SAP Application Controls Follow-up - final audit report.pdf

Internal Audit Report
SAP Application Controls
(Follow-Up) 2019/20
Final
Assignment Lead: Paul Fielding, Principal Auditor
Assignment Manager: Mark Winton, Audit Manager
Prepared for: East Sussex County Council
Date: September 2019
APPENDIX A

Internal Audit Report - SAP Application Controls (Follow-Up) 2019/20
East Sussex County Council Page 2
Report Distribution List
Draft Report:
Matt Scott, Orbis Chief Information Officer
Ian Gutsell, Chief Finance Officer
Lorraine Juniper, Head of Projects & Innovation
Tahiana Jefferis, Enterprise Apps & Portfolio Manager
Gavin Paul, Technical & Security Manager
Linda Whiteman, Business Platform Support Manager
Alex Rodrigues, Business Platform Support Team Leader
Final Report (as draft report plus):
Kevin Foster, Chief Operating Officer
Nicky Wilkins, Head of Strategy & Engagement (ESCC)
This audit report is written for the officers named in the distribution list. If you would like to share
it with anyone else, please consult the Chief Internal Auditor.
Name of Authority - Internal Audit Key Contact Information
Chief Internal Auditor: Russell Banks,  01273 481447,  russell.banks@eastsussex.gov.uk
Audit Manager: Mark Winton,  01273 481953,  mark.winton@eastsussex.gov.uk
Anti-Fraud Hotline:  01273 481995,  confidentialreporting@eastsussex.gov.uk
APPENDIX A

1. Introduction
1.1. The SAP system is the council's key software system for its financial management,
budgeting and reporting functions. The system is also used for making payments to
employees, suppliers and billing of revenue. SAP is a mission critical system at the council
and there are risks that inaccuracy or lack of availability of SAP would prevent receipt and
disbursement of cash, as well as producing inaccurate management information.
1.2. An audit of SAP Application Controls was undertaken in 2018. The audit opinion was
Reasonable Assurance. The audit contained 6 actions agreed with management, including 3
rated as medium priority.
1.3. Whilst we would not ordinarily undertake a follow-up of a Reasonable Assurance audit, this
follow-up is being undertaken at the request of the Chief Finance Officer, in response to the
technical SAP audit undertaken by External Auditors (Grant Thornton), which identified
concerns at a technical level, specifically in terms of permissions granted to key individuals.
2. Scope
2.1. The primary purpose of this audit was to follow up previously agreed actions. This will be
done with regards to the risks and control objectives of the original audit.
• System access is restricted to appropriately authorised individuals and the permissions
provided to those users are in line with job functions;
• Data processed through the interfaces is authorised, accurate, complete, securely
processed and written to the appropriate file;
• Outputs produced by the system are complete, accurate, reliable, distributed on time
and with confidentiality where appropriate;
• System updates and enhancements are performed in a consistent manner and subject
to enough testing and authorisation before implementation; and
• Defined support arrangements are in place to manage changes within the system.
2.2. This report does not seek to provide assurance over, or a response to areas of concern
highlighted by the Grant Thornton report.
APPENDIX A

3. Audit Opinion
Substantial Assurance is provided in respect of SAP Application Controls (Follow-Up)
2019/20. This opinion means that controls are in place and are operating as expected
to manage key risks to the achievement of system or service objectives.
Appendix A provides a summary of the opinions and what they mean and sets out
management responsibilities.
4. Basis of Opinion
4.1. We have been able to provide Substantial Assurance over the controls operating within
the area under review because all but one of the agreed actions from the 2018 audit
have been implemented.
4.2. We found that guidance in relation to access of restricted roles within SAP had been
updated in line with current practices and had been made available to officers. Sample
testing of requests to access these restricted roles found that in all cases evidence of
approval had been obtained prior to access being given.
4.3. A process to monitor user access with stream leads had been re-implemented to ensure
that access is being reviewed, particularly in the case of restricted roles.
4.4. The change request process for updates and developments within the SAP system,
including roles and responsibilities, has now been fully updated and documented in line
with current practices.
4.5. Processes have been implemented to undertake checks on the activity of members of
the SAP Security team within the system.
4.6. The one outstanding action is in relation to the update of the template used to
document change requests for updates and developments. Our review found that a new
template had been designed but has yet to be fully implemented by the team.
APPENDIX A

5. Action Summary
5.1. There is one finding repeated in this report from the previous audit. In addition, there
are no new findings.
Risk
Priority
Definition No Ref
High
Major control weakness requiring immediate
implementation
0 N/A
Medium
Existing procedures have a negative impact on
internal control or the efficient use of resources
0 N/A
Low
Represents good practice but its implementation
is not fundamental to internal control
1 1
Total number of agreed actions 1
APPENDIX A

6. Implementation Action Tracking from Previous Audit
Original Agreed Action
Original Risk
Rating
Implementation
Status
Revised Risk
Rating
Restricted Role Permissions
A review to be undertaken of the specific instances highlighted within the audit report.
Work to be undertaken to ensure that staff within the team are fully aware of the
assignment of restricted roles within SAP
Medium
Action
Implemented
N/A
User Access Review
The process by which user access is monitored regularly, including potential conflicts,
with stream leads will be reinstated with a process for monitoring the effectiveness of
this activity introduced.
Medium
Action
Implemented
N/A
System Administrator Checks
A process will be implemented where members of the SAP Security team across Surrey
and East Sussex will be tasked with reviewing each other's activity within SAP.
Low
Action
Implemented
N/A
Change Request Process
Work will be undertaken to ensure that the change request process will be fully
documented. Medium
Action
Implemented
N/A
APPENDIX A

Documentation of Change Requests
The template currently used to document changes within IT&D is not always applicable
for all changes made. Work will be undertaken to develop additional templates that will
be more applicable to the process.
Low Action Repeated Low
Records of System Testing
Discussion to be held with stream leads to make them aware of the importance of
documenting the testing they undertake. A template is to be produced that can be used
to record the results of specific tests.
Low
Action
Implemented
N/A
APPENDIX A

7. Detailed Findings and Agreed Actions
Ref Finding Potential Risk Implication Priority Agreed Action
1 Documentation of Change Requests
When auditable trails are
not fully documented this
reduces the ability to
effectively scrutinise
changes being made to the
system.
Low The template currently used to document
changes within IT&D is not always applicable for
all changes made. Work will be undertaken to
develop and implement a template more
applicable to the process.
An improved template and process has
been developed to help facilitate the
change request process for system updates
and developments within IT&D. The
template itself is robust, covering various
sections of a change process including the
requirement for the change, a technical
walk-through and authorisation.
However, this template and process has
yet to be implemented by IT&D. The
original audit highlighted issues with the
current process, where change requests
were not being fully documented due to
the template being used not being
applicable for changes being made.
Responsible Officer:
Alex Rodrigues, Business
Platform Support Team
Leader
Target Implementation
Date:
October 2019
APPENDIX A

Appendix A
Page 9
Audit Opinions and Definitions
Opinion Definition
Substantial
Assurance
Controls are in place and are operating as expected to manage key risks to
the achievement of system or service objectives.
Reasonable
Assurance
Most controls are in place and are operating as expected to manage key
risks to the achievement of system or service objectives.
Partial
Assurance
There are weaknesses in the system of control and/or the level of non-
compliance is such as to put the achievement of the system or service
objectives at risk.
Minimal
Assurance
Controls are generally weak or non-existent, leaving the system open to
the risk of significant error or fraud. There is a high risk to the ability of
the system/service to meet its objectives.
Management Responsibilities
The matters raised in this report are only those which came to our attention during our internal
audit work and are not necessarily a comprehensive statement of all the weaknesses that exist,
or of all the improvements that may be required.
Internal control systems, no matter how well designed and operated, are affected by inherent
limitations. These include the possibility of poor judgment in decision-making, human error,
control processes being deliberately circumvented by employees and others, management
overriding controls and the occurrence of unforeseeable circumstances.
This report, and our work, should not be taken as a substitute for management’s
responsibilities for the application of sound business practices. We emphasise that it is
management’s responsibility to develop and maintain sound systems of risk management,
internal control and governance and for the prevention and detection of irregularities and
fraud. Internal Audit work should not be seen as a substitute for management’s responsibilities
for the design and operation of these systems.
APPENDIX A

SAP Application Controls Follow-up - final audit report.pdf

More Related Content

Similar to SAP Application Controls Follow-up - final audit report.pdf

Recently uploaded

SAP Application Controls Follow-up - final audit report.pdf