SYSTEM AND METHOD FOR MANAGING CONTROLS WITHIN A HETEROGENEOUS ENTERPRISE ENVIRONMENT

• US 20070288253A1
• Filed: 05/01/2007
• Published: 12/13/2007
• Est. Priority Date: 05/01/2006
• Status: Active Grant

• Current Assignee: Infor Incorporated
• Original Assignee: Approva Corporation (Current Client) (Infor Incorporated)
• Inventors: Garrity, Thomas, Elliott, Steven, Cobb, Richard, Matteson, Silas, Boccasam, Prashanth
• Granted Patent: US 8,671,013 B2
• Time in Patent Office: Days
• US Class Current: 705/7
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/0639 Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: G06Q 30/018 Certifying business or products

Abstract

A system and method for managing internal controls within a heterogeneous enterprise environment is provided. The invention may include an open and extensible standards-based architecture that may be used to create, monitor, test, or otherwise manage internal controls by capturing, organizing, translating, and exchanging controls data, tests, and test results across organizational boundaries and between an enterprise and its external auditors. By providing an automated software solution for managing internal controls, business, finance, information technology, audit, or other professionals may automate on-demand testing, or perform closed-loop remediation and continuous exception-based monitoring of controls within and across enterprise systems.

Claims

1. A method for managing controls within a heterogeneous enterprise environment, comprising:

capturing data from one or more applications associated with an enterprise;

formatting the captured data into a predetermined data format;

applying one or more rules against the formatted data to determine whether one or more controls have been violated; and

publishing a report based on the applied rules, the published report indicative of the enterprise'"'"'s compliance with the controls.

2. The method of claim 1, the controls including one or more of process controls, access controls, application controls, operational controls, information technology controls, and financial controls.

3. The method of claim 1, further comprising sharing one or more of the formatted data, the applied rules, the controls, and the published report with an entity outside of the enterprise environment.

4. The method of claim 1, wherein the predetermined data format is an XML-based Controls Definition Language (XCDL).

5. The method of claim 1, wherein the report is published in an XML-based Controls Reporting Language (XCRL).

6. The method of claim 1, further comprising integrating the one or more applications with an open controls framework, the framework providing standard interfaces for communicating with the applications, for implementing controls, for implementing rules for testing the controls, and for generating reports to publish results of the testing.

7. The method of claim 6, the applications relating to one or more of Enterprise Resource Planning (ERP), Supply Chain Management (SCM), Identity Management (IDM), Business Process Management (BPM), Customer Relationship Management (CRM), Governance and Risk Compliance (GRC), and an application portal.

8. The method of claim 7, wherein the report is published to the application portal.

9. A system for managing controls within a heterogeneous enterprise environment, comprising:

an integration component for handling requests relating to an enterprise application, the integration component formatting data extracted from the enterprise application;

a foundation services component in communication with the integration component, the foundation services component providing one or more services for processing the formatted data;

a controls authoring component in communication with the foundation services component, the controls authoring component for designing one or more rules to test the processed data against one or more controls, and for publishing one or more reports indicating results of the test; and

a enterprise controls component in communication with the controls authoring component, the enterprise controls component for authoring the one or more controls.

10. The system of claim 9, wherein the services include one or more of security services, user management services, data analysis services, correlation services, request services, scheduling services, task management services, data management services, access services, reporting services, and publishing services.

11. The system of claim 9, the controls including one or more of process controls, access controls, application controls, operational controls, information technology controls, and financial controls.

12. The system of claim 9, wherein one or more of the formatted data, the designed rules, the authored controls, and the published reports are shared with an entity outside of the enterprise environment.

13. The system of claim 9, wherein the data is formatted using an XML-based Controls Definition Language (XCDL).

14. The system of claim 9, wherein the reports are published in an XML-based Controls Reporting Language (XCRL).

15. The system of claim 9, the applications relating to one or more of Enterprise Resource Planning (ERP), Supply Chain Management (SCM), Identity Management (IDM), Business Process Management (BPM), Customer Relationship Management (CRM), Governance and Risk Compliance (GRC), and an application portal.

16. The system of claim 15, wherein the report is published to the application portal.