AuditBoard vs. SAP Process Control

Auditboard is especially useful for SOX control testing. It is very convenient having all our information on a single platform. It is easy to communicate PBC requests to clients, store control testing working papers for review, communicate deficiencies and build dashboards to provide visual statistics. Situations where it might not be useful are for organizations that are smaller in size where the templates don't fit well with their internal audit/controls program. There is a significant amount of testing required before using the platform, and adapting working papers to fit in well with AuditBoard

Incentivized

In my opinion, SAP Process Control is well suited for bigger companies with an already mature Internal Control System as well as for bigger companies who want to completely new/redesign the internal control system. The size of the company, as well as the budget, is quite important when thinking about the implementation of SAP Process Control. A smaller company with e.g., 150 people should think more about implementing SAP FCM.

Incentivized

• AuditBoard allows real-time collaboration between control and business owners and auditors.
• AuditBoard has a lot of fantastic training sessions and office hours to help users make the most of the product.
• AuditBoard has great customer service personnel to answer questions and troubleshoot any issues.

Incentivized

• Native connection to SAP applications
• Automated monitoring process of SAP applications
• Workflow capabilities for control testing

Incentivized

• We used to perform our Risk Control Analysis (RCA) for each audit's planning in an Excel spreadsheet. Once we purchased the Risk Oversight module, AuditBoard helped us convert the RCA to a system function rather than a spreadsheet. At first, we lost some of the functionality the spreadsheet provided, but AuditBoard did continue to help us build and work towards a solution more similar to what we previously had. Though happy with it, it's still not perfect. As one example, I'd like to be able to link actual Ops Audit work steps that cover the risk and controls being outlined in the RCA, rather than just adding a comment to state which steps cover them. More of a preference, I suppose.
• I also had demoed their beta Resources and Scheduling module, but it didn't have enough functionality at the time to work for how we put the quarterly Internal Audit schedule together (using Excel). One thing I recall was that you couldn't pull in SOX controls or non-chargeable work (such as education or administration) to auditor's schedules; it was meant to schedule the Ops Audits only. It is possible they have already fixed or improved this; I just haven't seen the updated version.

Incentivized

• Default delivery of controls could be done by SAP on some basic controls like client openings, password controls, etc
• The messaging or customization of messages in different workflows is limited, which could be introduced to enhance the product
• SAP Process control does not have the capability for cloud product monitoring which is required with more SAP cloud products available right now

I remember there were a lot of sync issues when I used the internally developed software, but that's probably because a few people were working on the same project at the same time. I have not come across this issue in AuditBoard

Incentivized

The connectivity with other SAP products out of the SAP GRC suite, like Access Control and so on, was key for the decision. Also we had an already mature SAP System landscape as well as having internal processes that were similar to the SAP Process Control standard processes helped us with the decision to implement SAP Process Control.

Incentivized

• Hard to quantify. It was cheaper than the tool we had and we were able to get rid of standalone tool for surveys. overall, just better user experience for all.

Incentivized

• Automated alerts for controls issues
• Workflow capabilities; however, there's natively only 2 levels of review. More layers would be beneficial.

Incentivized