With the surge of IPOs, fast-changing business environments, and increasing regulatory requirements, Sarbanes-Oxley (SOX) compliance reporting has become more time consuming and costly. An effective data-driven analytics approach with actionable insights is the preferred way to increase efficiency and greater confidence in compliance and risk management. At Snowflake, the Data Cloud has been critical to managing SOX compliance and internal controls.
An increased volume of, and variation in, data sets has made it harder for audit, risk, and compliance functions to identify and monitor controls for operating effectiveness. In addition, traditional audit techniques involving time-consuming evidence collection and sampling no longer provide sufficient risk coverage or real-time visibility into costly exceptions and inefficiencies.
Some common use cases where we see challenges:
Additionally, internal audit, controllership, and compliance teams are unable to act and respond in real time. Given the limited adoption of real-time data analysis and alerting, teams are often surprised with deficiencies highlighted during an external audit.
As we embarked on our IPO journey and SOX readiness efforts, we noted a lot of manual activities in both performance and testing of certain key controls. By “thinking big,” one of our core values at Snowflake, we saw an opportunity to automate some common SOX controls across our in-scope financial reporting processes using Snowflake.
Snowflake is a highly scalable, cost-effective platform that can ingest and store many types of data, including semi-structured data, in one place to help monitor controls effectiveness: queries, flagging exceptions, alerting, and reporting compliance posture in near real time. So we went about building out Snowflake analytics for SOX controls monitoring over the course of a few weeks, focusing on a few use cases that met this criteria:
The following architecture is being used to automate SOX controls monitoring. It shows how we ingest data and analyze exceptions through real-time alerting:
Using the steps above, we have automated the following three use cases:
In this section, we’ll highlight some key challenges and value derived from the Snowflake solution for each of these use cases.
Data analysis is essential to understanding processes and controls over journal entries and adjustments, especially when dealing with complex ERPs, multiple data sources or sub-ledgers, and large volumes of data. Despite multiple tools in the market, it is still time consuming to easily ingest data and analyze potential errors or fraud in real time; however, with Snowflake’s core computing capability, we were able to analyze over 2 million transactions from multiple journal entry sources in a matter of seconds.
We developed a few use cases (shown below) that have been really beneficial to address audit concerns over journal entry controls, and also provide insights into potential operational inefficiencies.
Insider threats via unauthorized access to critical systems is a major risk to any organization and can lead to significant reputational and financial damage. With Snowflake, we were able to automate monitoring over SOX access management controls by building queries to flag real-time exceptions. As part of this implementation, we first ingested user access logs, then built logic for monitoring and alerting exceptions. The key to designing this logic was understanding the access data model (e.g., specific roles, authorization concept and access) within the application and associated access policy.
The key use cases we automated include:
These dashboards help our teams rectify failures before they become SOX deficiencies. They also help provide visibility into potential process improvements in controls design and access policies for certain applications. For example, we’ve now revisited the access roles and system abilities in one of our key sales applications, which has made quarterly user access reviews a much more efficient process.
Implementing and testing segregation of duties (SoD) controls is an important element of internal control frameworks, and also a key focus of external audit firms. Without comprehensive SoD policies and advanced analytics that detect violations across thousands of application access points, SoD control implementation, testing, remediation, and mitigation can be extremely difficult to achieve.
This is where Snowflake helps. As part of our internal audit, we were able to identify our high-risk rules within and across our key applications to detect hidden SoD conflicts at both the role and user level. We then configured these rules within Snowflake and built queries to identify any roles/users that violated defined SoD rules. This included both IT and business SoD rules.
These dashboards have helped our teams to identify SoD conflicts in our environment and update the access as required to quickly remediate the issue.
Building SOX monitoring automations through data analytics isn’t just about data and technology. To be able to rely on the automations, it must also deliver business value; be embedded into the audit methodology; and have people with the right skills to design, build, and monitor exceptions. Additionally, ensuring appropriate controls are in place is also a key factor for auditors and management to be able to realize the advantages highlighted above.
Key success factors for effective automation reliance include:
Try Snowflake free for 30 days and experience the AI Data Cloud that helps eliminate the complexity, cost and constraints inherent with other solutions.
Copyright 2022, Snowflake Site. All rights reserved.