Driving Value with Continuous Monitoring

1. Driving Value with Continuous Monitoring Make SOX Free

2. The “Unofficial” Definition of Compliance Main Entry: com·pli·anceFunction: noun1 a: the business tax levied by Congress in the form of the Sarbanes-Oxley Act of 2002 b: the distraction created by the Sarbanes-Oxley Act of 2002 2: a disposition to yield to others Oversight Systems Proprietary

3. A Different Perspective Main Entry: com·pli·anceFunction: noun1 : the act of setting objectives and then meeting them “Quality means conforming to expectations” Phil Crosby Oversight Systems Proprietary

4. SOX Can Be Free • SOX 404 work has set the objectives • Continuous monitoring addresses the gaps in preventive controls • Resulting continuous improvements drive defects out of the process • SOX investments are monetized through: • Reduced errors • Increased accuracy and integrity • Daily insight into controls effectiveness Oversight Systems Proprietary

5. Set Benchmarks & Baseline Map Process Flow Determine Customer Requirements Develop Defect Measurements Develop Data Collection Process Collect & Compile Data Draw Conclusions from Data Test Conclusions Determine Improvement Opportunities Create Improvement Ideas Set Goals Implement Improvement Methods Measure Improvement Statistics Assess Effectiveness Make Needed Adjustments Define Measure Analyze Improve Control Six Sigma Quality Process Oversight Systems Proprietary

6. Set Benchmarks & Baseline Map Process Flow Determine Customer Requirements Develop Defect Measurements Develop Data Collection Process Collect & Compile Data Draw Conclusions from Data Test Conclusions Determine Improvement Opportunities Create Improvement Ideas Set Goals Implement Improvement Methods Measure Improvement Statistics Assess Effectiveness Make Needed Adjustments Document Test Remediate Monitor Six Sigma & Sarbanes-Oxley Define Measure Analyze Improve Control Oversight Systems Proprietary

7. Quality is Free – Phil Crosby The Total Cost of a Duplicate Customer DSO Impact Collection Impact Cost to correct Flawed Customer Analysis Impact cost Credit Exposure Duplicate Customer Oversight Systems Proprietary

8. The Financial Manufacturing Facility • Financial processes are “Information Manufacturing” • SOX defines the objectives in terms of the integrity of financial reporting • ERP system ensure accuracy … don’t they? Oversight Systems Proprietary

9. People and ERP systems are the Financial Manufacturing Facility Preventing Defects in Financial Manufacturing 100% error free Human Element Effectiveness ERP Controls Cost Oversight Systems Proprietary

10. ! Duplicate Customer Detected Continuous Monitoring for Value Duplicate Customer Order-to-Cash Process Customer Maintenance Customer Maintenance No Existing Customer? Existing Customer? Customer Order Customer Order Remittance Shipment Billing Billing Remittance Shipment Order Entry Order Entry Yes Virtual Auditor Oversight Systems Proprietary

11. ! Duplicate Customer Detected ! Erroneous Shipment Prevented Continuous Monitoring for Value Duplicate Customer Order-to-Cash Process Customer Maintenance Customer Maintenance Erroneous Shipment No Existing Customer? Existing Customer? Customer Order Customer Order Remittance Shipment Billing Billing Remittance Shipment Order Entry Order Entry Yes Virtual Auditor Oversight Systems Proprietary

12. First Generation Techniques • Continuous Monitoring concepts first emerge in the early 90s – embedded audit modules • Simple evaluations available through ERP reports and rules engines • Voucher lines without matching Purchase Order • Identical customer records • Signal to Noise: False positives overwhelm true exceptions • Duplicate payments versus recurring payments • False negatives • “Ridgewood Road” is similar (but not identical) to “Rydegwood Road” Oversight Systems Proprietary

13. Advanced Analytics Present Precise Results • Relationship Linking: Understand the relationships of actors & activities through time • Identify the link from the voucher lines through three invoices back to 5 Purchase Orders • Pattern identification • Recurring payments aren’t duplicate payments • Persistent Conclusions • The same valid test result (a policy exception) from Monday, Tuesday, Wednesday and Thursday is one problem not four Oversight Systems Proprietary

14. Critical Success Factors for Continuous Monitoring • Unified view of the process • Access data at the source • Consistent evaluation across multiple systems • Don’t slow down the applications • Independence from operational systems • Minimize the “who can you trust” challenge • Isolate the audit function from failures in General Computer Controls Oversight Systems Proprietary

15. Dealing with Exceptions • Closed-loop, exception-handling workflow • Accept and dismiss individual events • Assign responsibilities • Proactive relationship discovery • Invalid vendor plus all of the transactions with the vendor • Auditable Journal • Test that were run • Exceptions identified • Adjudication Dismiss Investigate Correct Policy Exception Yes Audit Journal Integrity Checks Eliminating Errors is the Goal Oversight Systems Proprietary

16. Expanding Universe of Processes • Order to Cash • Procure to Pay • Financial Accounting & Reporting • Information Technology – General Computer Controls • Fixed Assets • Inventory Management • Supplier performance Oversight Systems Proprietary

17. Conclusion • Successful Quality (and Compliance) is a continuous improvement process. • Technology enabled quality in the “financial data factory” provides significant ROI with Sarbanes-Oxley compliance as a dimension of overall quality. • Continuous Monitoring provides precise results and a leveraged environment for improving quality in financial operations. Oversight Systems Proprietary

18. 75 Fifth Street, NW Second Floor Atlanta, GA 30308 404-920-2030 www.oversightsystems.com