1. Continuous Monitoring and Gaining External Audit Reliance

2. The Opportunity Post SOX organizations are inclined to establish key groups to govern risk and measure compliance across the company, who with the external auditor form an interdependent compliance community: Assess risk Assure internal controls Committed to operational excellence, solid metrics for measuring the process and continuous improvement. We believe that with some additional focus and prioritization, that these organizations can move to a continuous monitoring approach and create a better control environment with much less investment and expense than today’s environment. Continuous Monitoring will allow for far fewer audits and more risk coverage.

3. The Approach Build toward a common compliance strategy Model and measure in aligned segments Link monitoring activity to assertions and objectives Use audit engagements to determine specifications Collect persuasive detail through the monitoring applications Establish a solid methodology to accompany the metrics to reach a conclusion

4. Continuous Control Monitoring Tools and Methodology Accepted Assurance Frameworks Model and Measure in Aligned Segments Compliance Community Configurable Controls Exception Data Transaction Processing Financial Process RisksApplication Risks GAIT Principles Change Management Security Availability IT Operations Risks ITIL Processes Release & Config Mgt Identity Management Incident Management

5. Accuracy Authorization Completeness Control Objectives Financial Processes Applications & Databases GAIT Principles Change Management Security Operations Operating Systems ITIL Processes Release & Config Identity Incident Handling Link Monitoring Activity to Assertions and Management Objectives Assertion : Valuation / Measurement Assertion: Existence / Occurrence Assertion : Completeness

7. SAP_ALL Comparison Across Similar Applications (June 2008 – Sept 2008) Investigate

8. SAP_ALL Comparison Across Similar Applications (June 2008 – Sept 2008) Investigate

9. SAP_ALL Details for APL – September 2008