Clayton Homes

Matt’s team used Fastpath to design user roles for both the Oracle Cloud financial and supply chain products prior to go-live. Big Four auditors provided by Berkshire Hathaway helped with reviews of the user roles and the company passed “with flying colors.” Implementing Fastpath from the start of their Oracle Cloud implementation has made it much easier for Matt’s team to monitor maintain the security roles within Oracle. Fastpath lets his team review weekly Separation of Duties automated reports. “ITGC and SOX becomes less of a concern,” he said. “And if anything is a problem, I learn about it through my weekly audit reviews.” Access reviews are conducted quarterly, and roles can be reviewed by business unit. Fastpath also helps the team monitor sensitive access issues (correcting manual journal entries, errors, and higher-risk access problems) on a monthly basis, identify exposure to risk, and to take corrective action, as necessary. 

When sharing his feedback about the company’s experience with Fastpath, Matt was compelled to stress the lessons he gleaned from the companies he interviewed while performing his due diligence, looking for a SoD tool like Fastpath—and how being proactive helped his team avoid the issues they encountered. A key to the success of Clayton Homes implementing Fastpath was to plan for and address SoD roles, controls, and rulesets on the frontend, before the implementation began. “Many companies wait until the implementation is over and the roles have been baked in,” said Matt.

“Changing the roles at that point requires a complete overhaul of the business processes within the organization. This affects not only change management, but also the business practices after the users become used to how the new systems work. By setting up the security and SoD roles with the proper functionality during the implementation makes it much easier for users because they are already changing their work routine with the new software and will not notice the difference.” So, if this problem is so prevalent, why do so many companies fall into this trap? Matt thinks he knows at least some of the reasons: “It’s the nature of the SaaS systems and the complexities of going to the cloud. The CFO is ultimately responsible for the control environment, but with the pace and growth of technology, you also need someone who understands the financial controls as well as the systems. That really is the challenge – having the people on the team that can keep up with the technology.” Another piece of the puzzle involves the system integrator (SI): “Most companies don’t know that implementing system functionality and configuring the system security and controls are two distinct parts of the job. Nobody audits on the front-end and tells them there are these gaps for exposure. And there are so many changes the system integrator is doing when moving to a new system that it can easily get lost.”