It’s now been 17 years since the passage of the Sarbanes-Oxley Act (SOX), which was enacted in the wake of the corporate accounting scandals at Enron and WorldCom. The goal of SOX was to make publicly traded companies more accountable for the accuracy and integrity of their financial reporting. Whether the law has lived up to its intended goals is a matter for debate, but SOX has definitely had an impact on the way companies handle their Governance, Risk Management and Compliance (GRC) duties. And, considering the centrality of SAP systems in accounting, SAP GRC controls are essential when examining your SOX compliance checklist.
What is SOX Compliance?
The Sarbanes-Oxley law has many elements. As a practical matter, two sections of the law are most relevant to IT, finance and GRC people. Section 302 states that the CEO and CFO are directly responsible for ensuring that financial reports (e.g. the 10Q and 10K) are accurate and well-documented. It also holds that these two executives are responsible for the company’s internal control structure. Section 404 takes this further, obligating the company to assert that it has adequate internal controls in place and that they are operational and effective. Registered external auditors must then attest to the accuracy of management’s assertion.
To comply, you need to understand how transactions flow through your SAP landscape, calculate risks of fraud and error, put in necessary controls and evaluate and report on the effectiveness of those controls. Whether this is a Herculean task or a trivial one depends on your SAP SOX compliance checklist, and the SAP GRC software you use to implement it.
It’s worth mentioning the consequences of not complying with SOX, because they are potentially serious. If the external auditor determines that an internal control is “deficient,” meaning it is not going to perform its job, the auditor must disclose this fact. The company is then obligated to remediate the deficiency within a stated period of time. If the company does not remediate the deficient control, it can face some major consequences.
SOX Internal Controls
What are the internal controls SOX refers to? If you work in IT, the idea may not be familiar to you. It’s more of an accounting concept. An internal control is a rule or process (or a combination of them) that is intended to prevent or detect actions that might affect the integrity of financial transactions. A super simple example is the lock you see on a cash register. The lock prevents unauthorized people from stealing from the till. Controls in SOX are comparable, but much more sophisticated.
SOX Controls Examples
SOX controls run the gamut from basic accounting practices like bank account reconciliation to IT controls like running regular system backups. Internal controls fall into two categories—detective and preventive. A detective control detects if there is fraud or mistakes affecting reporting. A preventive control stops someone from committing fraud or making an error that would negatively impact accuracy of business operations.
Many SOX controls are both. For example, Segregation of Duties (SoD), which blocks users from executing transaction processes that could enable fraud, is largely preventive. However, the SoD management process is a detective control. It examines access controls to determine if anyone is violating SoD rules.
The SOX Compliance Audit
The SOX audit, though covering all aspects of SOX, is primarily involved with Section 404. Each company does it a little differently, but in general the process starts before the external auditors arrive. Whoever is assigned to SOX compliance creates a list of internal controls. (They usually get a suggested list from the auditor beforehand.) They go through the controls themselves first, checking them before the auditor gets to work. If the company has gone through SOX before, it’s not that big a deal. They simply update the previous year’s controls list and go from there.
The audit of internal controls (which is the bulk of the SOX audit) looks at four main categories. These encompass all of a company’s IT assets including access (both physical and virtual), security, change management and backup procedures. The auditor also takes a careful look at the company’s SoD controls. These are among the most important element of Section 404 compliance.
SOX Compliance Software
The SOX audit and overall compliance process are no longer manual affairs. Software can help expedite the process while making it more effective. For example, ControlPanelGRC Access Control contains a complete set of tools to automate the SoD tasks in your SAP SOX compliance checklist. Its SoD Risk Analyzer module contains customizable SoD rules, as well as compliance monitoring and remediation controls to quickly identify and correct SoD conflicts. This works with the SAP User Provisioning and Role Management module, enabling your security admins to quickly provision new user assignments or positions without risking SAP SOX Compliance.
The SAP SOX Compliance Checklist
1. Segregation of Duties SOX Compliance
Allowing a single user to create and pay a vendor, or order and receive inventory increases the risk of fraud and embezzlement. Segregation of Duties (SoD) controls prevent users from obtaining multiple, incompatible roles. ControlPanelGRC Access Control contains a complete set of tools to automate the SoD tasks in your SAP SOX compliance checklist. The SoD Risk Analyzer module contains customizable SoD rules, as well as compliance monitoring and remediation controls to quickly identify and correct SoD conflicts. This works with the SAP User Provisioning and Role Management module, enabling your security admins to quickly provision new user assignments or positions without risking SAP SOX Compliance.
2. SAP GRC Compliance Monitoring
There are two choices for monitoring compliance: manually reviewing records for inconsistencies or implementing automation for SOX compliance in SAP. An SAP GRC solution will look for warning signs that could indicate fraud or missing controls, and report on them in real-time. Manual reviewers will take months to sample a fraction of your records with far less accuracy.
3. Safeguard SOX Audit Trails Against Emergency Access
SAP landscapes create a permanent, automated record of every transaction as it happens. Anytime someone creates a vendor, files a purchase order, or changes a customer record, it’s recorded in a tamper-proof system. The problem occurs when there’s an emergency and generic firefighter IDs are used. This allows a consultant to go in and fix whatever has broken using a generic firefighter log, but it poses certain risks. It’s very difficult to track changes made by generic firefighters and compare them to the consultant’s regular ID.
Without this level of verification, it goes unnoticed if a consultant creates a vendor with a firefighter ID and then cuts a PO to the vendor with their regular ID. With this in mind, generic firefighters can make changes that harm the system, violate compliance rules or compromise audit trails. An SAP GRC solution like ControlPanelGRC® can provide firefighter access without using generic logons and hold firefighters accountable for any changes they make.
4. Automate SAP Audit Reporting
SAP GRC software can eliminate the arduous task of hunting down and compiling data for auditors. SAP Audit Management with AutoAuditor™ automatically executes reports and routes them for review based on your organization’s requirements. It integrates with your other SAP GRC modules, delivering a complete report for internal review or external audits. That integration facilitates remediation, allowing you to act on auditor findings immediately.
5. SOX compliance checklist for database
The SAP transaction data that underpins your financial reports should receive attention in the SOX compliance process. Indeed, SOX Section 302.2 says, “Establish safeguards to prevent data tampering.” You’ll be audited to determine whether you’re meeting this criterion. The best practice is to implement GRC software for SAP that tracks user log in access to any endpoint in the SAP landscape that has access to sensitive data. Section 302.4 adds to this, requiring that you “Establish verifiable controls to track data access.”
An SAP SOX Compliance Checklist and Solution in One
ControlPanelGRC® automates every step of the SAP GRC SOX compliance process. It provides risk evaluation, real time monitoring, and effortless reporting and risk remediation. Contact us for a free SAP GRC Risk Assessment to learn how your organization can remediate SoD risks and take the stress out of SAP SOX compliance.