Control is always rewarding

Some people may disagree with this statement, but it is a fact.

Internal controls are the processes implemented by companies to ensure their objectives are met. They are the parts of the business process which provide mechanisms that could prevent inaccuracies or frauds, whether they were triggered by mistake or not.

Preventive v/s Detective controls 

In general, controls can be classified as preventive or detective. Preventive controls avoid things from happening, while detective controls identify things that have already happened.  Clearly, preventing fraud or financial errors is better than discovering them after they have already occurred. 

IT Controls

These prominent controls do not directly affect transactions and financial statements, but indirectly make them possible to rely on all the automated processes and controls built in a SAP environment. General controls typically consist of security and access controls, change management and operational controls. 

Types of access controls

Let´s discuss the different types of access controls

Preventive

1. In the system configuration: they refer to the flow of the business process that places a control (i.e. the release of purchase orders)
2. Transactional: controls that operate on a transactional basis.

• Granted access approval: this must be supported by a risk analysis regarding access already granted and new access to be granted.
• Access termination: removal of the access when it is no longer required.

Detective

1. Periodic reviews: analysis of access configurations to identify errors.

1. User accesses: do you use your delivered accesses? Do you have excess accesses assigned?
2. Critical accesses: a review of users with elevated accesses. This allows users to change the way the system operates.
3. Segregation of duties: a review of users with access to combinations of transactions forbidden by the company (i.e. when creating a supplier, paying a supplier or approving a payment)
4. Security configuration: a review of the system configuration that supports access, such as password policies, workflow, etc.

2. Automated monitoring: to identify errors, misuse of transactions, attempted use of unauthorized transactions, use of critical transactions and SOD conflicts.

Any of the controls mentioned above (preventive or detective) can be implemented in an efficient and effective way with the support of CentinelBox: a software tool that helps to identify risk. The benefit will come as the result of reducing errors and fraud.