Legacy: Monitoring of Automated and Semi-automated Controls

Process Control facilitates the monitoring of data to ensure controls in your ERP system are operating effectively, and to identify weaknesses or potential deficiencies on a timely basis. You can create the following monitoring controls within Process Control to identify exceptions in your ERP system based on your deficiency parameters:

Configuration Controls – to identify potential unauthorized configuration settings or parameters in the ERP system.
Master Data Controls – to identify suspect master data in the ERP system.
Transaction Data Controls – to identify unusual business transactions in the ERP system.

You can customize your automated monitoring controls to review data based on your filter parameters and test period. You then schedule the automated monitoring controls at any frequency you choose based upon your configuration.

Automated test rules can automate your monitoring procedures. These rules use a script and rule criteria to identify control exceptions on data in the ERP system. For more information, see Legacy: Automated Test Rules, and Legacy: Performing Automated and Semi-automated Tests of Effectiveness.

If exceptions are found, the system automatically creates an issue when exceptions are Identified.
If no exceptions are found, no results are returned but the activity is logged with Adequate deficiency rating in the Job Monitor.

The following figure illustrates the steps in performing automated controls monitoring:

This graphic is explained in the accompanying text.

A monitoring control may be semi-automated based on its control design. However, if issues are found, there is no difference in the workflow tasks between automated and semi-automated control monitoring. Shown below is the test failure routing for automated and semi-automated control monitoring based upon delivered business content.

Test Failure Routing for Automated and semi-automated Control Monitoring
Rule with Issue Deficiency Rating	Automated: Issues Go to	Semiautomated: Issues Go to
Rule with Deficiency (H/M/L)	Control Owner	Control Owner
Rule with Review Required	Control Owner	Control Owner
Rule with No Deficiency	N/A	N/A

Prerequisites

For more information about the prerequisites to performing control monitoring, see Legacy: Performing Automated and semi-automated Tests of Effectiveness.

Activities

System execution of automated control monitoring
Access tasks related to issues from automated control monitoring
Perform tasks related to issues from automated control monitoring
Create and perform remediation plans

Note Note

If issues are identified for automated control monitoring, redoing the monitoring control for the same period returns the same results. For this reason and to ensure that issues are identified on a timely basis, some companies perform control monitoring on a more frequent basis than either manual testing or automated testing of control effectiveness.

End of the note.

Procedure

System Execution of Automated Control Monitoring

Process Control performs automated control monitoring based on the job schedule you create in the Monitoring Scheduler. The job schedule triggers execution of monitoring activities in the ERP system based upon rules and parameters to determine which ERP data represents a monitoring exception. For more information, see Legacy: Performing Automated and semi-automated Tests of Effectiveness. For more information about rules and control-rule assignments, see Legacy: Automated Test Rules, and Legacy: Control Rule Assignment
The ERP system returns any monitoring exceptions to Process Control. The issues have a deficiency rating of High, Medium, Low, or Review Required, depending on the rule settings. You define your tolerance settings for deficiencies in the rule parameters associated with the rule.
If no exceptions are identified, the monitoring job schedule is completed and no workflow is required. The job monitor reflects that the job has completed its execution with Adequate deficiency rating.
If exceptions are identified, this automatically creates an issue. The system routes the issue to the person assigned the task to receive the issues. In the delivered business content (BC Set), this person has the role Control Owner.

Note
You have the option of assigning the task to another role, depending on your business requirements and organizational structure.

End of the note.

Perform Tasks Related to Issues from Automated Control Monitoring

Perform steps in Legacy: Performing Automated and Semi-automated Test of Effectiveness