Industry news

Introduction – knowledge is power

For many years now, IT risk management has been taken extremely seriously by the ‘Big Four’ accountancy firms. These audit giants employ teams of dedicated IT risk management professionals who specialise in general systems risk management, as well as risks surrounding IT security in the specific financial systems that their audit clients run.

Auditing large enterprises employing complex ERP systems such as SAP often requires a more risk-based approach, which means understanding those risks which threaten the achievement of an organisation’s business objectives. Determining what those risks are at the application security level, and the necessary mitigating controls which should be in place, requires system-specific knowledge. Despite this dependency on specialist knowledge, gaining confidence over the integrity and security of data in a client’s core financial systems can save significant effort and cost in terms of reducing the level of substantive audit testing required. Therefore, taking a risk-based systems auditing approach is smart auditing.

Small and medium enterprises – welcome on board

As recently as 10 years ago, the suggestion that a county council would be running SAP R/3 would have been ridiculed. SAP systems were expensive to implement and support and were almost exclusively the domain of the blue chip corporation. It was rare to see a client outside of the FTSE 250 using SAP in the UK.

By the turn of the millennium SAP had saturated the blue chip market and turned their attentions to SMEs, releasing SAP Business One and steering their marketing machine in the direction of the middle market. Several years on SAP is commonplace in mid-tier companies and has become an integral part of their systems landscape. Consequently, this presents both the mid-tier accountancy firms that perform their external audits, as well as the internal audit departments of these SAP organisations, with a unique set of challenges.

Auditing ERP systems – it’s a tough job but someone’s got to do it

Auditing an ERP system is not an easy task. IT risk management teams at the ‘Big Four’ accountancy firms specialise in ERP systems security, and they invest much time and effort in developing and maintaining audit work programmes for each variety of these systems. Keeping this knowledge base up to date and in touch with the fast pace of change in ERP technology is an expensive business. ERP systems such as SAP incorporate complex security configuration and whilst basic in-built audit tools are provided there is no substitute for a solid understanding of the underlying authorisation (security) concept.

Whilst both mid-tier external auditors and organisations' internal audit departments encounter SAP more and more frequently nowadays, it is difficult to maintain and retain an internal team with the necessary expertise to audit an SAP system with the thoroughness and know-how required to really drive out meaningful audit points. Often general systems auditors will attempt to audit an SAP system but will overlook all but the most obvious security flaws. This means there is a real danger that significant risk exposures will go undetected due to this deficiency in system-specific knowledge.

Outsourcing solutions – closing the knowledge gap

An emerging alternative for external and internal audit departments is to outsource IT systems audit to a third party specialist.

For the medium sized / smaller audit firm the advantages of outsourcing IT systems audit are often quite compelling:

- Systems specialists will perform an IT systems audit rather than 'IT generalists'.

- You will gain access to proven methodologies, maintained and updated by the provider.

- Tools will be licensed and maintained by the provider, reducing licensing, training and support costs.

- The risk of missing significant audit points due to limited system-specific knowledge is reduced.

- There may be an opportunity for cross-selling follow-on work, revenue from which can be shared with the provider.

- Staffing costs are reduced, as there is no need to keep expensive in-house specialist skills.

However, there are also a number of things to be considered before choosing the outsourcing route.

1. Understand organisational competencies…

Auditing an SAP system requires specialist technical knowledge. Without a good understanding of the underlying authorisation concept it is very easy to overlook security loopholes or segregation of duties conflicts. Missing audit points like this could expose the firm.

2. Work with a trusted provider…

An audit relationship is one of trust. Clients expect many things from their auditor but the most important of these is integrity. Consequently, any outsourcing of IT systems audit must be based on a similar level of trust with the provider.

It is important to think carefully about the available options and select the provider carefully. Find a suitable partner and work hard at building the relationship to ensure the trust with clients is not broken. Consider trialling the outsourcing provider chosen with a small project where the relationship can be developed without risking an important and established client. This will provide the opportunity to outline rules of engagement and build trust in a low-risk environment.

3. Establish the rules of engagement…

Establishing the rules of engagement with the provider is essential in any outsourcing arrangement, but it is particularly important when it comes to outsourcing systems auditing. To succeed, it must be agreed in advance with the provider how they will represent themselves and the company for whom they are performing the audit with the end client.

- Whose business cards will they use?

- Will they provide their own hardware or use the firm’s laptops?

- Will they require access to the networks?

- If a SoD review is to be undertaken will they provide software and licenses for this or will the organisation license software for them to use?

- Who will be the initial point of contact for the client during the engagement – the outsourced auditor, or the audit firm?

- Should the provider follow the organisation's sample testing guidelines or utilise its own?

4. Agree a position for follow-on work…

An IT systems audit will more than likely identify points for remediation. Often clients will request assistance with this. This can lead to lucrative follow-on work for SAP Security implementation specialists. It is important to establish the ground rules for follow-on work prior to engagement.

- Should the outsourcing provider be allowed to accept follow–on work from the client?

- Will an additional consultancy role compromise the provider’s position of acting internal/external auditor depending upon the nature of work and individual resources proposed?

- Should any follow-on work be channelled through the firm or should the provider deal with the client directly?

Conclusion

In conclusion, there are many challenges presented to the internal/external audit department considering outsourcing IT systems audit. However, if managed well, outsourcing of IT systems audit presents an opportunity to deliver a considerably improved client service at a significantly reduced cost.

Infosys Technologies is seeing its outsourcing deals pick up as major countries leave the economic downturn behind, it has been reported.

In the last two quarters the markets have improved and deals are coming back, CEO and managing director, S Gopalakrishnan, told reporters at an event in Mumbai, according to Rediff.com Business.

“The recovery is led by the United States and other emerging markets such as India and China,” said Gopalakrishnan.

“The US contributes 60 per cent of the total business. Clearly this is having more impact on the Indian IT services. Proactively we are investing more on diversifying our business,” he added.

Currently, the company's revenue distribution is 60 per cent from North America, 25 per cent from Europe and the balance from other parts of the world.

Vodafone has revealed plans to make hundreds of employees jobless as it seeks to ‘remove layers’ between the company and its customers.

The majority of the job losses will be back-office roles, however Vodafone has also admitted some would also be lost within its call centres as reported by Call cEntre Focus.

It too has been reported that in addition to these cuts, the firm will also create 170 customer facing roles, 50 of which will be taken from its graduate programme, over the next few weeks and months.

The decision surrounding cuts seems to have caused some confusion among staff and union leaders alike,

“We’d like to see greater clarity from the company on how this decision will affect staff, a willingness to explore redeployment opportunities and greater assurances about a voluntary approach to redundancies,” said Andy Kerr, Communications Workers Union deputy general secretary.

Contact centre business transformation is a viable option to generate immediate and significant cost savings, according a Datamonitor whitepaper.

The transformation practice involves an enterprise-outsourcer partnership with the express purpose of improving CRM-related business performance whilst reducing risk and costs.

According to Datamonitor and Teleperformance, who commissioned the report, transformation can be achieved by re-engineering processes and transferring contact centre facilities to the outsourcer.

Peter Ryan, lead analyst for call centres and BPO at Datamonitor, comments, “In light of escalating costs and service demands we are seeing a focus on new and innovative contact centre operating models. Business Transformation has emerged as a viable option to generate large and immediate cost savings.”

Intelenet, controlled by the US private equity group Blackstone, has announced today that it has acquired the back office operations of the UK transport company FirstGroup.

The Indian BPO firm acquired the service arm, FirstInfo, for £45m. Intelenet will now be responsible for customer management, ticket issuing and back-office processing across rail franchises including FirstCapitalConnect, First ScotRail and First Great Western.

The deal, which was formally concluded on the 10th January 2010, sees Intelenet take over FirstInfo’s two UK contact centres in Fort William and Plymouth. It also supports the company’s expansion in the UK and the aim to increase FirstInfo’s UK employees from 300 up to 2,000 in two years.

Belen Martinez, First’s rail division business development director, commented: “It will be business as usual and the new contract with Intelenet will enable First to improve services to customers.

“Intelenet specialises in the delivery of contact centre services and there will be investments in new technology and processes at the centres. We will work closely with Intelenet over the coming months to improve service.”

Liverpool City Council has announced it is set to receive funding after government approval was granted for its Building Schools for the Future (BSF) plans.

“Out of the £350m being spent on the BSF project, over £26m will be on IT, around 7.3 per cent of the overall BSF spend, ” a spokesperson for the council said.

The initiative, which forms part of the BSF's sixth wave of spending, will include the provision of ICT services at 24 secondary schools in Liverpool, due to start in 2013 until 2017.

The council is said to be currently seeking a private sector partner to participate and invest in the Public Private Partnership vehicle, GC News has reported.

Midlands-based Accord and Ashram Housing Associations have signed a contact centre and network deal with the newly rebranded Virgin Media Business.

It is hoped the new arrangement will help the Associations deal with its increasingly large call volumes, now up to 6,000 a month.

The network will enable the Associations to direct all branch enquiries through its new Customer First Centre.

“Given the growth and expansion of our housing portfolio in the last five years, our contact points had grown to a number that our residents found confusing,” said Ian Tinsley, Information Systems Manger at Accord.

The Financial Intelligence Unit India, part of the Indian Government’s Ministry of Finance, has signed an IT outsourcing contract with Wipro Infotech. The project is due to be completed in 24 months with a further service period of 36 months.

As part of the deal, Wipro will manage the Unit’s IT in a bid to enhance the efficiency and effectiveness of its collection, analysis and dissemination of financial information and highlights the Government’s intentions to use technology to bring efficiency into analysis of data.

Mr Arun Goyal, director of Financial Intelligence Unit India, said: “We are keen on timely implementation of the Project as it will significantly enhance capabilities to collect financial information from various reporting entities, analyse it and disseminate actionable information to various law enforcement and intelligence agencies.”

Capita boss, Paul Pindar, has joined a growing group of high-profile sourcing professionals calling for an increase in public sector outsourcing.

The comments were made following figures from the CBI last week that £130bn could be cut from public spending through increased outsourcing.

Pindar said: “Outsourcing companies could easily save money in areas such as benefit payments as well as reducing back office and administration costs. If you look at the total level of public expenditure of £680-£700bn and the level of savings that have previously been made of 25-30pc, there's no doubt significant savings are there."

According to The Telegraph, the CBI has today written to Chancellor Alistair Darling ahead of the Budget to say that "re-engineering the way public services are delivered can increase public sector productivity"

Commenting on the need for increased outsourcing, National Outsourcing Association chairman, Martyn Hart said, “The sector’s ability to cut costs by traditional means, such as staff cuts, is limited, so sourcing and shared service arrangements will come as a matter of course.”

The Main Street America Group has appointed India-based outsourcing giant Wipro in a seven year IT agreement.

In the deal, Wipro will support Main Street America Group’s IT business needs, providing the insurer with applications development, maintenance and quality assurance.

Enthusiastic about the new partnership, Ronald James, Main Street Americas chief information officer said: "As The Main Street America Group continues to increase scale and productivity, we needed to implement more efficient processes while reducing our operating costs.

“Partnering with Wipro could also help accelerate the delivery of our projects even further.”