Denay Huddleston Who Are We Name Position Denay

Denay Huddleston

Who Are We? Name Position Denay Huddleston Supervisor, Training & Functional Development Year of Alma Mater Service 2. 5

Safety Moment Source: http: //www. safetymoment. org/Safety. Presentation/Home. General. Safety. pdf

About Conoco. Phillips Ø Conoco. Phillips is an international, integrated energy company with interests around the world Ø Headquartered in Houston, TX Ø 30 countries Ø Approximately 30, 000 employees Ø $153 billion of assets and $149 billion of revenues as of Dec. 31, 2009 Ø Website: www. conocophillips. com

43, 800 IT Service Desk requests monthly connect 13, 000 viruses prohibited monthly 1, 280, 000 inbound e-mails daily; 75% spam 1, 800, 000 intrusion attempts blocked daily support receive IT Services 140 372 other companies’ networks daily vendors and business partners daily 34, 000 external users 14 petabytes storage capacity 35, 000 SAP user IDs 40, 200 personal computers supported 52, 770 e-mail accounts 61, 500 user IDs managed for employees, contractors and service accounts 60 million SAP transactions monthly 7

What you need to know for the project…

SOX Ø Sarbanes – Oxley Act l l 2002. Standards act for all US public companies Strengthen public accounting controls

Segregation of Duties Segregation of duties is critical to effective internal control because it reduces the risk of mistakes and inappropriate actions. It helps fight fraud by discouraging collusion. ØSeparation: l l l Approval Accounting/reconciling Asset custody ØA detailed supervisory review of related activities is required as a compensating control activity if these functions cannot be separated in smaller departments. Source: http: //map. ais. ucla. edu/portal/site/UCLA/menuitem. 789 d 0 eb 6 c 76 e 7 ef 0 d 66 b 02 ddf 848344 a/? vgnextoid=06 e 56 d 221 c 4 c 0 110 Vgn. VCM 100000 dcd 76180 RCRD

Mitigating Controls Ø Type of control used in auditing to discover and prevent mistakes that may lead to uncorrected and/or unrecorded misstatements that would generally be related to.

Comparison of the Economic Measures of Merit Net Present Value (NPV) Strengths Properly accounts for the time value of money Ø Yields estimated picture of project profitability – uses after tax cash flow Ø Broadly used in industry Ø Weaknesses Ø Gives no indication of magnitude of project (large or small investments can give large or small NPV) Ø Does not measure investment efficiency – project with highest NPV not necessarily the best project

Comparison of the Economic Measures of Merit Average Annual Rate of Return (AARR) Strengths Properly accounts for the time value of money Yields estimated measure of Return on Investment – uses after tax cash flow Ø Can be compared to a minimum ROI for an accept/reject decision Ø Broadly used in industry Ø Ø Weaknesses Ø Gives no indication of magnitude of project (large or small investments can give large or small AARR) Ø Negative - Positive – Negative cash flows create multiple AARR’s

Comparison of the Economic Measures of Merit Profitability Index (PI) Strengths Properly accounts for the time value of money Provides indication of investment efficiency Can be compared to a minimum PI for an accept/reject decision Ø Preferred tool for ranking projects Ø Ø Ø Weaknesses Ø Gives no indication of magnitude of project (large or small investments can give large or small PI)

Current Process Ø Paper approval form action steps l l Business Unit (BU) or Staff Group (SG) fills out exception request and mails the request to SOX coordinator approves or denies, signs, and forwards request to SOX director approves or denies, signs, and forwards request to General Manager (GM) General Manager approves or denies, signs, and forwards request back to SOX director to keep and log all the requests BU or SG request SOX Coordinator SOX Director General Manager SOX Coordinator SOX Director BU or SG 15

Issues Labor Intensive Ø Inefficient - Could take up to a month to get roles approved l Constant need for ‘Pushing’ request through Ø Lack of reporting functionality Ø Requesters don’t know the state of the requests Ø

Project Goal The goal of the project is to achieve global implementation of a software application to detect and prevent Segregation of Duties (SOD) conflicts within SAP and across other non-SAP applications. • Document required mitigating controls • Document the approval to Internal Control Standards (ICS) exceptions • Enhance controls relating to SAP “Super Users, ” to and improve SAP user access provisioning. • Replace the existing laborious, inefficient and manual processes currently employed to identify, prevent and monitor SOD, mitigating controls, approved ICS exceptions and user provisioning

Project Ø Use AARR of 10% Ø Assume need to look at over 1000 roles Note: These are suggested only for the case of this classroom project. Do not represent actuals.

Questions