ERP Systems:

Audit and Control Risks

Jennifer Hahn
Deloitte & Touche

ISACA Spring Conference

April 26, 1999
 Session Learning Objectives
ERP Systems: Audit and Control Risks

■ At the end of this session, the participant should

be able to:
– Understand key risks and control issues surrounding
the ERP systems
– Understand the impact of ERP implementation on the
internal audit organization
– Explore alternatives for reengineering the audit
approach

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 2

 Session Topics
ERP Systems: Audit and Control Risks
■ Key Risks and Control Issues
■ Impact on Internal Audit
■ Reengineering the Audit Approach
■ Questions & Comments

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 3

 ERP Systems: Audit and Control Risks

Key Risks and Control Issues

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 4

 ERP Systems: Audit and Control Risks

Why ERP Audit is Different

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 5

 Technical Complexity
ERP Systems: Audit and Control Risks

■ System usually resides on multiple computers

■ Optimum coordination is a challenge
■ Reliability and availability of data
– Effective use of on-line reporting
■ System allows flexible configuration,
cutomization and maintenance

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 6

 Event Driven Processing
ERP Systems: Audit and Control Risks

■ On-line real-time processing

– All databases updated simultaneously
– Rely on transaction balancing
– Demands data validation before acceptance of data
– Highly dependent on system-based controls
■ Traditional “batch” controls and audit trails are no
longer available
– Data entry accuracy is improved through the use of
default values, cross-field checking and alternative
views into the data

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 7

 Integrated Database
ERP Systems: Audit and Control Risks

■ All transactions are stored in one common

database
■ Modules automatically create entries in the
database for each other
■ Auditors need to understand the interactions
and flow of information
■ Databases can be accessed by any module
■ System modules (applications) are
transparent to users

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 8

 Security and Access
ERP Systems: Audit and Control Risks

■ Requires extensive, well thought out definition of

security access capabilities
■ Authorizations occur within the application, not
at the database level
■ Delivered system security is not necessarily
strong
■ Network and database access security is also
required
■ Significant rise in users who have access
■ Increased access from field personnel, vendors
and customers
© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 9
 Implementation Impact
ERP Systems: Audit and Control Risks

■ Typically, an ERP implementation is

combined with a business reorganization/
reengineering
■ Organizational changes and new business
processes may be extensive
■ Resulting controls should also be different
from traditional ones

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 10

 Other Changes
ERP Systems: Audit and Control Risks

■ Lack of hard copy documents

■ Controls are sometimes an afterthought
■ Traditional general computer controls are
implemented within the application in some
cases:
– Security
– Change Control
■ Some ERP Systems are table driven:
– Tables determine how transactions are processed
– As table values change, system processing also
changes
© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 11
 ERP Systems: Audit and Control Risks

Key Exposures

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 12

 Key Business Exposures
ERP Systems: Audit and Control Risks
Organizations face several new business risks when they migrate to a real-
time, integrated ERP System:
■ Single point of failure since all of the
organization’s data and transaction processing is
within one application
■ Complexity of architecture, applications and data
structures makes it difficult to understand and
operate effectively
■ Reengineering or business process redesign
normally included in implementation
■ New Technology environment
■ User acceptance of the system influences
likelihood of success
© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 13
 Key Business Exposures
ERP Systems: Audit and Control Risks

■ Extensive expertise required to effectively operate

■ Significant personnel and organizational structure
changes
■ Transition of traditional user roles to empowered-
based roles
■ On-line, real-time system environment requires
continuous business environment
■ Effort of training a large number of users
■ Challenging to embrace a tightly integrated
environment when different business processes
exist among business units
© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 14
 Key Technical Exposures
ERP Systems: Audit and Control Risks

■ Inexperience with implementing and managing

distributed computing technology may pose
significant challenges
■ Increased remote access by users and outsiders
■ Extensive interfaces and data conversions from
legacy systems and other commercial software
often necessary
■ IS must transition to an organization that can
support a distributed computing environment

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 15

 Key Control Exposures
ERP Systems: Audit and Control Risks

■ Opportunity to establish control environment is

during system implementation since extensive
control is within the configuration
■ Complexity makes it difficult to understand and
audit effectively
■ High integration allows increased access to
applications and data
■ Necessity for temporary and permanent
interfaces increases exposures of data integrity
and security
■ Extensive expertise required to effectively audit
and control
■ Audit may need to change audit approach
© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 16
 ERP Systems: Audit and Control Risks

Impact on Internal Audit

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 17

 Summary of Audit Challenges
ERP Systems: Audit and Control Risks

• Level of Understanding of ERP System

• Process Audits
• Interface Between Internal Audit &
Audit External Audit
Challenges • Electronic Information
• Data Issues
• Computer Interfaces
• Managing Expectations

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 18

 Audit Challenges
ERP Systems: Audit and Control Risks

■ Level of Understanding of ERP System

– 1st Year Audits are opportunities
– Management Perception
– ERP “does it all”
– Use of a Subject Matter Expert
■ Process Audits
– Many companies will reengineer business processes
– Auditing the business process/internal controls will
likely become the focus of the audit tests

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 19

 Audit Challenges (cont’d.)
ERP Systems: Audit and Control Risks

■ Interface Between Internal Audit and External

Audit
– Partnering with One Another
– Leveraging Each Other’s Skill Set
■ Electronic Information
– Electronic Information vs.. Hardcopy
– Auditor Profile to obtain information electronically

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 20

 Audit Challenges (cont’d.)
ERP Systems: Audit and Control Risks

■ Data Issues
– Data Retention
– Data Entry
– Segregation of Duties
■ Computer Interfaces
– Number of Interfaces
– Data Analysis and Drill-Down

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 21

 Audit Challenges (cont’d.)
ERP Systems: Audit and Control Risks

■ Managing Expectations
– Self-sufficient in identifying and drilling down into
information
– Change in Audit
 Sharing of best practice information
 Adding Value
– Reduction in Hours
 Effective and efficient audits with little start-up costs
 All processes and computing on one system, therefore hours
are expected to be lower

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 22

 Audit Organization Impact
ERP Systems: Audit and Control Risks

■ Internal Audit Must Address the New Environment

in Several Respects:
■ Training
■ Staffing
■ Implementation Approach
■ Audit Methodology
■ Roles for the Auditor

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 23

 Staffing
ERP Systems: Audit and Control Risks

■ Complexity of system environment requires

staffing model with higher ratios of:
– Information Systems Auditors
– Integrated Auditors
■ Traditional Financial and Operational Auditors
must transform to Integrated Auditors
■ Audits of complex and technical areas may need
to be supplemented by experienced resources

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 24

 Training
ERP Systems: Audit and Control Risks
■ Detailed knowledge of ERP Systems necessary
in order to effectively understand security and
control issues over:
– application areas
– technical environment
■ Significant training necessary to adequately
understand the new environment
■ Must learn a security and controls implementation
methodology
■ May need to learn new tools (e.g., ABAP/4 for
SAP) in order to effectively audit ERP
■ Consider vendor training and joining user groups
© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 25
 Implementation Approach
ERP Systems: Audit and Control Risks

■ Audit should take an active role during the

implementation
■ Reengineered business processes require a
change in the method of control
■ New security, audit and control tools should be
developed to facilitate the effective
implementation and operation of the control
environment
■ On-going involvement with R/3 implementations
required

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 26

 Audit Methodology
ERP Systems: Audit and Control Risks

■ Traditional audit methodologies and approaches

must be modified to effectively audit R/3 in a cost-
effective manner
■ Integrated audits necessary for the new
environment
■ New audit tools should be developed to facilitate
efficient and effective audits

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 27

 Roles for the Auditor
ERP Systems: Audit and Control Risks

Integrated Approach Pre-implementation Review

• Focus on the Design and • Focus on the Controls Design for New
Implementation of Controls for New Systems
Systems • Give consideration to
• Give consideration to • Review of Business Case
• Project Risk • Project Risk
• Business Process Risk • Business Process Risk
Assessment Assessment
• Perform tests to Ensure • Review of Performance Measurement
Implementation of Controls Criteria

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 28

 Roles for the Auditor
ERP Systems: Audit and Control Risks

Post-implementation Review Quality Assurance Audit

• Focus on the Implementation of • Participation throughout Project

Controls for New Systems • Focus on overall quality of Business
• Give consideration to Process Reengineering Program
• Risk Assessment of Business • Give consideration to Ability to
Process Impact Project
• Achievement of Project • Consider specific deliverables at
Objectives and Business Case each key project milestone
• Review of Implemented Performance
Measurements

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 29

 ERP Systems: Audit and Control Risks

Reengineering the Audit Approach

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 30

 Audit Scope
ERP Systems: Audit and Control Risks

■ Evaluate the complexity of the technology

environment
■ Identify which ERP modules have been
implemented
■ Evaluate the existence of distributed applications
■ Determine whether legacy systems are used
■ Obtain an understanding of the organizational
model
■ Obtain a high level understanding of the controls
in place over:
– General Computer Controls
– Business Process Controls
© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 31
 Testing Considerations
ERP Systems: Audit and Control Risks
■ Difficult to perform financial audits without relying
on internal controls:
– Clients using ERP are usually large multi-national
corporations with complex structure and reporting
– More internal control testing, less substantive testing
■ Documentation of testing
■ Design of effective tests of controls
– Audit steps are different
– Audit issues are different

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 32

 Operational Audit Considerations
ERP Systems: Audit and Control Risks

■ Increased difficulty and importance in definition

of the scope of the audit
■ A detailed understanding of client processes is
required
■ An increased level of Operational Audit technical
knowledge and computer-related controls is
required
■ The roles and responsibilities of Operational
Audit and Computer Audit becomes more
integrated

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 33

 Computer Audit Considerations
ERP Systems: Audit and Control Risks

■ An increase in the level of technical Enterprise

Resource Planning (ERP) system knowledge
■ A detailed understanding of ERP specific
General Computer Controls, especially
– Security Authorization Structure
– Correction and Transport System
■ An increased understanding of business
processes and the related ERP controls
■ An increase in the integration of Computer Audit
and Financial Audit

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 34

 Audit Process
ERP Systems: Audit and Control Risks

General Computer Controls Assurance

Operation and Process Assurance

Planning and Functional/Process Final
Scoping Reviews Delivery

Operations Audit

Computer Audit
Operations and
Computer Audit

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 35

 Roles and Responsibilities
ERP Systems: Audit and Control Risks
■ Identify all the team members that will serve the client:
Operations Audit, Computer Audit and Other Specialists
■ No hard and fast rule to split roles and responsibilities
between audit groups
■ Actual differentiation of roles and responsibilities is
determined on a client-to-client basis
■ An evaluation needs to be made by the audit team as to
how the roles and responsibilities should be defined
■ The important issue is that the client should have a
– seamless and efficient audit
– from a well integrated and knowledgeable team

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 36

 ERP Systems: Audit and Control Risks

Questions & Comments

© 1998 Deloitte Touche Tohmatsu. All rights reserved. fico.ppt 37