Do You Make These Global Trade Service Process Control Mistakes?[Checklist]

Written by Lonnie D. Ayers, PMP | Wed, Jan, 18, 2012 @ 03:40 PM

SAP GRC Process Control

SAP GRC GTS (Global Risk & Compliance, Global Trade Services) require that you have highly evolved, perfectly executable processes.

SAP GRC Process Control Documentation Self-Audit Questions

See if you find any of the following issues within your organization:

Not all processes are well-documented and stored in a central repository - including the documentation of policies, work papers, and evidence to meet the reporting requirements of Sarbanes-Oxley section 302 and 404.
Only some, not all processes comply with the Sarbanes Oxley (SOX) requirements 302, 404, 409 and 401.
Appropriate alerting capabilities are not automated to comply with SOX Section 409 (enable notification of investors of financial results without delay).

As a result, you cannot notify stakeholders of pre-defined exceptions in an automated fashion.
No automated testing procedures exist to test internal controls.
Business process managers are not accountable for control documentation and testing, versus Internal Audit or IT.
No comprehensive audit trail information exists to ensure compliance.
Control assessment visibility does not exist at Corporate Level.
Documentation is not scalable and reusable.
Exception based reporting is not implemented.
External Auditors cannot be provided with high quality, easy-to follow policy and procedure documentation.
Internal Audit and compliance resources utilization is not optimized.
Internal Audit does not perform audits regularly to cover the effectiveness and efficiency of operations, reliability of financial reporting, compliance with applicable laws and regulations, and safeguarding of assets.
Manual control testing is not streamlined with automated task assignments, guided procedures, or workflows.
The controls to be tested cannot be rationalized.
The majority of process control testing is not automated and cannot be scheduled for appropriate locations, business units, or legal entities.
The testing process does not enable continuous testing of key controls and periodic testing of non-key controls in a repeatable sustainable manner.

As you can see, there are numerous process controls you must get right for an effective GRC GTS Compliance environment to exist. We recommend you get SAP GRC expertise when it comes to implementing these processes.

Self-Audit Checklist

Ideally, they will be highly experienced in multi-national complex environments. In the meantime, we've converted the above recommendations in a more indepth self-audit checklist with actionable insight you can implement now within your own organization.

Comments and links are always welcome.