ERP in the Cloud_ck_v2
- 1. ERP in the Cloud Chris Kenny Manager, Technology Risk Services 11 October 2016
- 2. © 2016 Grant Thornton UK LLP. All rights reserved | Public Overview • Introduction • ERP and the cloud • Risks and Controls • Cloud ERP in practice – Case study • Final thoughts
- 3. © 2016 Grant Thornton UK LLP. All rights reserved | Public About Grant Thornton Grant Thornton UK LLP UK member firm of Grant Thornton International Ltd Turnover of £521 million Led by over 180 partners, with 4,500 people Operates from 26 offices
- 4. © 2016 Grant Thornton UK LLP. All rights reserved | Public About me • Eight years experience in internal audit • Manage the delivery of ERP, internal and external audit services across the Midlands region • CMIIA and CISA qualified
- 5. © 2016 Grant Thornton UK LLP. All rights reserved | Public What do we mean by ERP?
- 6. © 2016 Grant Thornton UK LLP. All rights reserved | Public Characteristics of an ERP system • single integrated database • modular • common user interface • follow good business practices • flexible and adaptable • workflow • automation
- 7. © 2016 Grant Thornton UK LLP. All rights reserved | Public Evolution of ERP • 1980's • mainframe • time sharing • finance orientated • green screen • 1990's • client-server • real-time • GUI • full business operations • 2010's • focus on UX • data analytics • the cloud • 2000's • web-enabled
- 8. © 2016 Grant Thornton UK LLP. All rights reserved | Public ERP in the cloud
- 9. © 2016 Grant Thornton UK LLP. All rights reserved | Public Cloud services Public Private Hybrid
- 10. © 2016 Grant Thornton UK LLP. All rights reserved | Public On-Premise Iaas Paas SaaS Application Database O/S Hardware ERP in the cloud example
- 11. © 2016 Grant Thornton UK LLP. All rights reserved | Public What does the marketplace look like?
- 12. © 2016 Grant Thornton UK LLP. All rights reserved | Public Business drivers Reduce costs Speed of deployment Scalability and adaptability Accessibility Modernity
- 13. © 2016 Grant Thornton UK LLP. All rights reserved | Public Risk & Controls
- 14. © 2016 Grant Thornton UK LLP. All rights reserved | Public Model of internal audit involvement Due diligence • Asses risk and control Project implementation • Asses risk and control Post implementation / BAU • Asses risk and control
- 15. © 2016 Grant Thornton UK LLP. All rights reserved | Public Customisation & integration Performance, cost and SLAs Information governance Information security Business & strategic fit Due Diligence
- 16. © 2016 Grant Thornton UK LLP. All rights reserved | Public Project implementation Risk management Internal controls Segregation of duties Gateway or milestone reviews
- 17. © 2016 Grant Thornton UK LLP. All rights reserved | Public Post-implementation / BAU Monitor security Change management Benefits realisation Contract management
- 18. © 2016 Grant Thornton UK LLP. All rights reserved | Public • obtain and review the SOC1/2 or equivalent • right to audit • change management • review the security model, including segregation of duties and starters / leavers • review change management procedures • involve other SME's: Legal, Data Protection, Project Management Key actions for internal audit
- 19. © 2016 Grant Thornton UK LLP. All rights reserved | Public Case study
- 20. © 2016 Grant Thornton UK LLP. All rights reserved | Public • Large subsidiary business unit of a FTSE100 retail business • Implementing Oracle Cloud ERP (HCM, Finance, CRM) • Newness of Fusion • Project management challenges Key issues and challenges
- 21. © 2016 Grant Thornton UK LLP. All rights reserved | Public • Required a wide-mix of skills within the audit team by reviewing areas including: ─ compliance with data protection legislation ─ disaster recovery ─ capacity and performance management ─ IT general controls and key financial controls ─ contractual arrangements between the client and Oracle. Our approach
- 22. © 2016 Grant Thornton UK LLP. All rights reserved | Public • Change of business case impacted project benefits and caused delays • PII accessible outside the EEA • Key financial controls not implemented correctly • Volume and completeness of UAT • RBAC and SoD issues • SOC 1 report out of date Audit Findings
- 23. © 2016 Grant Thornton UK LLP. All rights reserved | Public Conclusions
- 24. © 2016 Grant Thornton UK LLP. All rights reserved | Public The future • The inevitable cyber breach • death of on-premise – but not for a while! • the Internet of Things
- 25. © 2016 Grant Thornton UK LLP. All rights reserved | Public Conclusion • Cloud ERP presents a number of opportunities for organisations • Cannot outsource risk however! • Aim to be involved at all stages of the lifecycle
- 26. © 2016 Grant Thornton UK LLP. All rights reserved | Public Questions?
- 27. © 2016 Grant Thornton UK LLP. All rights reserved | Public Further Reading • ‘The Treacherous Twelve’ Cloud Computing Top Threats in 2016 ─ https://cloudsecurityalliance.org/download/the-treacherous-twelve-cloud- computing-top-threats-in-2016/ • 'Service Organization Control (SOC) Reports' ─ http://www.aicpa.org/soc
- 28. ‘Grant Thornton’ refers to the brand under which the Grant Thornton member firms provide assurance, tax and advisory services to their clients and/or refers to one or more member firms, as the context requires. Grant Thornton UK LLP is a member firm of Grant Thornton International Ltd (GTIL).GTIL and the member firms are not a worldwide partnership. GTIL and each member firm is a separate legal entity. Services are delivered by the member firms. GTIL does not provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions. grantthornton.co.uk © 2016 Grant Thornton UK LLP. All rights reserved | Public