What Does “Completeness and Accuracy” Mean in An Access Audit?13, October 2016
If you have any involvement in conducting or preparing for your company’s next access audit, chances are you often hear the phrase “completeness and accuracy.” This is because, as with any audit that examines large amounts of system-generated data, how complete and accurate the data is will largely influence how confident auditors are with it, and therefore the outcome of the audit. Tommie Singleton, CISA, CGEIT, CPA put it quite clearly in this 2014 ISACA Journal article: “It is the completeness and accuracy of the information in the report upon which the auditor is relying. Accuracy alone is insufficient. One needs to obtain assurance about both the completeness and the accuracy.”
So, what does completeness and accuracy exactly mean when you are dealing with the specifics of an SAP access audit? Recently, we teamed up our partners over at Grant Thornton LLP to dive deeper into this topic, and more importantly give some “tips and tricks” that will help you with the auditors, from the auditors. In this webinar, which is now available as a recording, Ben Harder, Regional Managing Director IT Assurance at Grant Thornton LLP goes into detail about the nuances of SAP that usually catch their attention, and how to address them for the audit.
According to Ben, audit firms are expecting companies to have stronger controls over access programs and data and have detailed procedures in place to handle specific risks. He says that auditors will most likely use automated tools to perform their audit, which means that if companies are using manual processes, the audit firm will most likely find something amiss in the access environment. “With SAP the problem is not getting data out of the system…what’s helpful is organizing and presenting the data in a fashion that can be understood by a technical and a financial person. In the 15 years that I’ve been doing this I have not seen a better example of this than with ERP Maestro.”
To see what else Ben had to say about what auditors look for, as well as examples of the ERP Maestro reporting he is referring to you can view the full webinar here.