The GRC Consultant

Question

In a regulated economy, success is measured on the speed, transparency, integrity and compliance capabilities of the organization’s business processes and  the system landscape. The key to success, would then translate into an effective audit of the organization’s SAP system, with specific focus on security and control. General Controls specialists reviewing Application  Controls may not deliver the desired level of comfort in identifying control weaknesses in an SAP environment. This requires knowledge of the SAP system  security,  auditability, risks  and  controls.  The  introduction  of  SAP  Netweaver  has  further enhanced  the  need  for  having  a  better  understanding  on  the  key  aspects  of  security,  user authentication and authorization, across platforms.
To get into the GRC space, I do believe that consultants must have a fair understanding of:
- the main business processes in the mySAP Business Suite covering the Purchase to Pay Cycle, Order to Cash Cycle, Inventory Management, Accounting etc.
- SAP Basis Security covering User Management and Authorizations, Roles, Infrastructure Security, Netweaver Security, Single Sign-On in Heterogeneous Landscapes etc
- SAP tools like MIC, AIS, Compliance Calibrator etc
- regulatory requirements like SOX, JSOX, Basel II etc
- compliance frameworks like COSO, Cobit etc
- auditing standards like AS1, AS2, AS3, AS4 from SEC
- international accounting standards
- risk assessment and risk management in enterprises
- preventive, detective, corrective and deterrent controls to mitigate risks
The GRC initiative from SAP is definitely a step in the right direction. I do believe that exchange of ideas through this forum will be a catalyst to good governance and will definitely help organizations in meeting their compliance objectives.

Answer 1

Greetings to the Forum and Babu,
It is indeed a pleasure that SAP has started this forum and has heavyweights like Babu involved and participating.
SAP has been a front runner in the GRC space and is indeed doing a tremendous job to further the cause of a unified and holistic approach towards GRC, justifiably, the industry is perceiving the other players as laggards in this space.
I am attempting to provide a laundry list of all the resources available on the internet pertaining to GRC in general and SAP GRC in particular.I am passionate and committed to SAP GRC and would like to see this forum grow by leaps and bounds.
<b>Generic information on GRC and regulations</b>
1.  http://www.isaca.org/ for CISA and Systems Auditing and a whole range of subjects in GRC
2. http://www.aicpa.org/ for SOX
3. http://www.sec.gov/ for SOX
4. http://pcaobus.org/ for SOX
5. http://www.theiia.org/ for Internal Audit
6. https://www.isc2.org/ for Security
7. http://www.sebi.gov.in/ for Clause 49
8. http://www.fsa.go.jp/ for J SOX
9. http://www.frc.org.uk/corporate/internalcontrol.cfm for Turnbull guidance on Internal control
10 http://www.osc.gov.on.ca/ for Bill 198/CSOX.
11. Apart from these there are numerous other regulations like Kon Traag, FDA, ROHS, WEEE  all of which are part of the Governance, Risk and Compliance Ecosystem.
In my next post I will give a laundry list of all resorces available for the SAP GRC ecosystem.
Thankyou,
Happy blogging!