Audit Workbench in Dynamics 365 Finance and Operations

AUDIT WORKBENCH IN DYNAMICS 365 FINANCE AND OPERATIONS

In the previous article, I provided an introduction to the audit features available in Dynamics 365 Finance and Operations, highlighting tools such as the Audit Trail and Audit Workbench, which are designed to support compliance and transactional accuracy. 

This article delves deeper into the Audit Workbench module, a detective tool that enhances audit processes by automating the detection, tracking, and resolution of transactional discrepancies, ensuring compliance and operational efficiency.

Let's get started.

CONTENT The logic Query (Audit) types Sample scenarios Demo - Case creation Demo - Audit Conclusion

THE LOGIC

The logic of the Audit Workbench module in D365FO involves the following steps:

• Creates Policies: Establishes audit policies and rules to define criteria for identifying discrepancies or irregular transactions.
• Monitors Transactions: Continuously scans transactional data to detect deviations from the defined policies.
• Identifies Exceptions: Flags transactions that violate policies as exceptions for further review.
• Conducts Audits: Facilitates a detailed examination of flagged exceptions to analyze potential issues or risks.
• Tracks Resolutions: Enables tracking and documentation of resolutions for each flagged transaction, ensuring accountability and compliance.
• Provides Insights: Generates reports and insights to support decision-making and improve future processes.

This article demonstrates all of the above steps through realistic end-to-end business scenarios.

This feature enables the auditing of expense reports, vendor invoices, and purchase orders in various ways. The essential configuration required is the Audit Policy, which allows you to specify the document type to be audited and select the desired audit type.

QUERY (AUDIT) TYPES

When you set up an audit policy rule, the first thing you do is pick a rule type. This also decides the kind of audit the rule will use. The query looks at the source document the rule will evaluate and figures out details like which legal entity and date to use when selecting documents for auditing. The type of query also affects what fields show up by default when you're working in the query page or the Audit policy rule page.

Query type	Purpose
Conditional	It is used to evaluate records against a set of conditions and take action when those conditions are met. For example, you can configure a rule to flag expense reports if they exceed $1,000 and do not include an approval signature. This type of rule ensures compliance by checking for specific combinations of criteria in your data.
Aggregate	It is used to flag transactions or records that exceed certain thresholds or limits when grouped together. For example, you can use it to audit total expenses submitted by an employee over a month, or total payments to a vendor in a specific period, and flag cases where the amounts exceed a predefined limit. This helps identify unusual or risky trends for further review.
Sampling	It is used to pick a small, representative set of records from a larger dataset to review for compliance, accuracy, or irregularities. For example, you can configure a rule to randomly select 5% of all vendor invoices from a specific period for audit, ensuring a fair and manageable review process without checking every single transaction.
Duplicate	It is used to flag records that may have been entered multiple times by mistake, such as duplicate vendor invoices, expense reports, or purchase orders. For example, you can configure it to detect invoices with the same vendor, invoice number, and amount, helping to prevent overpayments or fraud. It’s a tool to ensure data accuracy and avoid redundancy.
List search	It is used to create audit policies that focus on identifying specific values or patterns within a list of data (e.g., transactions, vendor records, or employee expenses). These rules are ideal for catching anomalies, policy violations, or data points that require further investigation.
Keyword search	It is used to identify records that might need attention based on certain words or terms. For example, you can use it to find expense reports, vendor invoices, or other documents that include keywords like "gift" or "bonus".

SAMPLE SCENARIOS

The next step is to explore how these queries can be applied in real-world scenarios. By using these query types, you can create targeted rules to monitor and flag specific document types. Below are practical examples for each query type, demonstrating how they can be configured to identify anomalies, ensure compliance, and improve data accuracy in Dynamics 365 Finance and Operations.

List Search Policy Rule

• Scenario 1: Identify all purchase orders where the requested delivery date is in the past, ensuring timely communication with vendors.
• Scenario 2: Flag vendor invoices with payment terms longer than 90 days to ensure compliance with organizational policies.
• Scenario 3: Highlight expense reports submitted with amounts exceeding $5,000 for further managerial review.

Keyword Search Policy Rule

• Scenario 1: Search for the word "urgent" in vendor invoice descriptions, which may indicate rushed or unusual transactions.
• Scenario 2: Identify expense reports containing the keyword "gift," as these may require special approval or policy checks.
• Scenario 3: Flag purchase orders with descriptions containing "custom" to ensure they align with approved procurement guidelines.

Duplicate Policy Rule

• Scenario 1: Detect duplicate vendor invoices submitted with the same invoice number, amount, and vendor, avoiding overpayments.
• Scenario 2: Identify duplicate purchase orders with the same vendor, total amount, and delivery date, which could indicate data entry errors.
• Scenario 3: Flag duplicate expense reports submitted by the same employee for the same trip or purpose to prevent duplicate reimbursements.

Sampling Policy Rule

• Scenario 1: Randomly select 5% of purchase orders from the last month for auditing to ensure compliance with procurement policies.
• Scenario 2: Sample 10% of vendor invoices over $50,000 for auditing to confirm they have proper supporting documentation.
• Scenario 3: Select a random set of expense reports from a specific department for a compliance check.

Aggregate Policy Rule

• Scenario 1: Flag vendor invoices where the total payments to a single vendor in a month exceed $1,000,000, signaling a need for further review.
• Scenario 2: Identify purchase orders where the total value of orders placed with a single vendor in a quarter exceeds $2,000,000, ensuring compliance with procurement limits.
• Scenario 3: Monitor expense reports where the total amount submitted by an employee in a month exceeds $10,000, ensuring adherence to travel and expense policies.

Conditional Policy Rule

• Scenario 1: Flag expense reports where the total amount exceeds $5,000 and no manager approval has been recorded.
• Scenario 2: Identify vendor invoices where the due date is overdue and no payment has been scheduled yet, to ensure timely follow-up.
• Scenario 3: Flag purchase orders where the total value exceeds $100,000 and the order has not been approved by a senior manager.

DEMO - CASE CREATION

Let's delve into 'Duplicate Policy Rule's 'Scenario 1'.

Navigate to Audit workbench >> Setup >> Policy rule type.

The following line indicates that vendor invoices will be subjected to a duplicate invoice check. The batch job's date range will be based on the invoice date.

Let's now configure the system to display invoices with the same amount that belong to the same vendor within a specific time range.

Navigate to Audit workbench >> Setup >> Audit policies.

Create an audit policy named Duplicate invoices.

Create a policy rule  at the bottom of the screen and click on it.

Click Filter.

Switch to Group by tab.

We want to see all invoices belong to same vendor with same amount within a specific time frame.

Configure the screen as shown below:

Click OK.

Click Test.

Specify a date range for the test.

⭕ Note that the batch job's date range will be based on the invoice date.

Let's run the test now.

Click Run test.

Results are shown as below.

The last step is to configure a batch job to automate the process and capture anomalies. 

Navigate to Audit workbench >> Setup >> Audit policies

Select the policy and click Additional options. 

Enter the date range and click Batch.

 

Enter the batch job parameters.

Click OK.

 

Note that batch job is added to the queue. Upon batch job completion, system creates audit cases under Audit workbench >> Audit cases.

DEMO - AUDIT

Audit cases represent exceptions flagged during periodic reviews conducted to ensure adherence to SOX compliance and internal control policies. The following steps outline the process for managing and resolving these cases effectively:

1 - Initiating case review

Access the periodic audit cases from the Audit Workbench by navigating to Audit workbench >> Audit cases.

Each case is a part of the periodic Audit. 

Select the specific case flagged for review and drill down into its details to begin the investigation.

Update the case status to "In Progress" to signify the start of the auditing process.

2 - Assigning ownership

Assign the case to a responsible auditor or investigator. This ensures accountability and a clear delegation of responsibility for addressing the identified anomaly. 

3 - Analyzing case details

The responsible individual reviews the case content.

The Associations fast tab within the audit case displays all linked documents contributing to the flagged anomaly. 

The ID column provides hyperlinks for direct navigation to master data or the source documents, enabling a comprehensive examination of the transactions.

4 - Analysis

Examine the flagged transactions and complete the review.

5 - Document findings

Record the investigation outcomes in the case log to maintain a detailed audit trail.

6 - Providing supporting evidence

In case the identified finding requires further clarification, attach a knowledge article as supporting evidence to substantiate its accuracy. For example, while the system may flag a potential anomaly, it enforces controls that prevent users from recording the same invoice number more than once, ensuring compliance.

Attach a knowledge article to justify the finding if necessary as shown below:

Click Yes.  

7 - Closing the case

Once the review is complete and the necessary actions have been taken, update the case status to "Closed." This final step confirms that the anomaly has been resolved, and the audit process is complete.

CONCLUSION

Audit Workbench in Dynamics 365 Finance and Operations offers a practical and efficient way to manage the audit process by streamlining the identification, review, and resolution of irregular transactions. With its ability to automate key tasks such as flagging anomalies, assigning cases, and tracking resolutions, it helps teams focus on addressing critical issues without getting bogged down in manual processes. Its flexibility in configuring policies and queries ensures that audits are tailored to the organization’s specific needs, enabling a more targeted and effective approach. By leveraging these capabilities, businesses can maintain better control over their operations, improve compliance, and ensure transparency in their financial and operational processes.

How to Make Your ERP SOX Compliant? - PART 1

CONTENT   Introduction How to make your ERP sox compliant? Where does the SoD (Segregation of Duties) framework stand among the steps mentioned above? How to manage access rights? How to design application mitigating controls? Summary

INTRODUCTION

This article series acts as a comprehensive guide for SOX compliance, specifically tailored for public companies utilizing Microsoft ERP systems. The foundational knowledge provided here will then help build a SOX compliance framework. 

First article part will be theoretical, following articles will be application of the given information.

Let's get started.

The Sarbanes-Oxley Act, often referred to as SOX, is a U.S. law that sets standards for all U.S. public company boards, management, and public accounting firms. The purpose is to keep top management accountable for financial accuracy, to enhance financial disclosures, to enforce auditor independence, and to establish the Public Company Accounting Oversight Board (PCAOB). The idea is to make companies more transparent, so people feel safer when they invest their money in them.

How to make your ERP sox compliant?

To make your Enterprise Resource Planning (ERP) system SOX (Sarbanes-Oxley Act) compliant, you can follow these steps:

• Understand SOX Requirements: Familiarize with the requirements of the Sarbanes-Oxley Act, especially sections 302 and 404, which are about internal control over financial reporting.

• Assess Current Compliance Level: Evaluate your current ERP system to identify areas that do not meet SOX compliance requirements. This involves reviewing financial reporting processes, data accuracy, access controls, and audit trails.

• Implement Strong Internal Controls: Establish robust internal controls within your ERP system. This includes controls over financial data entry, processing, and reporting. Ensure that these controls are documented and tested regularly.

• Manage Access Rights: Strictly control access within the ERP system. Implement role-based access controls to ensure that only authorized personnel have access to sensitive financial information.

• Ensure Data Accuracy and Integrity: Implement measures to ensure the accuracy and integrity of financial data. This can involve validation checks, regular reconciliations, and automated data processing controls.

• Maintain an Audit Trail: Your ERP should maintain a comprehensive audit trail that logs all financial transactions and changes made within the system. This is crucial for auditors to verify the accuracy of financial reports.

• Regular Testing and Monitoring: Regularly test and monitor the effectiveness of internal controls. This can be done through internal audits and by using features within the ERP system that flag anomalies or control failures.

• Train Staff: Ensure that all staff who use the ERP system are trained in SOX compliance requirements. They should understand the importance of controls and their role in maintaining compliance.

• Continuous Improvement: SOX compliance is not a one-time task but an ongoing process. Continuously review and improve the internal controls and processes within your ERP system.

• Engage with Auditors: Work closely with external auditors to understand their expectations and get feedback on your compliance efforts. This collaboration can provide valuable insights into areas needing improvement.

As result, don't forget that each organization's needs and challenges are unique, so tailor these steps to fit your specific circumstances and consult with legal or compliance professionals if needed.

Where does the SoD (Segregation of Duties) framework stand among the steps mentioned above?

Segregation of Duties (SoD) helps you making your ERP system SOX compliant, and it intertwines with several of the steps mentioned above, particularly in implementing strong internal controls and managing access rights. Here's where SoD fits into the process:

• Implement Strong Internal Controls v2: SoD is a key aspect of internal controls. It involves dividing responsibilities and tasks among different employees to prevent fraud and errors. In an ERP system, this means ensuring that no single individual has control over all aspects of a financial transaction. For example, the same person should not be authorized to initiate, approve, and reconcile transactions.

• Manage Access Rights v2: SoD is closely linked to managing access rights within the ERP system. By controlling who has access to perform certain tasks or view certain data, you can enforce SoD effectively. For instance, different roles and permissions can be set up in the ERP system to ensure that conflicting tasks are not performed by the same person.

• Regular Testing and Monitoring v2: Part of regular testing and monitoring should include reviewing the effectiveness of SoD controls. This might involve checking whether the roles and responsibilities assigned in the ERP still align with SoD principles and making adjustments as needed.

• Continuous Improvement v2: The SoD framework should be reviewed regularly to adapt to changes in the organization, such as new business processes, changes in staff roles, or updates to the ERP system itself.

Incorporating SoD into your ERP system is essential for mitigating risks related to fraud, errors, and financial misstatements, making it a vital element of SOX compliance.

How to manage access rights?

Managing access rights in an ERP system is a critical component of maintaining security and compliance, particularly with frameworks like SOX and in ensuring proper Segregation of Duties (SoD). Here's a detailed approach to managing access rights effectively:

• Least Privilege Principle: This principle dictates that users should be granted only the access rights that are absolutely necessary for them to perform their job functions. This minimizes the risk of unauthorized access or actions within the system. Regularly review user permissions to ensure they align with current job responsibilities.

• Role-Based Access Control (RBAC): Define roles within your organization and assign access rights based on these roles. For example, a financial officer would have different access rights compared to a sales manager. This makes managing and auditing access rights more efficient.

• Implementing Segregation of Duties (SoD): SoD is vital for preventing fraud and errors. Ensure that conflicting tasks, such as creating a vendor and approving invoices, are not assigned to the same person. Design roles in the ERP system in a way that these duties are segregated.

• Regular Audits and Reviews: Periodically audit access rights to ensure they are still appropriate. Changes in employee roles, departures, or new hires often necessitate updates in access permissions. This process helps in identifying and rectifying any inappropriate access rights.

• User Access Reviews: Conduct regular user access reviews where managers verify and confirm the appropriateness of their team members’ access. This practice helps in identifying any discrepancies or unnecessary access privileges.

• Strong Authentication and Authorization Procedures: Implement strong authentication methods, like multi-factor authentication (MFA), to ensure that access to the ERP system is secure. Also, ensure that authorization procedures are robust and that any elevation in access rights is properly vetted and approved.

• Training and Awareness: Educate employees about the importance of access control and the risks associated with improper access. This includes training on how to handle access credentials securely.

• Use of Automated Tools: Consider using automated tools for managing access rights. These tools can help in efficiently assigning roles, tracking changes, and conducting regular audits.

• Documenting Policies and Procedures: Document your access control policies and procedures. This documentation should include details on how roles are defined, how access is granted, reviewed, and revoked, and the procedures for auditing and compliance checks.

• Incident Response Plan: Have a plan in place for responding to access-related security incidents. This should include steps for immediate action, investigation, and remediation to minimize potential damage.

How to design application mitigating controls?

Application mitigating controls are an essential part of the framework for ensuring the security and compliance of an ERP system, particularly in the context of SOX compliance and effective management of access rights. These controls are specific to the ERP application and are designed to ensure the integrity, accuracy, and confidentiality of the data and processes within the application. Here’s how application controls fit into the overall framework:

• Data Input Controls: These ensure that the data entered into the ERP system is accurate, complete, and authorized. This can include validation checks, field format restrictions, and mandatory fields to prevent incomplete entries.

• Data Processing Controls: These controls ensure that data is processed correctly within the ERP system. They can include workflow approvals, automated calculations, and checks that transactions are processed as intended.

• Data Output Controls: These controls ensure the integrity of data outputs, such as reports and exports from the ERP system. They ensure that data is accurately and appropriately presented and can only be accessed by authorized individuals.

• Integration with Access Rights Management: Application controls work hand-in-hand with access rights management. They help enforce the principles of least privilege and SoD by controlling what actions users can perform within the application based on their assigned roles and permissions.

• Audit Trails and Logs: Application controls often include creating and maintaining detailed audit trails and logs that record transactions and changes within the ERP system. These logs are crucial for audits and for monitoring and investigating suspicious activities.

• Error Detection and Correction Mechanisms: Implement controls to detect errors in data processing and provide mechanisms for their correction. This could include alert systems for unusual transactions or discrepancies.

• Segregation of Duties within the Application: Ensure that application controls help enforce SoD by restricting the ability to perform conflicting tasks within the application to different users or roles.

• Compliance and Regular Audits: Use application controls to facilitate compliance with relevant regulations and standards. Regular audits of these controls help ensure they are functioning correctly and remain aligned with compliance requirements.

• User Authentication and Authorization: Incorporate controls within the application for strong user authentication and for ensuring that authorization procedures are followed before granting access or approving transactions.

• Change Management Controls: Implement controls around the modification of the ERP system itself, including updates or changes to application settings, to ensure that they are authorized, tested, and documented.

In summary, application mitigating controls are a vital component of a secure and compliant ERP system. They work in conjunction with other measures like access rights management to provide a comprehensive approach to data integrity, security, and regulatory compliance.

Summary

Here's a table that combines the aspects of SOX compliance, Segregation of Duties (SoD), Access Rights Management, and Application Controls, highlighting how they interact with each other:

This framework illustrates the interconnectedness of these aspects in creating a secure, compliant, and efficient ERP system. Each aspect supports and reinforces the others, ensuring a holistic approach to compliance and security.