2. Notes accompany this presentation. Please select Notes Page view. These materials can be reproduced only with written approval from Gartner. Such approvals must be requested via e-mail: vendor.relations@gartner.com. Gartner is a registered trademark of Gartner, Inc. or its affiliates. Continuous Controls Monitoring for ERP and Financial Systems French Caldwell

3. Manual vs. Automated Controls Manual Controls Mostly detective Invasive, with little direct business benefit Focus on what's visible Automated Controls Mostly preventive Continuous, with direct performance benefits Often inherent in the system

4. Key Issues 1. What are the drivers for automating financial controls? 2. What does CCM do, and who are the vendors? 3. What are the best practices for implementation?

5. Key Issues 1. What are the drivers for automating financial controls? 2. What does CCM do, and who are the vendors? 3. What are the best practices for implementation?

6. GRC Solutions Comparison Model ITFinance Operations Controls Legal Management IT GRCM EH&S IT Controls Operations Controls Vendors Enterprise GRC Platform Operational Risk Mgt Corporate Governance Legal Controls Finance Controls Risk Management Governance

7. CCM Drivers: Continuous Audit and Continuous Monitoring Internal Audit — Do the audit: -Work paper management -Task scheduling and management -Remediation tracking -Complex analysis CFO — Reduce the cost and impact of the audit: -Responding to auditors -Remediate deficiencies -Reporting -Reduce impact of audit on other business priorities

8. Regulations Are Encouraging Automation Two Priorities: Skyrocketing Audit Costs Management's Antifraud Controls

9. And There Are Business Performance Drivers, Too Reduce fraud and other transaction cash leaks Improve availability of working capital

10. Key Issues 1. What are the drivers for automating financial controls? 2. What does CCM do, and who are the vendors? 3. What are the best practices for implementation?

11. Continuous Controls Monitoring Applied to… Master Data Data Accuracy and Permissions Audit Trail Application Configuration Presence and Config. of Controls Transactions Working Capital Financial Governance Segregation of Duties Antifraud PII

12. Accounts Payable Example of CCM Vendor P.O. Receipt Invoice Payment AP Process Duplicate Payments Duplicate Vendor Records Duplicate Invoices Payment Terms Three-Way Match Requisition Segregation-of- Duties Conflict Alert If Settings Changed CCM-Master Data CCM-App ConfigCCM-SoDCCM-Transactions

13. Continuous Controls Monitoring (CCM) Vendors VendorSegregation of Duties Transactional Controls Monitoring ACL Services Approva BWise Greenlight Technologies Infogix Oracle Oversight Systems Runbook Company International SAP Security Weaver SymSure

14. Key Issues 1. What are the drivers for automating financial controls? 2. What does CCM do, and who are the vendors? 3. What are the best practices for implementation?

15. Value on Investment (VOI) for CCM Improve Important Business Processes Management Value Lower Audit Costs Improve Antifraud and Other Controls Audit Value b Performance Risk Management Compliance External Auditor Trust in Internal Audit Work Reduce Manual Sampling ID and Correct Problems Before Performance Impact Value Strategic Business Initiatives Cross-Enterprise Initiatives Like ERM or Multiregulatory Compliance Response to Individual Mandates

16. Identify Key Controls "Control objectives that overlap reasonably anticipated risks indicate key controls that should have higher priority" CO Standard of Due Care RAR Governance Risk Assessment Control Objectives Reasonably Anticipated Risks Key Controls

17. CCM-T Selection Guidelines ERP Compatibility – Compatible "out of the box"? Controls Library Coverage – Controls for your risks? Business Rules and Analytics – Ability to model, simulate and build own controls? False positives? Remediation Workflow – Automated detection and remediation processes? Cross-Platform and Multiplatform Application Support – Integration in Heterogeneous environment? Integration with EGRC Platform – How easily does it integrate with your EGRC platform? Continuous Audit Support – Does your external auditor use the vendor for audit analytics? CCM vs. BAM – Is customization so great you would be just as well off using a BAM vendor?

18. CCM Implementation Guidance The problem is 80/20 Business/IT: -The solution is 50/50 Find money fast: -Duplicate payments; payment cards Extraction schedule: -Quarterly for audit -Daily for continuous monitoring Resolution workflow: -Problems found later in the process are more expensive -Repeatable, predictable, consistent process for the resolution of exceptions. Tuning: -Don't implement everything out of the box. -Develop custom analytics for your organization. -Choose integrity checks that are meaningful to the business.

19. Recommendations Align the needs of internal auditors and financial managers. -Reducing audit time and resources -Bringing more value of audit to the business -Stopping cash leaks and improving working capital Consider CCM if: -Lowering compliance and audit costs while improving access and antifraud controls -Improving assurance of ERP control configurations -Improving financial governance and control reliability -Improving operational performance, including the working capital, through enforcement of business rules Take a risk-based approach to implementation: -Determine business value -Scope to key controls -Evaluate vendor capabilities -Close the loop with your internal and external auditors