The Next Level of Controls Automation: How you can fully automate controls testing in financial systems by combining MetricStream and IRC

Transcription

1 The Next Level of Controls Automation: How you can fully automate controls testing in financial systems by combining MetricStream and IRC Christina Spies, Infor, Account Executive Infor Risk and Compliance (IRC)

2 G R C

3

4 The World of Integrated GRC: At a Glance Infor M7 Continuous Controls Monitoring Exception Reporting Risk Management Compliance Management Audit Management

5 Risk, Policies, Rules, Controls..and Exceptions!

6 Why combine IRC with MetricStream? Infor Risk and Compliance: Takes controls automation to the next level Provides fully automated assessments for risks and controls exceptions within financial systems Tests 100% of the data within financial systems Monitors different types of controls Risk-related Policy-related Compliance-related Performance-related IRC monitors controls 24/7 and feeds exception reports to MetricStream, dashboards, alerts, reports, notifications, further workflow and analysis, etc.

7 Infor Risk & Compliance IRC is a Continuous Controls Monitoring Solution. It automatically tests controls in financial systems. SEGREGATION OF DUTIES Preventive REMEDIATE VIOLATIONS Assign, Monitor, Close TRANSACTION MONITORING Detective SYSTEM AGNOSTIC Oracle EBS, PSFT, SAP, JDE, CGI Momentum, LN/Baan, Infor Lawson, Homegrown, Legacy CONFIGURATION AND VENDOR CHANGES Detective DESIGNED BY AUDITORS Streamline control testing, provide complete audit trail, document Risk / Control Matrix QUARTERLY ATTESTATION Certification AUTOMATED POLICY ENFORCEMENT OMB A-123, S/OX, FIAR, Improper Payments, CFO Act

8 IRC Controls Layers

9 Lifecycle of a Risk Detection and Mitigation Example by Nick Youngson CC BY-SA 3.0 Alpha Stock Images

10 Risks in MetricStream are automatically assessed by IRC Company A has a risk of inappropriate payment to a contractor. This is tied to a control, or a rule in IRC. IRC monitors these sets of rules and flags any exceptions.

11 IRC monitors rules 24/7 and flags any exceptions. In this case, an employee has created a vendor and also processed a payment to that vendor for $131,834.00

12 When drilling into the exception, IRC provides additional details about the transaction and why it violated the rule. At the click of a button, IRC will take the user to the record in the financial system for further investigation.

13 IRC also reports on the underlying SoD issue.

14 IRC reports on the details of what is causing the SoD.

15 The SoD violation can be mitigated within IRC, right there and then.

16

17 IRC Exceptions are fed back to MetricStream for further analysis Reporting, Risk Assessments, Trends, Policy Gaps, Training Gaps The next time Bob does a risk assessment in MetricStream, he can see all the IRC exceptions Albertson and others have triggered; further informing the inherent and residual risk. Albertson s team on average has 12 exceptions a month, while the average of other groups is 1 to 2!

18 Leveraging M7 & IRC Intelligence Across GRC Functions IRC and MetricStream M7 analytics can be leveraged to streamline and enhance your business intelligence in compliance, risk, audit, IT, third party risk, and across all other GRC functions

19 This insight leads to broader corrective actions or mitigation plans

20 The World of Integrated GRC: Summary Infor M7 Provides access control and transaction monitoring for financial controls Leverages an OOTB rules engine for monitoring Analyzes 100% of relevant data in financial systems Reduces cost of audits through continuous monitoring Information pulled from IRC can provide additional insight into policy or governance gaps Based on analysis new rules or recommendations can be fed back to IRC Programmatic action plans and change management

21 About Infor

22 Infor at a glance 90,000 customers 15,000 employees 41 offices around the world Customers in 170 countries 66 million cloud users $2B investment in product design and development over the past five years Global headquarters - New York City

23 Specialized by industry 19 of top 20 aerospace companies 84 of top 100 auto suppliers 10 of top 10 pharmaceutical companies 31 of top 50 industrial distributors industrial machinery manufacturers 26 of the top 35 largest global retailers E A M 5 of the top 10 brewers 23 of the top 50 largest public US hospitals 12 of the top 13 high tech companies 90% of the Las Vegas strip use our hospitality solutions More than 5,500 industrial manufacturing customers Infor has differentiated itself by building industry-specific functionality into vertical applications reducing the need for costly customizations. Panorama Consulting Solutions More than 200 Federal Agencies & Organizations

24 Infor Federal Solutions Core Components of Industry Offering Financial Management General Ledger Consolidations Allocations Eliminations Accounts Payable, Accounts Receivable Asset & Expense Management Project & Cost Accounting Financial Statement Production Enterprise Performance Management Dashboards Business Intelligence Financial Reporting Planning & Budgeting Workforce Planning & Analysis Analytics E A M Enterprise Risk Management Access Management Continuous monitoring Segregation of Duties Certification Management Audit readiness for OMB A- 123 and FIAR Configuration & Process insight Insider threat detection, reporting, and mitigation Licensing and Permitting Building Permits Development Permits Use Permits Business Licenses Trade Licenses Code Enforcement Workflow Process & Document Tracking (e.g. Inspections) Human Capital Management Human Resource Management Talent Management HR Service Delivery Talent Science Workforce Management Learning Management Payroll Benefits Management Contact center Work orders Labor and Expense Management Scheduling and dispatch Preventative maintenance Service contracts Loaners and Rentals Service History Analytics Service Management Asset Management Property Management Real Property Personal Property Fleet Management Work Order Management Linear Assets Facilities Management Reliability/Sustainability Energy Management Calibration Enterprise Asset Management Technology Interoperability Business systems/data Clinical systems/data Collaboration Development Framework Microsoft Office Integration Application Event System Document Management Mobility Sourcing & Procurement Inventory Management Shipping/Receiving Master Item Data Bills of Materials Multi-Site Supplier Portal MRO, MRP & MPS Scheduling Logistics/ Supply Chain Management Contract Lifecycle Management Contract Definition Standard Forms, Terms & Conditions Solicitation Management Contract Management Document Automation Analytics Integration

25 Infor Risk and Compliance (Approva) Global Customers Public Sector Manufacturing, Transportation & Professional Services Energy & Utilities Healthcare, Pharmaceutical & Biotech Technology, Telecom, Media & Entertainment Consumer & Retail Entertainment E A M Copyright 2014 Infor. All rights reserved. 25

26 Questions?

27 Contact Information: Christina Spies

28 Thank You Continue the conversation on #GRCSummit

29 SOD Violation - IRC Data Source When SOD rules are broken, they trigger violations by count and priority