ERP risk and controls automation

Rely on our proven methodology and industry-leading systems to help with governance, risk and compliance (GRC) tools, including GRC tool selection, rule-set implementations, assessments and designing GRC programs to maximize your GRC tool investment.

If you have a governance, risk management and compliance tool, we can:

• Perform GRC rules checkups with your tool. Following organizational or system functionality changes, RSM can test for GRC rule changes.
• Increase current tool’s value. We’ll help to identify ways to obtain maximum value of your current tool with RSM’s operational GRC tool assessment.

Considering purchasing a GRC tool? RSM can provide:

• Guidance. We’ve worked with numerous tools, and our "scorecard" approach helps you identify the best GRC tool to purchase for your ERP based on risk appetite, regulatory requirements and budget.
• GRC rule implementation assistance. When it’s time to design and implement GRC rules to satisfy your regulatory compliance needs, we can provide practical advice to make the process easier.

If you don’t have security and controls monitoring tools, RSM can perform annual or periodic ERP security controls monitoring (ESCM) to quickly detect:

• ERP segregation of duty (SOD) conflicts and unrestricted access. We can identify and remediate security conflicts or identify mitigating controls in your ERP system. Also, we can help prevent over-analysis of false positive/false negative results by customizing rules for future use to meet your needs.
• SAP security vulnerabilities. RSM uses tools and methodologies to assess your SAP system, perform scans of configurations, secure authorizations and uncover critical security-related OSS notes. Also, we help to identify potential risk exposure to internal and/or external hackers with reports based on NIST and/or SOX.

Designing ERP controls and optimal controls testing for complex ERPs are daunting tasks. Our professionals deliver superior risk controls services including:

• Conducting comprehensive review of business controls framework to identify and fix automated control design gaps
• Assessing extent of controls failure during pre-implementation controls design or post-implementation controls
• Determining extent of automated controls failures using “look-back” testing to identify fraud, business issues or other failure, such as duplicate posting of manual journal entries or duplicate payments
• Assessing or monitoring ERP security controls using RSM’s automated tools