British American Tobacco (BAT) has highlighted the benefits of using ETL (extract, transform, load) technology to audit its SAP data on a monthly basis.
Computerworld UK spoke to David Barkhausen, BAT's senior IT auditor, about the company's use of Intellicorp's LiveCompare tool to audit over a terabyte of data from its sprawling SAP infrastructure.
"We are using ETL on our current SAP landscape, which is pretty complex. LiveCompare extracts data from 12 separate SAP systems - two in the Americas, seven in the EMEA region, and another three in Asia-Pacific," said Barkhausen.
"Auditing was traditionally reliant on a sampling approach to get assurance of whether the controls and processes are operating as expected. If, for example, you had a population of 1,000 and you took a sample of 30, and all of those 30 had no issue, you could be pretty confident that the processes were operating correctly."
He added: "However, some of our SAP systems have got upwards of one hundred million transactions going through one table each month. We have got 114 tables. Taking a sample out of a population that size just doesn't make sense."
Consequently, Barkhausen has opted to deploy computer assisted techniques, which rely upon data analysis and automated scripts to interrogate the data automatically, and therefore identify any anomalies.
BAT had been extracting data manually prior to deploying LiveCompare, which Barkhausen said created an element of risk, as the integrity of the data could have been impacted when downloading from SAP to a text file.
However, it now has workflows that loop through all of BAT's tables and data is extracted in a standardised manner.
BAT's auditing team is using these techniques to analyse all of the underlying SAP data to ensure that the company is adhering to its own policies, procedures and standards.
"For example, internally we have stated that before we pay a supplier, the order needs to have emanated from a purchase order that's been generated in the system, which is matched to a goods receipt, and then the invoice we received from the supplier needs to match our purchase and what was actually received," explained Barkhausen.
"So, we are using LiveCompare to interrogate through and see if there are any major variances and find out whether this system is configured correctly."
BAT pulls data directly from the underlying SAP tables and extracts it into its on-premise data warehouse on a monthly basis to generate a regular 'snapshot' of the company's processes. It then runs analytics on the updated data, which is scripted in a programme called ACL.
Barkhausen's team stores a years' worth of data, and so when the latest month is extracted, the oldest set is deleted.
BAT has now also freed up time to run more intelligent analytics.
Barkhausen said: "We can now actually audit 100 percent of transactions going through. We have moved away from a sampling approach to a more granular, accurate picture of our systems.
"When we first started extracting data we were only pulling it from our five main systems and this was taking between two to three weeks every month, which was leaving very little time to develop our analytics."
He added: "We used to only produce analytics to our key orders and on a required basis, but now the process is automated, we have three free weeks every month to develop new analytics that cater to the business need."
BAT now produces analytics for every order it carries out. It is also undergoing a complete transformation of its SAP landscape, where it is consolidating its 12 global systems into just one instance of SAP.
It will have this single instance operating in all of its 65 global markets by 2016, and has just gone live with its first market, Malaysia. BAT will progress at a rapid rate by going live with at least one new market every month up until completion.
However, with this project being carried out, Barkhausen is already considering what this means for his ETL system for auditing data.
He said: "We are discussing with the project team what the best solution is. We have realised over the years that as an audit function we are not the only people extracting data each month from SAP - marketing and other teams also use it for business intelligence work.
"So, what we are trying to do is team up with all these groups and come up with a single solution, rather than just implementing our own solution."