The document describes logITmatix's Internal Controls and Audit Management System (ICAM). ICAM is a database-driven system that provides a single login portal for legal and compliance functions across an enterprise. It allows for centralized control and audit management, issue tracking, and reporting. ICAM integrates internal controls, ensures segregation of duties, and supports a three lines of defense risk governance model. The system provides efficiencies over document-based systems and helps companies comply with increasing regulatory requirements.

1. logITmatix Our Vision of a Future Landscape
Internal Controls and Audit Management System
Legal & Compliance Portal
Legal & Compliance Portal
Control Audit Cross Border Incident External
Management Management Travel Mgmt Management Mandates
Control Definition Audit/Review Management Client related Regulatory Public Directorships
Task Assignment Findings Management Non-Client related Financial Private Directorships
Multi Dimension Issue Tracking Secondary Occupations
Monitoring & Reporting Activity Implementation
Single system login for all Legal & Compliance related matters
Enterprise-wide alignment of initiatives
Full consideration of divisional/ regional/ functional characteristics
Powerful reporting and monitoring
Co-existence with complementary tools
Efficient and powerful Legal & Compliance Portal platform

2. Internal Controls and Audit Management System
The solution for you?
Need for action Key developments
Increasing statutory regulations demanding Increased regulatory pressure to demonstrate
transparency across enterprises. effective supervision
Pending business requirements not realizable Clear intention to strengthen supervision to protect
on existing platform or no existing control the enterprise from adverse effects
governance infrastructure. Need to leverage daily control activities to achieve
Audit management needs robust integration efficiency gains in maintaining compliance with
into enterprise application. regulatory requirements
The solution is ICAM
Use implementation of ICAM to lay the groundwork for a enterprise-wide supervisory control platform
Use implementation of ICAM Audit management module to offer generic control issue tracking
Extend beyond divisional / regional / functional boundaries to provide global solution

3. Database driven not Document driven
Database architecture not document management
ICAM uses a framework that encompases a powerful database architecture and Java application platform
solution, that is easily scaleable, which allows you to quickly find the information you need. Database driven
systems are more powerful than simple document based systems.
All key information, such as findings, issues, implementation progress, execution activities, signoffs and history
are all contained in an Oracle database which bring efficiencies to the documentation and review progress.
Database driven systems such as ICAM allow for real time team based use by thousands of users, providing
ease of use with a modern interactive Web based interface to facilitate storage, retrieval, sorting or filtering of
information.

4. Risk Convergence in ICAM
Laws, Regulations and Corporate Governance
Policies Structures
Relevant laws & regulations are adapted ICAM is designed to operate in line with
and embedded into the application as a standard control governance structures
company wide policy framework. ICAM and enables enterprise-wide oversight of
allows systematic mapping of relevant divisional/ regional or matrix
policies to control objectives and organisations.
consequently to underlying control
activities.
Deficiencies and Issues Internal Controls
Issues identified in the enterprise are Detailed specification and
raised, documented, assigned, handled, classification of controls ensures
and archived in ICAM. Issues can include full compliance with laws,
internal or external audit regulations, and policies. In addition it
recommendations and these can all be fully supports the achievement of strategic
linked to the internal control framework. and tactic goals.

5. Risk Management Governance
“Three Lines of Defence” Model
1st Line of Defence 2nd Line of Defence 3rd Line of Defence
Top Management
Risk Management Audit
and Front Office
Best Practice Promote strong risk Oversight Functions Auditors and Directors
culture within the combining compliance Independent oversight
enterprise and risk management with enforcement
Promote a culture Separate ability
of adhering to pre- risk management from Ability to link business
defined limits to risk control and risk with process
manage the risk Oversee Frontline with and IT knowledge
exposure regard to risk and Ensures the 3 lines of
Continual monitoring compliance defence operate
of risks and exposure effectively and
according to best
practice
Risk

6. Segregation of Duties
Internal Controls and Segregation of Duties
Societe Generale, $7 billion in losses: Operations expert moved to trading desk, taking some jobs with him.
Barings Bank, $1 billion in losses: Operations and trading managed by the same individual.
Lehman Brothers, $0.3 billion in losses: Sales manager took over certain simple operations functions.
Daiwa, $1.1 billion in losses: Same scenario as Societe Generale.
Allied Irish Bank, $0.7 billion in losses: Risk limit reporting under control of trader.
Tyco, $0.3 billion in losses: Three top executives colluded and board of directors exercised ineffective supervision.
Orange County, $1.6 billion in losses: Trader seen as the unquestioned maestro, while back office was underpowered to understand his
trading procedures.
Why SoD ?
Required by Sarbanes Oxley With good SoD it requires 2 or more employees
Proven management technique that organisations for irregularities to occur without detection
of all sizes can benefit Organise to achieve adequate segregation of duties
Primary objective is the prevention of fraud – see ISACA’s Segregation of Duties Control matrix
and errors Define general categories of functions to be
separated
ICAM supports and enhances SoD
Structured segregation of duties via dynamic role assignment
Enables management oversight of duties
Fully supports the ISACA’s Segregation of Duties Control matrix
Reports SoD anomalies