costpoint provides for two different types of controls for restricting the amount of cost, hours and/or fee charged for revenue and billings A ceiling caps the amount of costs, fees or hours on a project. Ceilings can be applied at the summary level of a project, or against detail levels or even accounts Overrides are used to change the rates charged on a project on the pools or the percentage charged as fee on a given account, such as not charging fee on travel where other costs have fee Note that ceilings do not prevent costs from being charged 39 10/17/2012

40 Types of Ceilings Total ceilings: imposed on the entire project rather than on the individual elements. Direct cost ceilings: imposed for any level of an account that is used to calculate revenue and billings Burden ceilings: imposed for project/account/pool combinations, which are used to calculate revenue and billing. Hours ceilings: imposed on the number of hours that are used to calculation revenue and billings Can be applied to PLC,s individual employees or vendors CP7:Projects>Project Setup>Project Ceilings CP6:Projects>Project Setup>Project Ceilings 40 10/17/2012

41 How Do I Use Overrides? Cost Fee Override: Use to set an override fee percent on each of the elements of direct cost for the project Burden Fee Override: Use to set an override fee percent on each of the indirect cost pools applicable to the project The system uses these override fee percents in place of the percent entered on the main Basic Revenue Info screen when computing revenue and billings CP6:Projects>Project Setup>Project Master CP7:Projects>Project Setup>Project Ceilings 41 10/17/2012

42 Tools to Identify and Manage Risks and Controls Deltek Controls & Reporting Solution for Costpoint AppGRC for Costpoint 42 10/17/2012

43 Deltek Controls & Reporting Solution for Costpoint Deployed in Costpoint Enterprise Reporting (CER) Control Elements Matrix Over 600 system Control Elements Detailed listing by module of Control Elements in a series of Microsoft Excel workbooks Control Reporting Over 100 reports in Cognos to determine which Costpoint controls you have activated Catalog that defines all tables containing control information Sample of each report in Adobe Acrobat pdf format Macro written using Cognos Script Editor to run all reports at once and save in PDF format Accounting G/L A/P A/R Fixed Assets Projects Project Setup Cost and Revenue Processing Billing People Employee Labor Payroll Materials Purchasing Other System Admin Transaction Entry Time Collection 43 10/17/2012

44 Deltek Controls & Reporting Solution: ICEM* Sample Project Setup ICEM: Project Master Screen Function CE R O P D Im pact PROJECT SETTINGS Validate Project/Org Yes No Yes Yes No All Transaction Entry PROJECT SETTINGS Show POP Warning message Yes No Yes Yes No All Transaction Entry PROJECT SETTINGS T&M Rate Sequence Search Yes No Yes Yes No Revenue Calculation PROJECT SETTINGS Allow Revenue Exceed Yes No Yes Yes No Select no to control revenue calc PROJECT SETTINGS Revenue Formulas Yes No Yes Yes No Revenue Calculation PROJECT ACCOUNT Project Accounts Yes Yes No Yes No All Transaction Entry GROUPS BASIC INFO Project Yes Yes No Yes No All Transaction Entry BASIC INFO Billable Project Yes Yes No Yes No Revenue Setup, Billing Setup BASIC INFO Project Classification Yes Yes No Yes No Project Cost, Project Reporting BASIC INFO Active Yes Yes No Yes No All Transaction Entry BASIC INFO Allow Charging Yes Yes No Yes No All Transaction Entry BASIC INFO Account Group Yes Yes No Yes No All Transaction Entry BASIC INFO Owning Org Yes Yes Yes Yes No Revenue Posting BASIC INFO Proj Work Force Required Yes No Yes Yes No Labor Charging CE: Control Element R: Required P: Preventive O: Optional D: Detective * Internal Control Element Matrix 44 10/17/2012

45 45 10/17/2012 Deltek Controls & Reporting Solution: Sample Report

46 AppGRC for Costpoint Dramatically reduces the cost of auditing and compliance through automating key processes and controls and continuously monitor these controls against all application activity FAST. Pre-configured solutions, designed by GRC experts, fast-track implementation and produces quick results CONTINUOUS. 24x7 monitoring proves nothing happened with before and after values, not snap-shot monitoring SIMPLE. Robust reports that document all activity with a comprehensive audit trail for LOB managers LUMIGENT AppGRC Reports detail history of all changes to controls including baseline deviation (before & after values) 46 10/17/2012 Lumigent Company Confidential

47 AppGRC Provides Key Business Controls Example: Monitoring of Check Approval Limit Key Business Control Check Approval Limit Application ensures that the required approval is obtained for checks greater than a defined amount Control Source A/P module settings Check approval limit amount Automated, Preventive Control AppGRC for Costpoint Rule Definition CP Master:AC_AP:A/P Settings Continuous Monitoring 47 10/17/2012

48 Key Business Control Check Approval Limit Deltek Costpoint 48 10/17/2012

49 AppGRC Baseline Report Lumigent AppGRC TM With continuous monitoring, AppGRC limits the scope of expensive testing to only the controls that have changed since baseline was established /17/2012

50 50 10/17/2012 AppGRC Audit Reports

51 Call to Action For more information, feel free to call or us Bhavesh Vadhani, CISA, CGEIT Risk Services Group Cindy Kalkwarf Costpoint Practice Director Please stop by our booth in the Exhibit Hall 51 10/17/2012

52 Thank You!