How to achieve a cost and time reduction:

Project Team: The Integration / Migration Project is handled by a team which has experience in both QAD and SAP. This knowledge enables them to understand the requirements of both ERP’s and to map the requirement of the customer

Stage 1 – Master Data and Modeling: A focused Implementation / Migration Approach is adopted for execution. Key workshop is held onsite for key functional requirements and master data management. Models are built on QAD and SAP based on existing schema, processes and key functional requirements with revised master data and key reports. Both master data and system models are done from offsite. This considerably reduced the time taken and the model is identifiable readily by the business.

Stage 2 – Migration and Integration: Pre build connectors and utilities are used for migration and integration. For example, in P2P (Procure to Pay) process, PO is raised in SAP, Receipt is made in QAD, Matching and Payment is done in SAP. Prebuilt connectors are used for integrating PO (SAP), Inventory (QAD) and Payables (SAP) modules. This significantly reduces the time and effort taken for migration, integration and Go Live.

Stage 3 – Roll Out: Roll Out is handled through identification and handling of repeatable tasks through separate teams. Tasks like User security management, Data conversion & Migration and Configuration Management are handled offsite through specific teams with SLA.

Results: Company ABC achieved a 30% reduction in the overall time and cost in moving over to a structured dual ERP. It also achieves common Shared Services, Master Data Management, streamlined processes and elimination of BI for financial consolidation.

Lets now make a case for single ERP in ABC Inc using the same hypothetical situation…….. (to be continued)

Decision: Go for Option-A – Retain both QAD and SAP but leverage them in an effective way.

What is the business case for existence of dual ERP here?

ABC Inc has inherited QAD and SAP across plants and divisions. Both the ERP’s are in different states in terms of maturity and life cycle.

ABC Inc, after due analysis of (1) Cost & Time and (2) Optimum TCO, presents the following compelling arguments.

1.    Take advantage of the inherent strength of QAD and SAP to meet company’s long term requirements.

2.    Realign the current model to provide best of breed business process solution across the enterprise

3.    The cost of realigning the solution in their case is more effective than complete replacement.

4.    Incorporate and implement Shared Services, Master Data Management and Best of Breed processes.

Dual ERP architecture

However, ABC will have to address the following issues:

1. Since BI / DW will be receiving data from 2 ERPs – e.g. GL coming from SAP and operational data coming from QAD, it will have to eliminate any possible reconciliation issues.
2. Introduce a MDM system which will interface with QAD and SAP to effectively address data model issues. This will address data duplication, data integrity and data enrichment requirements.

ABC Inc arrives at a revised IT ecology of

QAD for Manufacturing, Inventory, Sales and Distribution and

SAP for Purchasing and Financial incl consolidation.

ABC achieves the dual structure with 30% reduction in cost and time for execution. But how does ABC plan to achieve 30% reduction in cost & optimum TCO in this approach? It has to contend with implementation of both QAD & SAP and yet attain cost balance.

While Section 404 of SOx has made to mandatory for companies to annually assess and report on the effectiveness of internal controls over financial reporting. Financial reporting is directly influenced by multiple factors including the industry in which the company is working, local statutory requirements i.e., US GAAP and size of the company. From an internal controls perspective, it is entirely influenced by Risk. And this risk is entirely influenced by business and IT processes in place.

To an extent SOX has made Internal Controls to be looked at not as a one time exercise. For successful compliance the controls have to be existent, controls have to operational and continuously operational.

Complying with internal control requirements carry certain cost. This cost will be both one time and recurring. By making internal controls tightly integrated with operational components, companies can look at both increasing the efficiencies & predictability of their operations as well as reduce the ongoing cost of maintaining controls. Potentially, a company is also saved the cost and embarrassment of any misstatements, malfeasance and financial frauds.

Let’s look at some of the key influencers:

Financial Reporting: Financial Reporting is primarily influenced by the industry and statutory regulations. More so for companies in regulated domains like Insurance, Banking etc. Local Statutory reporting and disclosure requirements are another key factor. If a company is operating in multiple geographies and have to report in different formats i.e., US GAAP, IFRS etc. each of these will have a bearing on how financial information is processed for final statement and disclosure

Business Process: Addressing Risk through internal controls will strongly influence and be influenced by business process. Here business process could mean revenue recognition, special purpose vehicles, capitalization / amortization etc. Evaluation and mitigation of risk will include assessment of policies & procedures guided by financial reporting objectives and aided by financial reporting competencies.

IT Process: Information Technology is perhaps the biggest area for internal controls both in terms of impact and in terms of coverage. Risk assessment in this area is directly related to the complexity of IT ecology. With multiple systems, silos of information processing and complex integration strategies, assessment ranges from access control to change control, data integrity to data protection. In many of the internal control review assignments audit that Thirdware has executed, much of the leakages emanate around these four areas:

1. i.        Generic ids and access control
2. ii.        Segregation of duties
3. iii.        Audit trail
4. iv.        Data integration and integrity

Internal controls, like any other key management process, must revolve around these 5 key processes. COSO Framework on Internal Controls elaborates these areas extensively.

1. Control Environment: Setting the overall control environment including buy in from top management, organizational structure, financial reporting competencies, authority & responsibility and human resources.
2. Risk Assessment: Establishment of financial reporting objectives, assessment of financial reporting & fraud risks
3. Control Activities: Address risks, selection & development of control activities incl policies & procedures and IT controls
4. Information and Communication: Address information relating to financial reporting & internal control both for internal and external consumption
5. Monitoring: Ongoing evaluation and corrective actions.
   

More to follow

Does a multi ERP environment make sense in an SME? Or should companies move to a single ERP only?  There are pro’s and con’s to both the approaches and much of it would depend on the business strategy of the company.

Lets first take a case of living with dual ERP’s with a hypothetical case study?

ABC Inc has eight plants: Plants 1 to 5 are on QAD and Plants 5 to 8, which were recently acquired, operates on SAP (Figure-1 below). Financial Consolidation is achieved through Hyperion.

Dual ERP

The issues facing the company are (1) ability to scale to future requirements (2) cost of multiple support (3) disparate master data and (4) disparate processes. All these anomalies are (1) increasing the total TCO and (2) questioning the ability to handle future growth.

ABC Inc has two options. Option-A leverage the current dual ERP i.e., QAD and SAP or Option-B move to a single ERP i.e., either QAD or SAP.

Lets make a business case for both the options. In a real life scenario other factors like availability of budget, extent of implementation complexity etc may make the decision more individual and unique. For our purposes, let see the pro’s and con’s of both the options.

(To continue)

Based on the numerous engagements Thirdware was involved in helping companies meet Internal Control requirements, this blog series should help explain the overall approach and execution. While many of the software vendors have provided patches or modules inside their application, unless the overall control process (both business and IT) is understood and addressed in unison, it is never complete.

Coming to the subject:

Internal Controls, for audit and certification purposes, must meet three essential conditions:

1.      Compliance and Controls must be documented

2.      Controls must be implemented and complied on an ongoing basis. It should be made part of the business process.

3.      Evidence must be available to prove compliance with the documented processes

If anyone of these elements is missing, the basic tenet of compliance is not fulfilled.

The foundation of these 3 conditions lies in the following approach

• Understanding and documenting Business and IT controls and their relationship to the financial reporting process
• Identifying risks and designing/implementing controls to mitigate risks and continuously monitoring them
• Ensure the controls are updated (Ongoing) and correspond to business process changes or the financial reporting changes impacting operations

The entire controls process lie both inside and outside the application. While, most companies have completed their initial phase in compliance, the requirement is to change SOx compliance from a project (audit compliance) based approach to that of a business process based approach.  Adopting a process-based approach to SOx compliance helps companies maintain strong internal control over financial reporting and saves money in the long-term and ensures a sustainable controls environment.

At a broad level, Internal Controls and Compliance must address the following: