Defining User access appropriateness confirmation process for organization

Challenge

I am a SOX compliance lead in a multi-national organization. As part of assurance on  Information technology general controls, organization need to ensure that all the ERP  accesses provided to its 20000 users (employees & others) at the point of verification, is  appropriate for the role which the user is playing. These are specific requirements sought by  statutory auditors considering significant importance of regulatory requirements to ensure  completeness and accuracy of the financial reporting numbers in the books of accounts and  other regulatory disclosures. For the year 2019-2020, my team along with IT application team  spent significant time to identify the users for whom access appropriateness confirmations  have to be obtained and approached various employees of the organization over emails / calls  to get this confirmation. Wherever the user confirmed that access of a specific user is  inappropriate, immediate revocation action need to be taken by BASIS team. Considering the  efforts put in FY19-20, we have decided to automate this entire process for FY20-21.

Selection

We have consulted multiple service providers and senior management personnel to  understand their perspective of this problem and analyzed various tools applicable to address  the problem, within assigned budget. One of the option was to develop the in house tool in  lotus notes application, which does not incur much cost, but the efforts required in  maintaining data base in line with ERP is phenomenal. Alternate approach was to deploy GRC  access control application applicable for existing ERP package, which already has all the data  flowing from existing ERP and hence, no additional efforts required in maintaining data base.  We went ahead with access controls in GRC module and engaged a consultant to implement  the same.

Application

Initially IT application team was resistant to go ahead with this application due to some  practical challenges, like they want to exclude some select users for appropriateness  confirmation (like senior management personnel, employees for whom reporting managers  are not mapped in ERP, etc.,). After discussing with consultants and HR teams, we finalized  an approach to eliminate some users in this process and initiate confirmation process to  remaining users.

Insights

During the discussions, we have also noted some of the best practices that we are not  following. Current access granting mechanism in the organization did not define role owner,

who has to review the roles which user is requesting and question whether such access need  to be given or not and accordingly approve. While, we wanted to build this approach in our  ERP system, considering deadlines for current year, we went ahead and implemented access  control with current ERP set up, but management agreed to set up role owner concept in next  financial year.

Approach

Considering the timelines required for implementation, we wanted to adopt an agile  approach. We formed a task force under my leadership and involved cross functional teams.  Weekly reviews are conducted to understand the problems and to discuss solutions, and  tracking of the solutions is done through another in-house tool built for tracking purpose.

