Infoblox IPO Readiness

1. Segregation of Duties:
Best Practices for Compliance

2. © 2006 Infoblox Inc. All Rights Reserved.
1. Unidentified or unresolved Segregation of Duties
2. Operating System access controls supporting financial
applications or Portal not secure
3. Database access controls supporting financial applications not
secure
4. Development staff can run business transactions in production
5. Large number of users with access to “super user” transactions
6. Former employees or consultants continue to have system
access
7. Posting periods not restricted within GL application
8. Custom programs, tables and interfaces are not secured
9. Procedures for manual processes do not exist or are not followed
10. System documentation does not match actual process
Top Ten IT Control Deficiencies

3. © 2006 Infoblox Inc. All Rights Reserved.
Segregation of Duties (SoD) Definition
§ Segregation of duties (SoD) provides the assurance that no one
individual has the physical and system access to control all phases of
a business process or transaction: from authorization to custody to
record keeping.
§ A person or group has too much access or authority – resulting in risk
exposure to the business

4. © 2006 Infoblox Inc. All Rights Reserved.
Segregation of Duties (SoD) Examples
Function 1 Function 2 Business Risk
Enter PO Receive PO Prevent buying and receiving items for user's personal use
Define Supplier Pay Invoice
Prevent a user from setting up and paying a fictitious vendor for
personal gain
Enter AP Invoice PO Returns Prevent goods from being received, invoiced and then returned
Fixed Asset
Physical
Inventory
Asset Retirement Assets could be misappropriated and then summarily written off
Enter SO
Manage Price
Lists
A user could manipulate prices for the benefit of a customer or
themselves
Enter Customer Ship SO A user could enter and ship an order to themselves
Enter Credit
Limits
Enter SO
Manipulated credit policies could increase risk or benefit
customers
Misc. Inventory
Txn
Inventory Counts Adjust inventory balances to meet count results
Inventory
Transaction
Ship SO Shipping users should not be able to move inventory

5. © 2006 Infoblox Inc. All Rights Reserved.
Typical Procure to Pay Process
Procure to Pay
AccountsPayableInventoryPurchasing
Supplier
Master
Item
Master
PO
Setups
INV
Setups
AP
Setups
Enter
Requisition
Enter
PO
Approve
PO
PO
Receipt
Print PO
INV
Receipt
Enter
Invoice
Pay Invoice
Payment
Document
GL
Transfer
PO Close
Reports
Open/Close
Periods
Open/Close
Periods
AP Close
Reports
INV Close
Reports
Open/Close
Periods
Transfer
Inventory
Transact
Inventory
INV Count
Reports
Count
Inventory
WIP

6. © 2006 Infoblox Inc. All Rights Reserved.
SoD Control Automation: Preventative Capabilities
§ Develop the ability to proactively enforce the conflict matrix within
your ERP applications
§ Develop the real-time capability to monitor, report, and administer the
conflict matrix and corresponding SoD conflicts
§ Create notifications & approvals for changes to responsibility
definitions
§ Eliminate intra-responsibility conflicts and the ability for users and/or
super-users to manage themselves

7. © 2006 Infoblox Inc. All Rights Reserved.
§ A Prevention + Detection approach to Controls Automation ensures that
controls are systemically and continuously enforced
Prevention
Active
Compliance
Detection
The Analogy of Virus Software
=+

8. © 2006 Infoblox Inc. All Rights Reserved.
SoD Enforcement: Provide Flexibility
§ Prevention: prevent a conflict within your ERP at the time of attempted
assignment
§ Allow with Approval: restrict or disable conflicting responsibilities until
formal approval is granted
§ Allow with Rules: Allow a conflict with the deployment of a business
rule that mitigates the associated risk

9. © 2006 Infoblox Inc. All Rights Reserved.
Segregation of Duties (SoD) Key Considerations
§ How will I define my SoD controls?
§ How will I deploy and enforce my controls?
§ What mechanisms do I give my process owners for preventing SoD
conflicts?
§ How will I clean up my existing SoD conflicts?

10. © 2006 Infoblox Inc. All Rights Reserved.
Segregation of Duties (SoD) Summary
Automate, Manage, and Enforce
Policies and Procedures
§ Separation of Duties
§ Access Control
§ Change Control and Tracking
§ Authorizations / Approvals
§ Key Process Controls