Tech Talks Daily
00:21:09 · Neil C. Hughes, Chris Radkowski
[00:21:09] S0: Yeah. And, you know, so much has changed, but, obviously, this is not your first rodeo, Chris. Well, as you said at the very beginning, seventeen years at SAP. So what have you learned about that gap between how ERPs control... Controls are designed and and how they operate in the real world? [00:21:28] S1: So so controls for everyone out there, you know, control can be anything. [00:21:35] S0: Yeah.
00:21:36 · Chris Radkowski
[00:21:36] S1: Control can be, hey. We, you know, we need to achieve the revenue objective this quarter. That's a control. And so a control is just a list of objectives, really, and requirements, and those can be implemented in various different ways. Some systems have configurations that enforce the control, don't allow that control to be performed. And other times, you have to go back and maybe perform more manual tasks. And I think, know, in today's environment, you have a fairly mature set of controls that are available for each of the types of regulations and security regulations. You... You'll probably hear the term ITGCs, I... IT general controls, SOX controls. You know, we talk a lot about SOX controls because these are the controls that go into your your finance process. And so you have different tools in your set of different tools you can you can use to validate that your controls are effective. And that's a key thing. I mean, that's like a a loaded term, controls controls, effectiveness. Oh, if we've had a failure of controls, that is a meaningful, event that occurs. And one of the things that I become fascinated with is is, is talking to people that ever... I have experienced these kinds of things behind the scenes. It's very revealing, and it's not very fun to have a controls failure or have some kind of audit finding or, you know, a material weakness is when you have to report a finding in your your 10 q, your quarterly reporting. And what happens when you have a material weakness is often the case where... And your your your your listeners will know this. Right? If you have a material weakness, it reflects badly on the company. It shows something isn't being well managed, and that affects your brand. It can affect your stock price, you know, the value of your of your company. It's... It can be profound. The impacts can be billions of dollars. Right? And so, I mean, ultimately, yeah, ultimately, we are trying to implement the controls that demonstrate our company is managed properly. And so that we don't have any kind of anomalous findings during... From our auditors that would result in anything we'd ever have to report to, report on our 10 q paperwork.
00:24:00 · Neil C. Hughes
[00:24:00] S0: You mentioned there something that really resonated as well because when things go wrong and that inevitable p one incident drops, technical teams can feel almost like that Spider Man meme with each member pointing at each other. So when something like that happens, where should responsibility sit across when we're talking about security teams, audit, compliance, and transportation teams? And that... So access governance doesn't become everyone's problem and nobody's priority. We've all been in those situations. Right?
00:24:28 · Chris Radkowski
[00:24:28] S1: Jeez. Neil, you've set me up for a softball question because it's a topic I'm fascinated by. You know? And I was at a conference, and I asked that question. I said, what do you guys do when something... Do things go wrong? You know? And and what happens when things go wrong? Yeah. And you can imagine. I mean, this really, really great customer, he's telling me... And he started he started telling me that sometimes the systems don't breathe. And I said, well, what do mean the systems don't breathe? And he was flapping his arms, you know, like like a bird, like a chicken, you know? I wasn't sure. It was a language difference there, but he he said sometimes the system freezes. And I was like, oh, okay. Everybody's experienced their computer freezing. You know? And what do you do? You reboot it. And... Well, okay. So if this computer is running your ERP system that's managing a giant supply chain, it triggers all... It triggers a process. And that process involves... And it happens within ten minutes. Yeah. So that process involves letting letting the, you know, the the the c suite know that there's been an incident. They they bring in, you know, IT experts to try to to diagnose the problem. And, I mean, it is it is a really big deal. Like, you you could have thousands of people, you know, waiting to screw nuts on, you know, with the chassis or, you know, you know, install the engine and so forth. You have a supply chain and an assembly process that's waiting for the system to come back up. And ultimately, in those cases, and there are very few, very rare, but they go in and they may spend two or three hours trying to diagnose the the the channel. Why is the system freezing? And you're turning off processes, turning on processes. We've all been in our computers trying to do that. And then ultimately, if they can't determine the problem, they'll reboot the system. I was completely amazed. So there's there's two there's two sides of the equation. So there's really critical and urgent events, and there's an entire process, and there's a communication chain that is that is created just for this. These are critical and urgent events that have to be dealt with immediately. Impacting your business. Your entire organization is aligned to make... Prioritize whatever activities to get that system up and running. And then there are other cases where may...
00:26:49 · Chris Radkowski, Neil C. Hughes
Maybe you've got maybe you've got a case where your incoming POs aren't matching. You've got some configuration change in your system, the incoming POs aren't matching requisitions or what have you. So you've gotta go through and make a bunch of different configuration changes. It's a it's a very different kind of urgent emergency access scenario. Both of them can have certain kinds of effects. But system freezing, rebooting, I'd never heard that before, and I'm completely fascinated. It's always completely amazing to talk to our customers that that that that are operating these businesses at such huge scale. And, you know, there's... It's always interesting things you hear. Even though you're... You may be talking to a internal controls team, they know the ins and outs of the business. They know what's going on. And I I had another... I had conversation the other day with an organization. They're, like, they refined crude oil into its various different products, and they've got literally, like, super tankers coming in on a, you know, like, two or three a week come in [00:27:54] S0: Yeah. [00:27:55] S1: With half a million barrels of oil, you know. I I just love... I love thinking about the scale of of these operations. And even though even though you're on the internal controls team, you can have a profound effect.
00:27:55 · Chris Radkowski, Neil C. Hughes
[00:27:55] S1: With half a million barrels of oil, you know. I I just love... I love thinking about the scale of of these operations. And even though even though you're on the internal controls team, you can have a profound effect. [00:28:09] S0: Absolutely. Love it. And finally, just to give everyone listening a valuable takeaway, if they're in a organization that is about to begin a major ERP or AI transformation, that's why they're listening today, Any tips on what controls they should be designing in right from day one rather than trying to bolt on after go live?