ERP implementation risks

RSM’s IV&V assessment methodology is based on the Institute of Electrical and Electronics Engineers (IEEE) standards for software verification and validation, but is enhanced with several frameworks including ISO2700, PMBOK/PMP, COBIT5, ITILv3, PROSCI, COSI, C-SOX, NIST, PCI and HIPAA. Our IV&V approach determines if the software, hardware, documentation and user requirements have been designed completely, accurately and consistently.

Our methodology is flexible to align with any ERP and any industry, with any type of project methodology (i.e., agile, waterfall or hybrid), upon which we then bring in ERP subject matter professionals when a deeper understanding of system functionality and options is needed. Our methodology is flexible; we work with many customers to customize our IV&V assessments to contain the specific areas of high risk that our customers would like us to focus on.

When choosing an out-of-the-box ERP solution, implementers are typically not responsible for compliant security or automated controls design or testing the effectiveness of controls before go-live. With an understanding of regulatory requirements such as C-SOX, JSOX and FDA, we can evaluate the controls environment, review design documentation and identify control objectives and control design activities. We can implement GRC technologies or utilize our own proprietary tool, RSM Guardian, to mitigate segregation of duties risk, or build bots to automate controls or test automated controls.

If resources or timeline constraints didn’t allow design controls during implementation or there are unexpected problems after your go-live, we can assess both the design and operating effectiveness of your controls post-go-live. Using our tools, we quickly assess your environment to identify automated or security controls to recommend specific improvements for remediating any control failures.