Agenda  Sarbanes Oxley Act  Where to Begin  Creating the Risk Library  Assessments / Audits  Signing Officer  Business Process Owners  Documenting Procedures  Q & A

Sarbanes-Oxley Act A Response to the Deterioration in Public Confidence

Sarbanes Oxley Act Highlights  Section 103: Your auditor must (and therefore, you should) maintain all audit-related records, including electronic ones, for seven years. Effective now.  Section 201: Firms that audit your company’s books can no longer provide you with IT- related services. Effective now.  Section 301: You must provide systems or procedures that let whistle-blowers communicate confidentially with company’s audit committee. No effective date.  Section 302: Your CEO and CFO must sign statements verifying the completeness and accuracy of financials reports. Effective now.  Section 404: CEO’s, CFO’s and outside auditors must attest to the effectiveness of internal controls for financial reporting. Effective now.  Section 409: Companies must report material changes in their financial conditions “on a rapid and current basis.” The act calls it “real-time disclosure” but doesn’t define what that means. No date set. Computerworld, April 14, 2003

You must ensure internal controls over your financial reporting. Sections 302 and 404 of Sarbanes Oxley The Act states…

You must be able to attest to…  The Processes affecting values in accounts,  which are exposed to Risks,  which are mitigated by Controls,  which are verified by Audit Procedures.

Internal Control Testing Where to Start

Setting Up Internal Controls Review and Update Procedures -Business Process Owners Identify and Organize Processes -Internal Audit/Risk Assurance Partner Identify Risks & Controls for Processes -Internal Audit/Risk Assurance Partner Create Risks & Controls Library -Risk Assurance Partner Upload Risks & Controls Library -Risk Assurance Partner Identify Controls within your system -Internal Audit/Risk Assurance Partner Link Risks to Controls -Internal Audit/Risk Assurance Partner Link Key Controls to Audit Procedures -Internal Audit/Risk Assurance Partner Link Processes to Key Accounts -Internal Audit/Risk Assurance Partner

Risk & Control Library DEMO

Testing Internal Controls Begin Assessment Process -CFO Create Surveys -Internal Audit Distribute Surveys -Internal Audit Review Survey Results -Internal Audit Create Assessment and Link Survey to Assessment -Internal Audit Based on Results, Choose Where to Audit -Internal Audit Execute Audit Procedures -Internal Audit Review Processes, Risks & Controls -Internal Audit Make Recommendations & Issue Audit Opinions -Internal Audit

Assessment / Audit DEMO

Signing Officer DEMO

Business Process Owner DEMO

You must ensure internal controls over your financial reporting. Sections 302 and 404 of Sarbanes Oxley The Act states…

You must be able to attest to…  The Processes affecting values in accounts,  which are exposed to Risks,  which are mitigated by Controls,  which are verified by Audit Procedures.

ICM / Tutor Business Process Risks Controls TUTOR

Do You Want to:  Comply with Corporate Governance regulations by having documented business policies and procedures?  Achieve success through user acceptance of business process and technology changes?  Reduce time spent documenting implementation decisions?  Easily create and maintain all documentation and training material?  Reduce training costs (development, travel, time away)?  Regularly deploy role specific, accurate, up-to-date, procedure manuals?  Modify Oracle eBusiness Suite online help?  Provide employees documentation on an as needed basis; improve employee performance?  Train employees based on their role in the organization?  Manage change within the organization?  Leverage documentation and training resources across the organization?

Oracle Tutor - How it works Tutor Tools AUTHORAUTHOR PUBLISHERPUBLISHER Apps Help Printed/PDF Student & Instructor Guides Online Help & Reference Materials Online and Printed Desk Manuals Owners Manuals and Reports Content Repository Procedure Documents (MS-Word) Online Help Courseware (MS-PowerPoint) Methodology

Tutor Demo Let’s Take a Closer Look

Customer’s:  Uses –US Department of TransportationUS Department of Transportation –University of VirginiaUniversity of Virginia –US Army Corps of EngineersUS Army Corps of Engineers –San Francisco State UniversitySan Francisco State University  Testimony –MedelaMedela  Articles –MotorolaMotorola –ETECETEC

ICM / Tutor Business Process Risks Controls TUTOR

Oracle Tutor  Mature Product  Pre-built business process –Arthur Andersen Study  10 – 12 man hr’s create a procedure  man hr’s to modify an existing procedure man hr’s time savings per process  Integration  Update to Procedure, automatically updates all other procedures that reference it  Not just for Process Documentation

Why Oracle?  Our solution addresses all needs, not just documentation of processes or entering testing results  Uses the business processes that you create or can be modeled from the applications  Leverage your existing information and environment, especially in your GL which directly relates to your financial reporting  Uses powerful Workflow engine to enforce controls and automate what can be automated (reminders, notifications, etc)  Tutor offers delivered content for documentation, desk manuals, and training materials

You must ensure internal controls over your financial reporting. Sections 302 and 404 of Sarbanes Oxley The Act states…

Q & A

Audit Projects

Audit Scope

Audit Tasks

Controls that are being audited

Risks that are being audited

Findings

Certification Status

Certification tied to Financial items

Business Process Owner View

Business Process View-issues