The document discusses risk management strategies for moving from on-premise to cloud environments. It summarizes technologies like a Risk Management Cloud service that can streamline internal control assessments and automate tasks for external certifications. It also discusses on-premise options like a Smart Segregation of Duties tool embedded within PeopleSoft that can perform proactive and detective segregation of duties scanning with interactive reports and dashboards. The presentation aims to help organizations manage controls and risks within their ERP systems more effectively.

1. RISK MANAGEMENT FROM ON PREMISE TO
THE CLOUD – A FOCUS ON CONTROLS
03/01/2017

2. PRESENTERS
Lewis Hopkins
Snr Applications Consultant
Smart ERP Solutions
Lewis.Hopkins@smarterp.com
Security and Risk Management since 2003.
Board member – OAUG GRC Customer Group.

3. AGENDA
• About Smart ERP Solutions, Inc.
• Review of Risks
• Technologies
• Q&A

4. ABOUT
SMART ERP SOLUTIONS, INC
Innovative solutions and
services to automate,
streamline and simplify ERP
applications.
Achieve Best-In-Class Performance
Our mission is to provide innovative, configurable, flexible, cost-effective solutions
to common business challenges, enabling our clients to save time,
increase productivity, minimize costs, and maximize their return on investment.
Solutions
Business applications that
offer organizations an end-
to-end solution providing the
right design and
implementation from start to
finish.
Services
A 24/7 seasoned and
experienced staff of
experts to help you
implement your business
solutions efficiently and
effectively at a cost-
effective rate.
Cloud
Cloud applications provide
solutions built on proven
enterprise class architecture
that enable high
configurability and ease of
monitoring.

5. SMARTERP & ORACLE
Embracing Partnerships
with Oracle / PeopleSoft
and Our Clients

6. CURRENT RISKS
Finance
Student Finance
HR

7. US Fraud averages $150,000, 22% exceed $1m
The average time to finding Fraudulent activity is
18 months
41% of Fraud committed Internally – KPMG Securing the ERP
2016
See: http://www.fraudweek.com/uploadedFiles/Fraudweek/content/documents/cost-of-
complacency.pdf
SECURITY AND FRAUD

8. THE IMPACT OF TIME
$75k loss at <7 months $150k at 19 months $965k at 61 months +
0
200000
400000
600000
800000
1000000
1200000
7 19 61
Loss in $
Time: 7 to 61 months
Loss over Time

9. PROACTIVE VS REACTIVE MEASURES
“PROACTIVE MEASURES catch fraud
sooner and minimize losses. Frauds that
are caught by reactive measures last
longer and cause more harm.”
Surveillance / Monitoring, IT
Controls:
$59k
Tip or Confession:
$184k
Notification by Law Enforcement:
$1.25m

10. GRAMM-LEACH-BLILEY ACT & THE
DEPARTMENT FOR HIGHER EDUCATION
GLBA requires institutions to ensure, among other things:
• Develop, implement, and maintain a written information security program.
• Designate the employee(s) responsible for coordinating the program.
• Identify and assess risks to student information.
• Design and implement an information safeguards program.
• Select appropriate service providers that are capable of maintaining
appropriate safeguards.
• Periodically evaluate and update the security program.
ED plans to incorporate the GLBA security controls into the Annual Audit Guide
and will look at GLBA compliance as part of institutions' annual student aid
compliance audits.

11. NIST 800-17, OMB UNIFORM GUIDANCE
AND MORE…
Designed to build a SOX like framework for non Federal Organizations
sharing Federal Data. Controls include:
• Access Controls
• Security Assessment
• Risk Assessment
http://www.nacubo.org/Business_and_Policy_Areas/Student_Financial_S
ervices/Student_Financial_Services_News/ED_Reminds_Schools_about_Pr
otecting_Student_Information.html
https://library.educause.edu/~/media/files/library/2016/4/nist800.pd
f

12. MANAGING CONTROLS AND RISKS IN ERP
1
No Segregation of
Duties out of the
box
2
Difficult to answer
who has access to
what
3
Reports in ERP
technically
orientated
4
No way to document
Risks and Controls
‘inside ERP’

13. Today we use spreadsheets, but with
spreadsheets….
 No workflow
 No audit trail
 Difficult to create attachments
 Purely acts a data store, cannot take actions within spreadsheets
 No segregation of duties or data
 Too much effort to manage users and get them to carry out their tasks
 If someone did something they were not supposed to do, we have to
manually track and fix it
 Difficult to track progress of actions
 Too much effort to provide executive snapshot
Financial Controller
Vision Corp
MANAGING CONTROLS AND RISKS
OUTSIDE OF ERP

14. TECHNOLOGIES Cloud

15. FINANCIAL RISK CLOUD
Risk Management Cloud service that:
 Streamlines internal control assessments
 Automates labor-intensive tasks required to complete external
certifications for SOX/NIST or similar legislation

16. BENEFITS
• Replace Spreadsheets
• Does not depend on the ERP Platform, no integration
• Detail Risks and their impact
• Provide workflow approval for process owners

17. • Sample Risks:
• “Potential fraud may occur in payroll due to inappropriate access and
transactions”
• “Changes to master data information that is not authorized or incorrectly
entered which causes errors to sales, credit, or payment related
transactions.”

18. • Sample Controls:
• “Ensure SoD within payroll functions”
• “Review changes to master data information, including change owner”

19. Assessments distribute tasks to process owners along with the Test Plan.
Instructions included:

20. Issues are raised
Status of Issue recorded

21. Risk Reports help identify Controls that have issues
or failures to help assess the Organization’s overall Risk
Management position.

22. TECHNOLOGIES On Premises

23. SMART SEGREGATION OF DUTIES
Embedded within
PeopleSoft
•Detective and Proactive SoD
scanning
•Interactive Reports and
Dashboards
•Mitigations/Exceptions
•Rules stored in PeopleSoft
•Read Only

24. ABILITIES
•Abilities contain the Security required to
perform a task or duty

25. RULES
Ability 1 – Create
Vendor
Component 1 OR
Component 2 OR
Component 3 OR
Component 4 OR
Ability 2 – Approve
Vendor
Component 1 OR
Component 2 OR
Component 3 OR
Component 4 OR
AND
Rule: Create Vendor
& Approve vendor

26. STRUCTURED REPORTING

27. STRUCTURED REPORTING
Ability 1 – Create
Vendor
Component 1 OR
Component 2 OR
Component 3 OR
Component 4 OR
A: “Should we have 200 Users who can Create a
Vendor?”
B: “There should only be 5 people who can do this!”

28. SUMMARY
Risk Management Cloud

29. PRESENTERS
Lewis Hopkins
Snr Applications Consultant
Smart ERP Solutions
Lewis.Hopkins@smarterp.com
Security and Risk Management since 2003.
Board member – OAUG GRC Customer Group

30. THANK YOU!