erp in financial process

8/2/2019 Erp in Financial Process

http://slidepdf.com/reader/full/erp-in-financial-process 1/8

IT’s Role in FinancialProcessImprovements

Technology Solutions to Drive

Out Mistakes & Violations inFinancial Applications



2

From the first databases to ERP deployments, ITmanagers have led projects for financial processimprovements. Despite business process

reengineering, corporate America and governmententerprises still face errors, fraud, and data qualityissues within their financial systems.

Now the challenge is to stay competitive andcontinually improve those processes, such asaccounts payable, accounts receivables, purchase-cards, and financial reporting. IT managers canagain play a role in financial processimprovements.

Those responsible for these business processes

face increasing pressure from governmentregulations, such as Sarbanes-Oxley and BASEL II,to eliminate errors and strengthen internal controls.However, fast-paced growth and corporateacquisitions only increase the risk of financial errorsby implementing financial process improvementsthat create complex IT environments with multipleERP systems running throughout most companies.

A 2004 study from the Hackett Group reported thatthe average $1 billion company has 2.7 ERPsystems. Most CIOs and IT managers personally

deal with this headache on a daily basis. All thewhile, business process owners face competitivepressures to decrease their operating costs and putin place financial process improvements or beoutsourced.

Just as they led ERP deployments in the 1990s, ITmanagers can lead process-improving changes byapplying the proven methods for qualityimprovement to their financial applications. ITmanagers can enable business process owners todrive out errors in their financial systems throughcontinuous monitoring and real-time transactioninspection.

Manual EffortsToday, business process owners rely on sample-based audits and manual review of their custom-built ERP reports to identify invoicing errors,uncollected receivables, payment errors, invalid

journal entries to the general ledger, orunauthorized p-card purchases.Most of these efforts toward financial process

improvements are consumed on the backend of theprocess – looking for a duplicate payment or badinvoice before they hit the mail. For example, a $6billion Midwest manufacturer devoted two full-timeemployees to double check payments before theywent out the door. Two other employees spentmost of their days correcting the identified errors bytracking down the cause of the problem andreversing the purchase orders, vouchers, andpayments.

While this manufacturer placed a large emphasis

on quality and catching all the errors in its financialsystem, the quality assurance team could onlyspend their time inspecting and following up on thepayments that were greater than $5,000.Economically, it didn’t make sense to hire two morepeople to check data quality within these smallerpayments and another two employees to correctthe mistakes. However, errors within these smallerpayments built up over a year to misstate thecompany’s accounts payables by almost $400,000.

Open-Loop Controls

Spurred on by the demands of Sarbanes-Oxley,some companies have tried to establish financialprocess improvements that simulate ERPconfigurations to eliminate segregation of dutiesviolations and root out the cause of many of theseerrors. These highly technical solutions offer “open-loop” controls that attempt to project the potentialerrors or acts of fraud that could occur in thefinancial system. However, these solutions forevercement daily involvement from IT personnel in thebusiness process, which creates a resourceproblem for IT and a headache for the owner of the

business process.

While useful in configuring an ERP system, thesesolutions require time-consuming manual reviewsthat increase operating costs without effectivelyaddressing the entire problem. By tightening theembedded controls of the ERP system, theserestrictions introduce barriers to productivity, which



3

then frustrates production-line employees byrestricting them from getting their jobs doneefficiently.

With this mindset, IT managers risk running smackinto the “productivity paradox” where investments ininformation systems drag corporate productivityinstead of lifting it as projected. In short, tightercontrols reach a point of diminishing returnsbecause the human element can never be removedfrom the process. The human part of the processcreates the opportunity for errors, risk, and controlviolations to affect the quality of your financialoperations.

Further, configuration management tools typicallywork for only a single system and cannot correlateusers, access controls, and transactions acrossmultiple systems. IT managers must duplicate theirefforts across all systems.

For these reasons, IT managers should look forclosed-loop control systems that monitor qualitythroughout each step of financial processes.

Closed-Loop ControlsIT managers generally understand “closed-loop”

controls in the context of information security. Afirewall can be configured so that it does not allowInternet traffic into the corporate network, but that’snot realistic. Communication must flow into and outof the corporate network. While configuration of thefirewall remains the first step of IT security, ITmanagers know that they must also deployintrusion detection or other forms of networkmonitoring to identify threats inside the corporatenetwork.

In the same way, financial systems must be

monitored for risk. The best efforts at preventioncannot eliminate the human element that naturallyintroduces errors and risk and errors into financialprocesses.

Financial systems demand controls that identifyand prevent mistakes and violations that occur in each step of the financial processes. Whilecontrollers could throw a roomful of internal

auditors to provide this level of quality assurance,IT managers should recognize the potential fortechnology to automate this benefit.

To effectively present this agenda for budgetapproval, IT managers should first understand theconcepts of quality and process improvement – andhow technology can drive these programs infinancial processes.

Total Quality Management & the FinancialManufacturing PlantTo compete with Japanese manufacturers,American manufacturers adopted the idea of totalquality management in the 1980s. In the 1990s, Six

Sigma grew as another quality managementmovement. IT managers can apply these conceptsto improving financial processes within their ERPsystems.

The costs and benefits of quality within financialoperations – or lack thereof – is best understood ifyou think of the financial processes, such asprocure-to-pay, order-to-cash, and financialreporting, as “Information Manufacturing.” (Just tobe clear, we’re not talking about manufacturingfictitious earnings reports.) Within this information

manufacturing, these processes transform inputdata into more refined information.

The key to remember is that quality isn’t abouthaving the most elaborate financial systems – it’sabout meeting expectations. To this point, qualityisn’t necessarily a Cadillac. A Chevrolet can havequality as long as it delivers to the expectations ofthe customer. Phil Crosby’s most compellingargument is that quality doesn’t have to be a cost; itcan be free of you think about all the costs of anerror. And every time you remove that error, you

save money.

So what are the costs of processing an error withinfinancial processes? If an invoice error produces anerroneous shipment, the correction cycle mayinclude:

Receiving a customer call complaining.about the bad shipmentInvestigating the error



4

Reversing the invoiceHandling returned materialsAccruing for rebates & returns

Accounting for change in revenuerecognition

Less explicit costs arise when the sales managergets involved to manage the customer relationship,so the sales manager absorbs an opportunity costby not devoting his time to call on new business.

For most Fortune 1000 companies, enterpriseresource planning (ERP) systems serve as themanufacturing facility. These systems can beconfigured to deliver quality, but they also involve a

significant human element. While ERP systemsprovide the conveyer belts that move informationthrough the various steps along the process,people play a major role with regard to data entryand approvals.

The analogy in manufacturing is that you inspect forquality along the way. For example, Intel doesn’twait until the end of the production line to look for

defects within its microchips. They look at eachstep along the process. Intel would much rather finda flaw in a silicon wafer before they’ve burned in all

the circuitry. It’s a lot cheaper to throw away thatfaulty wafer before investing time and productioncycles into a defective final product.

IT managers should apply that same mentality tothe financial processes inside their ERP systems.Look for errors and defects throughout the processto minimize correction costs and the downstreamimpact.

Real-Time Transaction InspectionOversight Systems offers an IT solution that

automates the work of auditors to continuouslymonitor financial processes for mistakes andviolations within ERP systems. As a “virtualauditor,” Oversight provides CIOs and IT managersa closed-loop control system that monitors financialprocesses at each step to identify errors as theyhappen and identify the first signs of fraud.

The Oversight solution for real-time transactioninspection is a single solution for IT managers toimprove financial processes. Built from the bestpractices of auditors, Oversight provides a quickly

deployed continuous monitoring system thatincludes all audit tests for financial processes,including:

Order-to-CashProcure-to-PayFinancial Accounting & ReportingFixed Assets & Capital ProjectsP-cardsEmployee Pay

Oversight’s virtual auditor counter-balances thehuman element of financial operations and the gap

between control effectiveness and the goal to be100 percent error-free.

For example, a virtual auditor would work in theorder-to-cash process to identify control exceptionsrelating to duplicate customer records andcustomer credit limits. Once a customer reaches itscredit limit, a sales manager may continue to bookorders for this customer under the duplicate

The Six Sigma DMAIC Framework

Define

Set Benchmarks & BaselineMap Process FlowDetermine Customer

Requirements

Measure Develop Defect MeasurementsDevelop Data Collection ProcessCollect & Compile Data

Analyze

Draw Conclusions from DataTest ConclusionsDetermine ImprovementOpportunities

Improve

Create Improvement IdeasSet GoalsImplement ImprovementMethods

ControlMeasure Improvement StatisticsAssess EffectivenessMake Needed Adjustments



5

customer record. In this case, an advancedcontinuous inspection system recognizes all similarcustomer file across all financial systems – even if

the record is not an identical match. A virtualauditor identifies the duplicate and aggregatesactivities from both customer records to identify theincreasing credit risk and control violations.By identifying this control exception at the momentit’s created, the company avoids the risk exposureof over-extending credit to a customer.

Evolution from Continuous Monitoring to Real- Time Transaction Inspection The idea of the virtual auditor is not new. In theearly 1990s, continuous monitoring concepts first

emerged as embedded audit modules within thefinancial systems. But these required companies torewrite their applications and install the auditmodules.

The next approach relied on simple evaluationsavailable through ERP reports and rules engines.For example, an internal auditor or controller mightrun a report that looks for voucher lines without amatching purchase order. However, false positivesoverwhelmed the true exceptions. For example,these systems faced big challenges in

differentiating between duplicate payments versusrecurring payments. Executives and auditors facedan overwhelming task to validate true events, whichled them to disregard these daily reports asinconsequential.

False negatives were also a problem. Mostprocure-to-pay systems can look for vendors whohave the same address as an employee. However,an employee who lives at “503 Ridgewood Road”could create a ghost vendor and have checksmailed to “503 Rydegwood Road”. ERP reports and

rules engines would not identify the ghost vendor.

Larger companies that operate with multiplefinancial systems faced another huge challenge ofcorrelating results from across the enterprise. Toanalyze from multiple systems or data sources,auditors manually loaded data into spreadsheet-likeapplications for manual analysis and testing. Thishistorical analysis still plays a role in many audits,

but it does not address the need for real-timeidentification of errors and other exceptions. It doesnot improve financial operations.

Advanced Analytics Drive Inspections Real-time transaction inspection improves oncontinuous monitoring by incorporatingsophisticated analytics to aggregate conclusions ofmultiple tests and assemble the evidence thatidentifies root cause for control exceptions. Real-time transaction inspection delivers accurate resultswith minimal false positives and rich conclusionswithout false negatives. Inspection integratesmultiple reasoning techniques:

Symbolic – known signatures

Incremental – link individual testsContextual – consider surroundinginformationComparative – uncover similaritiesCross-source – correlate information frommultiple systemsTemporal – relate events to time

As a virtual auditor, these advanced analyticsrepresent the thought processes of auditors andfraud examiners as they evaluate activities withinthe financial processes.

Symbolic Reasoning. Symbolic draws upon thedecades of experience from auditors and fraudexaminers to essentially know what to look for.Symbolic reasoning looks for signatures of knowncontrol exceptions as well as patterns of events.For example, symbolic reasoning identifies allsegregation of duties violations as well as commonerrors with the general ledger, such as anunbalanced journal entry or a duplicate journalentry within the same accounting period.

Incremental Reasoning. With Real-time transactioninspection, incremental reasoning identifies errorsand fraud as they unfold by identifying controlexceptions that build upon previous conclusionsand exceptions. Incremental reasoning raises theconfidence and priority of conclusions as well asrecognizes multi-transaction exceptions thatindividually are not suspicious. Incrementalreasoning also considers transient data to compare



6

the current and past states of information. Becausean ERP system only stores current state of thedata, continuous monitoring is essential to capture

all evidence that no longer exists in the ERPsystem.

For example, incremental reasoning identifiesvendor “change and change back” schemes. In thiscase, an employee alters a master vendor filebefore a check run and inserts his own address orbank routing number – through the financial systemor in the database. After the check run, theemployee covers his tracks by changing the fileback to its previous state. Incremental reasoningrecognizes the sequence of events and previous

conclusions to raise the priority of the exceptionbased on the degree of risk.

Contextual Reasoning. Contextual reasoningconsiders the circumstances of each transactionand how it relates to historical norms or patterns.Real-time transaction inspection correlatescontextual reasoning with other conclusions toadjust the confidence and priority of otherexceptions. For example, symbolic reasoningidentifies segregation of duties violations within theorder-entry process, but contextual reasoning rates

the significance of the control exception. The neworder that violates SOD controls may closelyresemble previous compliant orders, and thereforerepresent a low priority exception. However, thenew order could be more than twice the size of anormal order and to a new customer. In this case,contextual reasoning raises the confidence andpriority of the SOD control exception.

Comparative Reasoning. Comparative reasoningidentifies transactions that are not exact matchesbut closely resemble other transactions orinformation in the financial system. Most financialsystems will not accept two identical purchaseorder numbers; however, slight variations caneasily create a duplicate and lead to furtherdownstream errors. Comparative reasoningrecognizes the similarities between purchase ordernumber 41410 from vendor Glennlake andpurchase order number 41140a from vendorGlynnlake.

Cross-Source Reasoning. Real-time transactioninspection integrates across multiple financialsystems for cross-source reasoning, which

compares the business processes and transactionsby going to the source systems. This cross-sourcereasoning powers a consistent view across multiplefinancial systems to recognize duplicates andanomalies across the enterprise – no matter howmany financial systems are running.

Temporal Reasoning. Temporal reasoningintroduces the element of time into Real-timetransaction inspection. Temporal reasoningconsiders the timing of an event, transaction, orstate of an entity. For example, temporal reasoning

is used to identify an expense account, such assupplies, that has a credit balance at the end of anaccounting period when it should have a debitbalance.

Critical Success Factors Real-time transaction inspection relies on two keycomponents for success: a unified view of theprocess and independence from the operationalsystems. First, continuous inspection must accesstransaction data at its source without going throughan intermediating step exposed to tampering. By

drawing upon information from multiple financialsystems, continuous inspection performs consistentanalysis across the same processes performed indifferent systems across the company.

Second, Real-time transaction inspection must beindependent from operational systems. This isessential to minimize the “who can you trust”challenge and provide no impact on theperformance of financial applications. Separatefrom the financial system, continuous inspectionprovides results are based on unadulterated data

exactly as it appeared in the transaction. Thecomplex analysis of a virtual auditor must beprocessed in a separate system as to avoiddegrading the performance of the financialsystems.

Exception Handling Continuous inspection is not just about findingexceptions to your policies but also managing the



7

process once you identify the exceptions. Acontinuous inspection system should have aworkflow system that provides a framework to

manage all identified exceptions from initialdiscovery to resolution.

This workflow capability closes the loop on allidentified exceptions by:

Allowing authorized users to accept anddismiss individual eventsAssigning responsibilities for follow upProactively linking all related events andentities (e.g. an invalid vendor and alltransactions associated with that vendor)Documenting all exceptions and follow up

activities in an auditable journal

ConclusionCIOs and IT managers can play a major role inimproving financial business processes byevaluating technology solutions that automate themanual testing for quality assurance. OversightSystems provides a continuous monitoring solutionwith real-time transaction inspection to drive qualitythrough all steps of financial processes.



About OversightErrors in day-to-day financiatransactions consistently res

in adjustments, reversals anrework. Oversight Systemsdrives defect-free financialprocesses to eliminate theseextra costly efforts. Increasinthe quality of financialoperations leads toaccelerated, more accuratecloses and validates policycompliance. Our softwareinspects each step of everyfinancial transaction in real

time for errors and controlviolations, so companies canaddress these issues whenthey are less complex and lecostly to correct.

For more information, visitwww.oversightsystems.com

“Oversight works across the financial systems toidentify segregation of duties conflicts and prioritizesthese conflicts based on actual risk. For the conflictsthat can't be eliminated, Oversight's real-timetransaction inspection serves as an automated

mitigating control to provide alerts when an SoDconflict is actually violated. Instead of having to huntdown and correct every SoD conflict, Oversightenables a risk-based approach to control compliancethat allows efficient, defect-free financial processes.”

Mark Van Holsbeck Director of Information Security Aver Dennison

“With Oversight, I have a system that detects what'sgoing on independent of the accounting or databasesystem. I'm in a much better position if someone inmy technology group is manipulating the data.”

Mike Sullivan Director of Accounting Services American Electric Power

“Oversight software within minutes found theduplicate payments that nearly paid for the Oversightsoftware immediately. That’s a textbook definition of aquick ROI.”

William McNeill AMR Research

“Oversight’s benefits of early detection and quickresolution should pay for this system easily.”

John Hagerty

Vice President AMR Research

“Controls automation and monitoring improvesreliability of controls and potentially reduces the costof compliance by reducing the labor component ofcompliance activities.”

French Caldwell Vice President of Research Gartner

“Oversight helps cut auditing expenses.”Baseline Magazine

erp in financial process

Documents