Receive CohnReznick insights and event invitations on topics relevant to your business and role.
01/06/2021
Case Study: Reduce costs and time spent on SoD management with efficient, automated solutions and processes
Challenge
A large retailer with annual sales of nearly $2 billion across 1,000 retail stores in North America lacked enforcement of segregation of duties (SoD) policies across financial applications, as well as an approach to monitoring and reporting SoD violations.
The organization’s external auditor, as well as management, determined that the retailer had material weaknesses in internal controls related to SoD and access management. Under the Sarbanes-Oxley Act (SOX), publicly traded companies like the retailer are required to disclose any material weaknesses to the Securities and Exchange Commission (SEC), which can negatively impact stock prices and investor confidence, and potentially increase external audit and legal fees. A lack of effective SoD and access management controls can also make it difficult to detect internal fraud, another red flag for investors.
Compounding matters, the retailer lacked an automated reporting system to review its millions of transaction records for violations. Manually collecting that data from disparate files and areas was prone to error and resource-intensive, requiring hundreds of work hours per month.
After a costly but ineffective first effort to design and implement a process to manage these challenges, the organization asked CohnReznick to help remediate the internal controls weakness around SoD violations and reporting.
Synopsis
CohnReznick’s Risk Intelligence and Automation services helped solve this specific challenge by developing a customized solution that addressed the business’s ongoing need for security controls and real-time monitoring of all financial transactions conducted by all users.
To do so, our team worked with Pathlock (formerly Greenlight Technologies), a third-party firm that provides a technology platform to monitor user access permissions for SoD conflicts in and across applications. In collaboration with the retailer’s stakeholders, our team developed a solution utilizing Pathlock's automated business control platform for transaction monitoring, which provided 100% visibility across 23 key financial risks and monitored millions of transactions in the organization’s enterprise resource planning (ERP) environment.
As part of this effort, the CohnReznick team helped develop processes and procedures for automated monitoring of user activity and access violations. Our team also helped design SoD business processes and limit employee user access to only applications necessary for their roles. Furthermore, we integrated the Pathlock control automation and SoD processes with the organization’s ERP system to help provide complete visibility across all transactions and all users within the ERP that were directly tied to the 23 key financial risks impacting the retailer.
Throughout the design and supplementation phases, our team identified and remediated transaction- and access-related issues and irregularities in the client's ERP system. We also developed a training and operational handbook, and provided training to the organization’s employees. We continue to advise the organization’s staff on fast and accurate delivery of its monthly and quarterly reports.
Results
Armed with an efficient, accurate system for monitoring and responding to SoD conflicts within and across applications, the retailer now has complete visibility across all transactions and all users within the ERP landscape tied to the 23 key financial risks. This new capability has helped the organization reduce the time and resources needed to identify, remediate, and report SoD violations and associated risks.
Since the new reporting system went live, the organization has substantially decreased the time required to gather and analyze data and run reports. In their first quarter, for instance, the company completed reporting within two weeks. By the third quarter, the organization gathered data and ran reports in just a few hours. What’s more, the new solution helped reduce the cost of access violations by almost 98% within a 10-month period. It also helped lower the cost of external audits by automating monitoring of transactions and performing transactional testing, as well as providing timely reporting to auditors.
With a faster, more efficient tool to help accurately identify users violating SoD, the retailer can now focus on investigating verified violations and can limit user access to only the functionality needed for specific jobs. Armed with this integrated solution, the organization can actively and efficiently monitor for and quickly mitigate SoD and other control violations while reducing its risk exposure, ultimately resulting in positive financial outcomes.
Business breakthroughs
- Reduction in the time and resources needed to identify, remediate, and report SoD violations and associated risks
- Enhanced ability to focus investigations on verified violations and to grant user access only to those needed for specific jobs
- Decreased the cost of access violations by almost 98% within a 10-month period
Contact
Bhavesh Vadhani, Principal, National Director, Cybersecurity, Technology Risk, and Privacy
703.847.4418
Subject matter expertise
Bhavesh Vadhani
CISA, CRISC, CGEIT, PMP, CDPSE, Principal, Global Leader, Cybersecurity, Technology Risk, and Privacy
Close
Contact
Let’s start a conversation about your company’s strategic goals and vision for the future.
Please fill all required fields*
Please verify your information and check to see if all require fields have been filled in.
Related services
This has been prepared for information purposes and general guidance only and does not constitute legal or professional advice. Neither CohnReznick LLP or its personnel provide legal advice to third parties. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is made as to the accuracy or completeness of the information contained in this publication, and CohnReznick LLP, its members, employees, and agents accept no liability, and disclaim all responsibility, for the consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it.