FulcrumWay - Planning to Implement, Upgrade or Deploy a New ERP System?

Leverage T echnology: Turn Risk into Opportunity™

Risk and Compliance Financial Reporting Internal Audit Controls Catalog Application Security Advanced Analytics

A Leader in Risk Based Enterprise Controls Management Solutions

Copyright ©. Fulcrum Information Technology, Inc. Give me a lever long enough and a fulcrum on which to place it, and I shall move the world - Archimedes

Planning to implement, upgrade or deploy a new ERP release? Learn to control project costs and risks with effective configuration controls management approach

Webinar – May 20th , 2014

Adil Khan

Managing Director

www.fulcrumway.com Page 2 Copyright © FulcrumWay

Control ERP Project Costs and Risks

Introductions

Top ERP Project Challenges

Configuration Management Approach

Overview of Configuration Controls Governor

Case Study

Q&A

Agenda


A Leader in Risk Based Controls Management™

FulcrumWay: is the #1 End-to-End Provider of Risk Based Enterprise Controls Management

Solutions for Oracle EBS, PeopleSoft and JDE customers with over 200 Fortune-500 to Middle Market

clients. Since 2003, we have successfully assisted companies across all major industry segments.

Expertise: Risk Advisory Services. Advanced Controls Design for Enterprise Applications. Best

Practices for Risk Mitigation and Internal Controls Automation. Audit, Compliance, Financial,

Enterprise and Operational Risk Assessments. Risk Remediation Services.

Packaged Solutions: FulcrumWay is the #1 choice of Oracle customers for Oracle GRC Advanced

Controls, GRC Manager, and GRC Intelligence/OBIEE software implementation. Oracle has certified

us as the only partner with Accelerators for Oracle GRC. We also provide Managed Services

Software Services: Risk Assessment for ERP systems, Control Design and Management Tools,

Controls Catalog, Enterprise Risk Manager, Financial Reporting Manager, Audit Manager

USA Presence: Privately held Delaware Corporation with US offices in New York City, Dallas and San

Francisco

International Presence: in Auckland, Chennai, Johannesburg, London, Mexico City

FulcrumWay


FulcrumWay Clients Successful

Track Record Government Oil and Gas

Healthcare

Communications

Financial Services

Transportation Natural Resources

Manufacturing

Retail

High Tech Media/Entertainment Life Sciences

http://www.rd.com/

http://www.arvinmeritor.com/

http://www.semiconductorstore.com/pages/asp/supplier.asp?pl=0133

http://www.integralife.com/index.aspx


FulcrumWay™ Insight

Thought Leadership

Co-Authored GRC Book: First book on GRC for Oracle Applications

SROAUG GRC Solution Lab - February 21st – Los Angels: GRC Case Studies and Best Practices

Collaborate 14 – GRC Client Appreciation Dinner April 7th, 2014 Las Vegas

NEOAUG Spring Conference – June 9th – Worcester, MA -GRC Case Studies and Best Practices

IIA/ISACA GRC Conference – August 19th, 2014 - Presentations – Five New Ways to Assess the Risks that Can Turn Results into Rewards

Webcasts – Every 3rd Tuesday of the Month – GRC Best Practices, Trends and Expert Insight

Oracle Open World – Annual GRC Dinner on September 29th, 2014 - San Francisco, CA

LinkedIn –FulcrumWay Risk, Compliance and Audit Software Group

YouTube Podcasts – FulcrumWay Instant Insight in 10 min or less

Proven Expertise



Introductions




Case Study

Q&A

Agenda


Top Project Challenges

Had functionality work in Dev but not in Prod.

App customizations are lost or broken after upgrading to new release.

App functionality works in version 11.5.10 but not in R12

App setups are changed without authorization.

Not able to validate setups to auditor or business.

App is no longer functioning properly and there’s no record of what changed.

Had documentation (BR100) that was out of date

Applied a patch and not known full impact.

Had project overruns and production downtime.

Missed deployment milestones for rollouts and upgrades because of manual effort.


Top Project Challenges

Security Access Risks.

Inconsistent Oracle configurations Risks

– Inconsistencies between instances / Ledgers / legal entities

– Inaccuracy of configurations in production.

– PROD issues discovered after go-live

ERP Roll-out Risks

– Longer Roll-out Time and Higher support issues (SRs)

– Ineffective Change Management for ERP configurations

– Actual Application Setups not the same as the documentation

Process and Policy Compliance Risk

– Approved Process Design and Policies not enabled in ERP Application

Go-Live Audit Risks

– Auditors Find Control Weakness in Review of ERP setups


Impact of Misconfigurations on project Configuration

Management

You can control project risks and costs by monitoring configurations when

implementing an upgrade of ERP or a new application.

Solu

tion D

efinitio

n

Build

Build

UA

T

Imple

ment

Go L

ive

Project life cycle Project life cycle

During During development development

Post Post imp. imp.

Pre Pre - -

high high

finish finish start start

low low

Solu

tion B

lueprint

Test

Imple

ment

Go L

ive

Co

st

of

Co

nfi

gu

rati

on

Ch

an

ge

s

Project life cycle Project life cycle

During During development development

Post Post imp. imp.

-

Pre-implementation

high high

finish finish start start

low low

De

sig

n



Introductions




Case Study

Q&A

Agenda


Configuration

Management Software Development Life Cycle (SDLC)


Projects fail without SDLC Controls Configuration

Management


Application Implementation Method Configuration

Management


Application Implementation with SDLC Configuration

Management

Phase Time J F M A M J J A S O N D

Requirements

Design

Configure Build

Test

Deploy

Discover Configurations

Document Configurations

Test Configurations

Compare Configurations


Fit/Gap

Analysis

Design

Workshops

(CRP)

Unit/

System

Test

Go-Live/

Production

Support

Discover

Configurations

Security

Master Data

Value Sets

Discover

Report

Interfaces

Customizations

Extensions

Configure/

Build/

Extend

User

Acceptance

Design / Implement Discover/Assess Deploy/Maintain

DataProbe Analytics

Configuration

Snapshots Monitor SDLC

Test / Accept

Automated Configuration Management Configuration

Management

Establish

Application

Baseline


Automate Configuration Management? Configuration

Management

Automated Approach

Configuration management is integrated throughout

the implementation. Design decisions are

augmented with real-time analytics, configurations

are verified with a specific focus in testing and

training, and confirmed with post go-live reviews. • Provides most effective configuration baseline

• Minimizes project team re-work

• Long-term cost is lower

• Leverages implementation momentum to make

SDLC control improvements

Manual Approach

The configuration errors are discovered and

corrected after the production system is live. A

SWAT team approach is employed to cover all of

the areas at once. • Less impact to the project team and project

timeline

• Less up-front effort

• Review can be performed against some history

(i.e., has the risk area manifested?)

Time

$

“Manual”

Approach

“Automated”

Approach



Introductions




Case Study

Q&A

Agenda


Enterprise Controls Platform Advanced

Controls

Manage Data Integrity

Enforce Change Control

Monitor Configuration

Changes

Document or Compare

Configurations

Configuration Controls Ensure Integrity of Critical Application Setups

• Tightly control change management to accelerate development and test time

• Track complete audit trails for changes to key configurations

• Achieve consistent application setup and operating standards across multiple instances

Define Configuration

Controls

Detection Prevention

GRC Manager

SOD & Access

Application Configuration

Transaction Monitoring

GRC Intelligence

Advanced Controls

Preventive Controls


Configuration Controls Advanced

Controls



Controls



Controls Compare Configurations

Differences


Business application does not keep a record history of change details nor does it alert users to changes.

Continuously Monitor Controls

When?

What?

Where?

Who?



Controls

Advanced Controls High-level Architecture

Advanced Controls

Suite

APP

SERVER

TEST (EBS R12)

ERP Agent

DEV (EBS R12)

ERP Agent

PROD1 (EBS 11.5.10)

ERP Agent

PROD2 (EBS R12)

ERP Agent


Is Your ERP Leaking Cash?

Introductions

Top Procure to Pay challenges in ERP

Overview of Payable and Purchasing Controls

Advanced Controls Analytics

Case Study

Q&A

Agenda


Silicon Image Case Study


Application Control Environment

ERP System Release 11.5.10 (Upgrading to R12)

Modules 30+

Total Roles/Responsibilities 423

Total Users 65

Access Controls Total Access Policies 18

Total Role level policies 8

Total BU’s supported in ERP 4

Total Privileged Users 6

Access Monitoring Detective Testing Frequency Monthly/quarterly

Preventive Testing Capability

Application Controls Configuration Controls 9

Transaction Controls NA

Other Change Controls NA

Total Waived Users

Application Monitoring Detective Testing Frequency NA

Preventive Testing Capability NA

Notification Optional would like to implement after business input

Case Study


FulcrumWay Oracle High level Plan for Oracle

Configuration Controls Governor

Control Design

Configuration

Test and Accept

Knowledge Transfer

Controls Analysis

Project Plan

Resource Plan with

Roles and

Responsibilities

Quality Assurance

Scope Configuration

Setup Application

Test Environment

Select, Add and

Manage Controls for

EBS Application

Instance

Setup Test

Environment

Finalize project plan

Define Compensating Controls

Scoping and Design for

Snapshots by Application

Owners

Scoping and Design for

Change Tracking by

Application Owners

Scoping of Alerts for Change

Tracking

Security for CCG

Setup Configuration Controls

Build Walk-through

Configuration and Testing of

Snapshots

Configuration and Testing of

Change Tracking

Setup Test Instance

Test Roles

Test Users

Assignments

Test Configuration

Controls

Setup Acceptance Test

Resolve Issues

Roll out new system

Deliver User and

Admin Training

6/18/12

6/25/12

7/2/12

7/16/12

Go Live

9/30/12

Case Study


Manual Configuration Management Case Study


Configuration Report Case Study






Is Your ERP Leaking Cash?

Introductions

Top Procure to Pay challenges in ERP

Overview of Payable and Purchasing Controls

Advanced Controls Analytics

Case Study

Q&A

Agenda


Leader in Risk Based Enterprise Controls Q & A

One-on-One with Experts Download DataProbe

Follow FulcrumWay on LinkedIn for ERP Risk and Controls