Continuous Auditing, Monitoring & Data Analytics

CONTINUOUS AUDITING,
CONTINUOUS MONITORING, AND
]
DATA ANALYTICS FOR AUDITING SAP
R/3
MICHAEL BERARDI, MS-CIS, CISA
ASUG INSTALLATION MEMBER
MEMBER SINCE 2001

[ ANUP MAHESHWARI
ASUG ASSOCIATE MEMBER
MEMBER SINCE: 2008

[ SHERRYANNE MEYER
ASUG INSTALLATION MEMBER
[ AJAY VONKAREY MEMBER SINCE: 2000
ASUG ASSOCIATE MEMBER
MEMBER SINCE: 1996

[ Michael Berardi

Real Experience. Real Advantage. 2

[ SAP R/3 ENVIRONMENT AT ENERGIZER
HOLDINGS INC.
 Eveready Battery Company
 Energizer and Eveready Batteries
 SWS Schick
 Playtex Products
 SAP R/3 v. 4.7
 Five instances of SAP R/3
 USA – two instances
 Sales (HP & PC)
 Manufacturing (HP)
 Europe
 Sales (HP & PC)
 Manufacturing (PC)
 Human Resources/Payroll

[ FRAUD OPPORTUNITY
TRIANGLE

PRESSURE RATIONALIZATION

[

The only limits on what can be accomplished are the limits of
your imagination, creativity and access to the data

LIMITS OF DATA ANALYSIS,
CONTINUOUS AUDITING
AND MONITORING

[ TERMS DEFINED

DATA Continuous Continuous
CAATS
ANALYSIS Auditing Monitoring

Real Experience. Real Advantage.

[ TOOLS

SAP R/3 (SE16, SE17, SAP Queries)

IDEA
• Benford‟s Law toolkit

ACL - http://www.acl.com
• Desktop
• Network version has evolved to Audit Exchange
• Webinars – www.acl.com/findmoney

Microsoft Access and Excel


[ Data Analysis Tools Outside SAP R/3
 ACL
 Direct Link for SAP R/3
 ACL for the desktop
 Audit Exchange
 User Forums
 http://www.acl.com
 Idea (http://www.audimation.com)
 Pre-built analysis for fraud - http://www.audimation.com/datas.cfm
 Manufacturing applications
http://www.audimation.com/applications/Manufacturing_Applications
.pdf
 Microsoft (Ms) Access
 Ms Office
 Approva


[ Approva BizRights
Collaboration Across
Business Users, IT and Audit

Finance Business IT Managers Internal & External
Managers Managers Auditors

Pressure & Audit Costs
Increasing Regulatory
Process Controls: Process Configuration, Transactions, Master Data, …
Multiple Controls

Procure-to-Pay
Order-to-Cash
Financial Close
Payroll

Security Controls: Segregation of Duties, Sensitive Access…

System Controls: Password Policies, Transport Policies…

People Legacy Other
SAP Oracle Soft Hyperion Apps Apps

Multiple Applications

[ LEARNING POINTS
Why apply data analysis with SAP R/3?

Understanding the benefits of data analysis,
monitoring and continuous auditing

A cookbook approach to data analytics

Energizer Holdings success with continuous
monitoring

Pre-written continuous monitoring and
auditing tools


WHY APPLY DATA ANALYSIS
[


[ BENEFITS OF DATA ANALYSIS
R/3 is data rich, report opportunistic

Testing the entire populations versus samples

Data analysis increases effectiveness and
efficiency

Effective for working remotely or on-site

Easier to share information electronically
than via hardcopy reports


[ BENEFITS OF DATA ANALYSIS
 Benford‟s law – who can tell me what this is?


[ RETURN ON INVESTMENT
• Payroll
• SSN tests (invalid, duplicate, dead people)
• Setting criteria for percent change from run to run
Continuous • Accounts Payable
Monitoring • Duplicate Payments
• Unclaimed credits

• Systems such as Approva or those you build yourself
can identify unusual transactions that might avoid a
fraudulent payment
• Look for a series of split transactions, avoiding the
Continuous dollar cutoff for either no receipt or no approval
Auditing required


[ PAYROLL

Ghost Expense Reported
reimbursement
Employees overtime
• AP vendor bill during slow
• Invalid SSN and employee
• No benefits reimbursemnt period Segregation
or unusual through • Authorized of Duties
items payroll check
overtime? (SOD)
• Dup Dir for expense
• Rounding up
Deposit Info hours?


[ ACCOUNTS PAYABLE

Duplicate payments &
vendor pre-payments

Procurement
Invoice to Site draft to Duplicate
card to
invoice off-invoice vendor
invoice


[ ACCOUNTS PAYABLE (CONT.)
LOOSE INVOICES (NO PO)

Fictitious vendors

Employee vendor accounts

Duplicate freight charges

Missed earned vendor discounts


[ Revenue Leakage
• Unlimited No. copies per Co.
• No Expiration
Evaluation Software • Outstanding copies not
disabled upon purchase

• Trends –always same vendor(s)?
Short Paid invoices • Excessive rebates?

Unauthorized discounts
or credit notes?

Price overrides


[ BEST PRACTICES

Follow the SDLC
process in the
selection and Include I.T. in the
implementation process
of a data analytics
tool

Follow the SDLC
Allocate enough
process in the
storage space on
creation of new
the SAP server
queries, so as not
for what the
to impact the
selected tool
production
produces
system(s)


[ LEARNING POINTS


[ A DATA ANALYSIS APPROACH – DATA
COOKBOOK
Don‟t re-create the wheel every time you develop a new
report

Maintain a list of the tables and procedures followed

Cookbook a catalogue of Recipes

Recipes may reference existing R/3 reports or table sources
and procedures to produce reports

Sources of information on tables and the location of data
exists both within R/3 and through internet resources

[

Using SharePoint to organize and store data analysis, continuous auditing
and continuous monitoring „recipes‟ or procedures

SHAREPOINT TOOL


[ AUDIT SITE WITH LINK TO COOKBOOK


[

SHAREPOINT SITE USED FOR RECIPES

[


[ SAP R/3 Tables for testing
 According to ACL there are over 20,000 tables in SAP
R/3
 The following are the top 20 Tables:
 BKPF - Financial Documents Header
 BSEG - Financial Document Items
 EKKO - Purchasing Document Header
 EKPO - Purchasing Document Item
 BSAD - Cleared Customer Invoices (paid)
 BSAK - Cleared Vendor Invoices (paid)


 BSIS - General Ledger Accounts
 KNA1 - Customer Master (General Data)
 KNKK - Customer Master (Credit Data)
 KNVV - Customer Master (Sales Data)
 LFA1, LFB1, LFM1 - Vendor Master
 MARC - Material Master
 VBAK - Customer Orders - Header
 VBAP - Customer Orders - Items
 VBRK - Customer Invoices - Header
 VBRP - Customer Invoices - Items


 DD02T - Table Titles
 TSTCT - Transaction Titles
 Create your own list of tables,
transactions and reports you find
useful
 Join ASUG Internal Controls SIG
discussion groups to grow your
knowledge


[ Good Information Sources
 Google – http://www.google.com
 SAPGenie - http://www.sapgenie.com
 SAPGenie Table Diagrams
 http://www.sapgenie.com/abap/tables.htm#Finance%20Tables
 SAP Help on the Web - http://help.sap.com/
 SAP R/3 Application Help
 http://help.sap.com/saphelp_470/helpdata/EN/e1/8e51341a06084
de10000009b38f83b/frameset.htm


[ Good Information Sources
 ISACA
 http://www.isaca.org and select downloads for SAP ICQ & Audit
Programs
 ISACA Bookstore for guides such as “Security, Audit and
Control Features SAP R/3 A Technical and Risk Management
Reference Guide”


[ SAP R/3 transactions to facilitate data analysis
 Transactional access required
 Display only access
 Data Dictionary (SE11)
 Ability to view tables (SE16, SE17)
Demonstration of Transaction Code SE16
 Using R/3 transactions to locate table data
Demonstration of using Help - Technical Settings


[

SE11 – DATA DICTIONARY


[

Transaction SE11 to
display data dictionary
information


[

SE16 – EXTRACTING FROM
TABLE FIELDS


[
Transaction Code SE16
TCODE: SE16


[
Transaction Code SE16


[

HOW DO I FIND THE TABLE
AND FIELD IN WHICH DATA
RESIDES?

[

When working with the users....

Click on the paper in the
bottom left corner gives
critical information such as
Tcode


[

So how do I find the source of
information?


[ So how do I find the source of information?


To save to a file on
[ your local hard drive
follow this menu tree


[ SAP Queries – Tcode SQ01


[ Key Learning Points!
 Grow your knowledge of SAP R/3
 Discussion groups
 ASUG chapter meetings
 Locate training
 Find good sources of SAP R/3 information related to
internal controls
 Start a cheat sheet of transactions, tables, programs and
reports
 Start your own library of data extraction and analysis
methods and reference them in the applicable internal
controls test plans


[

Questions or Comments?

THANKS,
MICHAEL BERARDI
MICHAELA.BERARDI@ENERGIZER.COM


[
 Thank you for participating.
Please remember to complete and return your
evaluation form following this session.
For ongoing education on this area of focus, visit the Year-Round
Community page at www.asug.com/yrc
]
[ SESSION CODE:
4506 – Data Analysis, Continuous
Auditing and Monitoring


[ IDEA by AUDIMATION


[


[ http://www.slideshare.net/acc_shan/sap-hr-
presentation-08052002-presentation


Continuous Auditing, Monitoring & Data Analytics

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (11)

Similar a Continuous Auditing, Monitoring & Data Analytics

Similar a Continuous Auditing, Monitoring & Data Analytics (20)

Último

Último (20)

Continuous Auditing, Monitoring & Data Analytics