www.pwc.be/erp Pave the way: Build a value driven SAP GRC roadmap March 2015
Agenda Introduction Measuring GRC Progression & Benchmarking GRC Program Roadmap Building a Business Case 2
Introduction Pave the way At the end of this session We intend to provide you with the techniques and good practices to help you in building a business case and a roadmap for your GRC program and technologies. We will explore the types of approaches that can be adopted to synchronize your organization in order to streamline activities, create efficiencies, enable effective reporting, and avoid redundancy. 3
Measuring GRC Progression & Benchmarking 4
Measuring GRC Progression Automation Where do you fit on the scale? GRC Technology Enablement 5
Control Mix Benchmarking 600 70% 500 60% 400 50% 300 200 Average Automation 40% 30% 20% 100 10% 0 C1 C2 C3 C4 C5 C6 C7 C8 C9 Auto Controls Manual Controls % Automation 0% It is important to bear in mind that control standards will differ from client to client, and different individuals may even classify the same control differently, however we can still draw some broad conclusions. 6
GRC Program Roadmap An Example 7
GRC Program Roadmap Example Introduction Identify redundant controls, areas for risk & controls consolidation, and controls which can be centralized. Provide recommendations and rationale for which controls should be removed or streamlined. Identify maximum documentation requirements to enable documentation once. Leverage GRC Technology to support the to be control framework and evaluation of that framework. Identify Continuous Control Monitoring opportunities. Risk Assessment & Analysis of Existing Controls 1 2 Risk & Controls Alignment 3 Automation of Controls & Streamlining Processes 4 GRC Technology Enablement 5 GRC Program Maintenance Gain an understanding of risks and controls. Analysis of risks and controls against industry and leading practices. Provide recommendations and rationale for: - Missing risks; - Duplicate risks; - Any recommended changes to risk rating. Identify areas where automation could be leveraged to reduce existing control effort. For example: - Workflow enablement of manual controls; - Preventive configuration in the system; - Restrictions of Access; - Segregation of Duties ; - Near real-time analytics; - Workflow tooling (central provisioning, emergency user management, etc.). Document business case and roadmap to implement recommendations. Establish practices to maintain your control framework s design and keep it relevant. For example: - Incorporation of business, regulatory and technology changes; - Issues found incorporated into control design to prevent reoccurrences. Sustainable and efficient governance over the GRC technology 8
GRC Program Roadmap Example Ownership An important piece of the GRC roadmap is establishing clear ownership and accountability. Ownership completely depends on the size and structure of the organization. There is not a one size fits all. Here are some things you need to consider before initiating your program: Compliance Team: If established and separate from Internal Audit, typically we see the compliance function own risk identification and the GRC program. Business Users All business units have responsibility for operation of controls. Finance have greater responsibility from a compliance perspective. If separate compliance function does not exist, typically risk identification and GRC program falls under finance. IT Team: IT own the technological components and support the technology utilized for the GRC program. Internal Audit: Internal audit has a stake in compliance and the GRC program to help establish that the controls are operating effectively. 9
Building a Business Case 10
Importance of the business case Today s Control Environment Improved, robust, and efficient controls that leverage increased automation are becoming critical as the number and complexity of risks increase for companies. Companies need to invest in a technological infrastructure that supports increased automation, better reporting, and stronger overall controls governance. Challenge Such initiatives are often shot down in the annual budgeting process as they compete with other company priorities. Companies are often only willing to invest in such technologies as a reactive response to audit or compliance failures; or worse public embarrassment. Solution Developing a strong business case with proper financial metrics can help pave the way for more proactive and progressive investments in controls automation technology at your company. 11
Building a business case The process Steps to Build the Case: 1. Define the opportunity 2. Identify your options 3. Gather information on your options 4. Analyze the information on your options 5. Choose an option and assess the risks 6. Create a high level implementation plan 7. Communicate your case Key Financial Metrics Payback Period Net Present Value Return on Investment 12
Building a business case ROI Framework for automated controls Return on investment (ROI) A financial ratio measuring the cash return from an investment relative to its cost for a stated period of time. Estimate Monetary Benefits of Automated Controls Benefit Area FY '15 FY '16 FY '17 FY '18 FY '19 Notes / Total Continuous Control Monitoring Cost savings by enabling CCM on existing controls Cost savings by converting manual controls to automated resulting in reduced operation cost associated with execution of controls Cost savings by converting manual controls to automated resulting in reduced testing cost Cost savings due to continuous monitoring Data Analytics Cost savings by enabling data analytics mechanisms (includes operation and testing savings) Cost savings due to data analytics Cost Savings & Direct Benefits 58,080 58,080 58,080 58,080 58,080 23,040 23,040 23,040 23,040 23,040 14,080 14,080 14,080 14,080 14,080 Existing 33 automated controls will be subjected to CCM. 8 manual controls can potentially be converted to automated controls. 8 manual controls can potentially be converted to automated controls eliminating need to perform periodic substantive testing at each in scope location. 95,200 95,200 95,200 95,200 95,200 476,000 25,000 25,000 25,000 25,000 25,000 Assuming 25,000 analytics would be developed for XYZ. 25,000 25,000 25,000 25,000 25,000 125,000 * For illustrative purposes only 13
Building a business case ROI Framework for automated controls Estimate Monetary Benefits of Automated Controls In building the business case a number of assumptions have been made in order to provide a comprehensive calculation of all the benefits and costs. Some of the assumptions listed below are derived from our experience but can be amended according to company s specific requirements and characteristics. # Description Assumption 1 Average time testing each control (documenting and reviewing results) 8 2 Average number of times the controls are tested per year 2 3 Average time updating supporting controls documentation 2 4 Average time spent around remediation, reporting and decision making 2 5 Average monthly time spent to execute and document a manual control 3 6 Average hourly cost per employee 80.00 7 Average hourly cost for contractor assistance 200.00 8 Employee / Contractor Ratio 3 9 Weighted average cost per hour blend b/w employee/contractor 110.00 10 Increased effectiveness of Internal Audit by leveraging GRC 10.0 10% * For illustrative purposes only 14
Building a business case Lessons Learned Know your audience! Anticipate difficult questions ahead of time and provide appropriate information that aligns with the style of your leader. Cross-functional collaboration and support can be critical. Understand the organizational impacts of what is in your business case and engage with impacted stakeholders for support. The more subjective the estimate, the more communication and collaboration is recommended prior to submitting the case to senior leadership. Clearly define and communicate assumptions that support estimates to gain others confidence in your numbers. Know the budgeting process and budgeting calendar. Plan ahead! Get help from trusted advisors with appropriate subject matter expertise. Talk to other companies with experience in implementing automated controls technologies to establish additional internal credibility. 15
Your Questions 16
SAP GRC webcast series: Looking to better manage and govern access risk? Date & time 12 March 2015 12:30pm 13:30pm What s in it for you? Discover SAP GRC 10.1 functionality via a live demo Learn about best practices to upgrade from older SAP GRC versions to version 10.1 Interact in real time with experts with extensive hands-on SAP GRC experience Understand the latest SAP GRC Access Control 10.1 functionality and how it can help you improve access management processes Understand the upgrade track from older SAP GRC versions to v10.1 To subscribe to 's SAP GRC Webcast series please visit: http://www.pwc.be/en/pwc-academy/sap-webinar-grc.jhtml Enter your email address to create or update your profile and manage your subscriptions. 17
For further information, please contact: Wim Rymen Director Office: +32 (0) 2 710 7238 Cell: +32 (0) 473 269 227 E-mail: wim.rymen@be.pwc.com Kris Wauters Manager Office: +32 (0) 2 710 4631 Cell: +32 (0) 499 558 949 E-mail: kris.wauters@be.pwc.com 18
The information contained in this document is shared as a matter of courtesy and for information or interest only. has exercised reasonable professional care and diligence in the collection, processing, and reporting of this information. However, data used may be from third-party sources and has not independently verified, validated, or audited such data. does not warrant or assume any legal liability or responsibility for the accuracy, adequacy, completeness, availability and/or usefulness of any data, information, product, or process disclosed in this document; and is not responsible for any errors or omissions or for the results obtained from the use of such information. gives no express or implied warranties, including, but not limited to, warranties or merchantability or fitness for a particular purpose or use. In no event shall be liable for any indirect, special, or consequential damages in connection with use of this document or its content. Information presented herein by a third party is not authored, edited or reviewed by and is not endorsing third parties or their views. Reproduction of this document or recording of its presentation, in whole or in part, in any form, is prohibited except with the prior written permission of. Before making any decision or taking any action, you should consult a competent professional adviser. 2015 PricewaterhouseCoopers LLP. All rights reserved. refers to the United States member firm, and may sometimes refer to the network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details.
Appendix GRC Program Roadmap 20
GRC Program Roadmap Example Risk Assessment & Analysis of Existing Controls 1 Risk Assessment & Analysis of Existing Controls What do we see? Value: Objectives: Risk Assessment focused on SOX only, but not relevant to other areas of the business. Not used to prioritize controls coverage or GRC enablement. Not granular enough to be an actionable tool. To acquire deeper insight in your processes, risks and existing controls. To socialize and obtain agreement on risks and risk ratings as this assessment forms the basis for the control analysis performed in subsequent phases of the project. Recommended: Streamlining of risks to help establish risks that meet multiple objectives (financial and operational) are identified. Gap analysis of risks against industry and SAP leading practice to identify any other areas for consideration. Alignment of SOX/compliance initiatives with other process improvement initiatives. Risk assessment to consider compliance and operational initiatives. This would allow you to identify areas of redundancy across regulatory / operational objectives and improve the rationalization effort. This could be utilized as the first step in building a business case for expansion of your GRC footprint. 21
GRC Program Roadmap Example Risk Assessment & Analysis of Existing Controls (continued) Output Benchmark against other clients in the industry and SAP Optimized. Assessment to determine whether the risks within the organization have been appropriately recognized. Examples of output includes but is not limited to: - Missing risks; - Duplicate risks; and - Any recommended changes to risk rating. 0% Benchmark Percentage Automation 70% 60% 50% 40% 30% 20% 10% Client Utility 1 Client Utility 2 Client Utility 3 Client Utility 4 Utility 5 Client 5 Current Client 6 Reccom Client 7 Utility 6 Client 8 Optimized SAP Client 9 Example deliverables illustrative only 22
GRC Program Roadmap Example Risk & Controls Alignment 2 Risk & Controls Alignment Objectives: Identify opportunities where controls could be eliminated or consolidated and new controls are required to mitigate new risks. Streamline controls to enable efficiencies in controls management. What do we see? Focus on # of controls, as opposed to the right controls to mitigate the risk. Access controls are not aligned to risks Controls are mapped to risks, instead of risks driving controls Recommended: Thorough initiative to align controls to the organization s risks. This would enable you to identify areas of redundancy across regulatory / operational objectives and improve the rationalization effort. The risk and controls alignment could be used as the foundation for an initiative by way of establishing key access control objectives across process and regulations. Value: Potential reduction and consolidation of controls. Potential reduction in time spent operating and evaluating the current framework. Less likelihood for audit conversations about control issues for controls which are not really key. Template to achieve coverage for any new areas. 23
GRC Program Roadmap Example Risk & Controls Alignment (continued) Output Assessment to align controls to risks. Examples of output include, but is not limited to: - Controls which could be eliminated or consolidated. - Controls which could be improved through better leverage of current technology (such as further automation).; and - New controls required to mitigate new risks. An example of this includes: Control Recommendations - Overview Controls Automation of controls Manual report procedures Current State 260 Key Controls for SOX 21% Automated Controls 48 key reports for SAP Example deliverables illustrative only Recommended State 87 Key Controls for SOX 52% Automated Controls 33 of 48 have automation or event based reporting opportunities Client assessed restrictive access to a PO and segregation of duties between maintain/approve PO in order to mitigate the risk of POs being inappropriately approved. The control was incomplete because the release strategies were not configured. 24
GRC Program Roadmap Example Automation of Controls & Streamlining Processes 3 Automation of Controls & Streamlining Processes What do we see? Objectives: If it's not in SAP, it cannot be monitored. Controls governance model is not widely established or aligned. Business case does not exist or is not tangible. Identify controls which could be enhanced through better leverage of current technology. Advise management of improvements that can be made which would require additional efforts. Identify requirements and build a business case to obtain funding for any recommendations. Recommended: Perform an automation assessment. This will enable you to identify opportunities to reduce effort around sustaining the environment and operating controls and processes. Consideration should be given to a pilot process. This has a few advantages such as allowing for a prototyping approach, starting with a smaller investment, and enabling the development of a business case with real achieved business savings. Value: Increased leverage of SAP automation and investment. Potential reduction in time from the business to operate controls and processes. Automation at higher levels to help establish consistently implemented configurable controls. Transition from decentralized controls to centralized risk and controls. 25
GRC Program Roadmap Example Automation of Controls & Streamlining Processes (continued) Output Output includes changes to controls. Examples include, but are not limited to: - Controls and processes which can be automated in SAP or other technology An example of this includes: Client placed a high amount of rigor in a number of manual physical inventory controls in order to gain comfort around the accuracy of their inventory balances. The recommendation removed emphasis on time consuming processes and instead identified an opportunity to automate inventory cycle count initiation; - Controls and processes which can be automated in GRC. An example of this includes: Client whom currently spends a significant time manually provisioning users, utilizing a GRC tool to preventatively assess SoD and sensitive access. This review identified an opportunity to enhance existing technologies to automate user provisioning through workflow; - Event-based reporting opportunities; - Workflow enablement for manual controls; and - Continuous control monitoring (CCM) opportunities for current and proposed configurable controls. For automation opportunities, effort efficiency estimates can be provided to compare existing state to proposed state, enabling management to prioritize activities. Efficiency Estimates (Example ITGC Process) - Overview Hours a year Change management 2,992 374 User access management Days a year 15,471 1,934 Systems management 1,012 126.5 Total 19,475 2,435 Example deliverables illustrative only 26
GRC Program Roadmap Example GRC Technology Enablement 4 GRC Technology Enablement Objectives: Identify new and existing technologies to support your rationalized and improved framework together with your processes. What do we see? Systems and functionality selected before requirements are defined. Biting off more than you can chew. Unrealistic expectations. Recommended: Utilize the recommendations from the prior phases to develop the indepth path and multiyear year plan. Facilitating a deep dive into at least one of business processes will enable you to have the tangible understanding of types of technology you would want to consider and potential efficiencies of these enhancements to establish business case and prioritization. This plan can be revised and enhanced as you analyze the other processes. Value: Early detection and remediation of control issues. Increased return on the GRC investment by way of expanding the functional use to support and monitor the control framework. Potential operational, financial and regulatory compliance efficiencies can be realized by automating various time-consuming processes. 27
GRC Program Roadmap Example GRC Technology Enablement (continued) Capabilities Assessment: Inventory requirements and plot these against existing and potentially new technologies. Set expectations of what the solutions will and will not do in terms of capabilities. Tooling Requirements Existing Technology Enhance Existing Technology SOD / Sensitive Access Detective Reviews Solution A New Technology Emergency Access Management Solution A Controls Documentation in GRC tool Workflow Enablement Of Manual Controls Solution B Prioritize and Determine optimum sequence: Prioritize the actions with a focus on return on investment or alternatively,business issues. Organization needs to understand impact of extending usage of existing technologies and introducing new technologies Based on the impact and prioritization a sequence should then be defined to facilitate effective and efficient integration. 28
GRC Program Roadmap Example GRC Technology Enablement (continued) Output Overall program business case for supporting the control environment and supporting processes with GRC technologies. This will take into consideration the risks and regulations of the organization. A phased technological roadmap with sequenced activities based on prioritization. A target operating model (TOM) for the GRC program covering most aspects of control management and GRC usage. 29
GRC Program Roadmap Example GRC Program Maintenance GRC Program Maintenance Objectives: Establish practices to maintain your control framework s design and keep it relevant. 5 What do we see? Ongoing GRC program does not have proper alignment with management s strategy. The deployed governance model is not living and breathing. Recommended: Maintenance program should include: i. Definition of policies and procedures to incorporate embed technologies within governance model. ii. iii. iv. Establish protocols to incorporate new risks, controls and business changes as a company grows and matures. Establish IT management procedures for ne w technologies. Identify GRC stakeholders to facilitate adequate involvement from the business, integration with IT, internal audit and compliance, and value to the organization on the whole. Establish a GRC Operating model to maintain the GRC program and roadmap. Value: Less likelihood of a need for a risk rationalization in future years as it will be part of on-going maintenance. Potential reduction in cost to sustain environment and compliance. 30