miami-dade county public schools-sap

©2010 KPMG LLP, A Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative ( “KPMG International” ), a Swiss entity. All rights reserved.

ADVISORY

KPMG LLP

Miami Dade County Public SchoolsSAP Configurable Financial Controls AssessmentWith Management’s Response

May 28, 2010


MIAMI-DADE COUNTY SCHOOL BOARD

SAP Configurable Financial Controls Assessment – OverviewControls help ensure that financial and operational information is reliable, operations are performed efficiently and achieve effectiveresults, assets are properly safeguarded, and that the actions and decisions of the organization are in compliance with laws, regulations,and contracts. It is important to note that controls are not only used to comply with financial reporting regulations but provide a balancebetween process optimization and risk mitigation. Thus, by implementing controls companies can increase data reliability and improvereporting and monitoring of information.

To that end, Miami-Dade County Public Schools ( ‘M-DCPS’ ) has engaged KPMG, to assess the configuration of SAP configurable financialcontrols related to the Record-to-Report, Procure-to-Pay, and Grants/Budgeting processes. More specifically, KPMG has been tasked withthe following:

Interview M-DCPS process owners and configuration support staff to gain an understanding of the financial controls configuration. Access the M-DCPS Implementation Guide (IMG) to assess controls configuration based on KPMG’s business system controls (BSC)

methodology. Assess current M-DCPS controls portfolio against KPMG’s standard control catalogs for each of the in scope process areas. Develop observations and recommendations on the current configurable financial controls within M-DCPS’ SAP environment.

KPMG’s review has been divided into two main sections: Control Configuration Review & Configurable Control Pain Points.

Control Configuration Review: Review of configurable controls to validate adequate configuration based upon industry leadingpractices.

Configurable Control Pain Points: Analysis of pain points experienced by M-DCPS related to issues arising from controls configuredwithin SAP that were not configured in previous Financial systems / applications.

Overview

2



Executive SummaryThe KPMG team, utilizing KPMG’s proprietary SAP control matrices in addition to controls matrices developed specifically for publicsector clients, worked with M-DCPS staff to validate adequate configuration of system/configurable controls for the following processareas: Record-to-Report, Procure-to-Pay, and Grants Management / Budgeting. The public sector controls matrices although notdeveloped specifically for M-DCPS processes, provide a comprehensive set of leading practices within K-12 business processes. Byutilizing the public sector control matrices, KPMG was able to review the SAP System configuration for key configurable controls andidentify any deviations from leading practices. In doing so, KPMG was able to map the M-DCPS SAP environment against 177 system /configurable controls and leading practices.

To provide targeted recommendations to M-DCPS management, any deviations, noted within the report as ‘observations’, were reviewed and validated with relevant business process owners and end-users. Business process owner and end-user comments were utilized by KPMG to generate relevant control configuration recommendations for M-DCPS. As of June 4, 2010, all KPMG observations were discussed with M-DCPS management. Through these discussions, KPMG has determined that M-DCPS management has accepted the observations and was in the process of implementing the resulting recommendation, or had an appropriate response to any deviations from the resulting recommendation. These actions and any associated Management Comments will be detailed in a subsequent Management’s Response.

The table below provides a high-level overview of the number of leading practice configurable control activities the M-DCPS SAP application was mapped against and the number of noted observations for each in-scope process area:

Control Configuration Review

3

Process Area Total Controls Reviewed # of Observations

Record-to-Report 65 6

Procure-to-Pay 41 2

Grants / Budget Management 57 0

Order-to-Cash 14 2



ProceduresBased upon the SAP Public Sector control matrices, KPMG reviewed the configuration of each control within SAP to validate that it hadbeen adequately configured within SAP. Specific procedures varied depending upon the control type. Procedures for each control typeare outlined below:

System Configuration – Reviewed IMG and/or specific t-codes to determine whether system tolerances, account mappings,automatic posting procedures, etc meet relevant control objectives.

Management Review / Reconciliation – Controls of this type are manual in nature, however, where necessary KPMG will evaluatethe configuration of standard reports to validate adequate information can be obtained to perform the review / reconciliation.

System Access – Controls of this type will be incorporated within phase 2 of the review (SAP Security and User Access Assessment).

Data Interface – Not in scope. Only SAP system and configurable controls were reviewed for adequate configuration.

Manual Controls – Not in scope. Only SAP system and configurable controls were reviewed for adequate configuration.

The observations noted through review have been consolidated by process and recommendations provided.

4

Control Configuration Review



The Record-to-Report process is focused specifically on the posting and reporting of financial data both internally and externally. Through the configuration of legal entities, accounting statements (balance sheet, P&L, etc.) and accurate posting procedures the Record-to-Report sub-processes allow an organization to accurately report their financial position.

Utilizing the KPMG propriety control matrices in addition to Public Sector SAP Controls matrix, KPMG reviewed the M-DCPS SAPenvironment’s configuration of automated controls for the Record-to-Report process which included the following sub-process areas:External / Internal Financial Reporting; Chart of Accounts, Organizational Hierarchy; Close Accounting Period; Journal Entries; G/L MasterData; Treasury; Controlling.

The M-DCPS Record-to-Report SAP process was mapped against 65 leading practice control activities of which 59 where found to have noconfiguration issues. However, only 6 observations were noted as depicted within the table below:

Control Configuration Review – ObservationsRecord to Report

# Observation Recommendation

RtR.1

Not all customer account groups have been configured to require the entry of a reconciliation account when creating a customer assigned to that particular account group.

As an inherent control, SAP requires that all sub-ledgers agree to the general ledger. However, to make the inherent control operate as designed, reconciliation accounts must be adequately configured and assigned to customers, vendors, assets, etc. to help ensure that the sub-ledgers and general ledgers agree. One way in particular is to configure the ‘reconciliation account’ field as a required entry when creating a customer, asset, and / or vendor.

Currently, the following customer account groups have not been configured to require the entry of a reconciliation account: FEDD, FEDL, FEDS, LOCL, STAT.

KPMG recommends that M-DCPS consider configure the following customer account groups to ‘require’ entry of a reconciliation account when creating a customer: FEDD, FEDL, FEDS, LOCL, STAT.

MDCPS Management Response: M-DCPS has implemented KPMG’s recommendation to configure all customer groups, including Grant Sponsors (FEDD, FEDL, FEDS, LOCL, STAT) to require the entry of a reconciliation account.

5



Control Configuration Review – ObservationsRecord to Report – Cont’d


RtR.2

All vendor account groups have not been configured to require the entry of a reconciliation account upon creation of vendors.


Currently, the following vendor account groups have not been configured to require the entry of a reconciliation account: 0007, Z004, and Z005.

Through inquiry with relevant business process owners and accounting personnel, it was noted that M-DCPS does not receive invoices from vendors assigned to vendor account groups: 0007, Z004, and Z005. Thus, the ‘reconciliation account’ field has been configured as an optional entry.

However, KPMG recommends the following:1. Review configuration of vendor account groups 0007,

Z004, and Z005 for appropriate configuration based upon M-DCPS business rules.

2. Review list of vendors assigned to these account groups for appropriateness, and continue to do so on an on-going basis (monthly, quarterly, semi-annually, etc.) as deemed necessary by M-DCPS management.

MDCPS Management Response: Management has reviewed the configuration of the Account Groups (0007, Z004 & Z005) during go-live and once again at the recommendation of KPMG and found them to be configured based on existing M-DCPS business rules. These three account groups are managed as follows:

Acct Group 0007 – Delivering Plants:Currently only two vendors exist under this account group, Plant 2000 (S&MD) and 3000 (S&MD Textbooks). They were created to enable the purchasing of goods via SRM to subsequently create a stock transport orders in ECC for S&D or Textbooks. Account group 0007 is not part of the vendor supplier self-service nor the current MDCPS vendor application so no other vendor can be created automatically by the system. Since we do not invoice against this vendors, no accounting information was needed. If we introduce another module such as plant maintenance or warehouse management, then the configuration and fields needs to be checked for appropriateness.

Management Response to RtR.2 Continued on Next Page…

6





RtR.2

All vendor account groups have not been configured to require the entry of a reconciliation account upon creation of vendors.


Currently, the following vendor account groups have not been configured to require the entry of a reconciliation account: 0007, Z004, and Z005.

Through inquiry with relevant business process owners and accounting personnel, it was noted that M-DCPS does not receive invoices from vendors assigned to vendor account groups: 0007, Z004, and Z005. Thus, the ‘reconciliation account’ field has been configured as an optional entry.

However, KPMG recommends the following:1. Review configuration of vendor account groups 0007,

Z004, and Z005 for appropriate configuration based upon M-DCPS business rules.

2. Review list of vendors assigned to these account groups for appropriateness, and continue to do so on an on-going basis (monthly, quarterly, semi-annually, etc.) as deemed necessary by M-DCPS management.

MDCPS Management Response Continued from Previous Page …

Acct Group Z004:Vendors created under this account group are driven by the information contained in the vendor application or entered via the supplier self-service portal (Section 2 of the Vendor Application - Mailing Address for PO's or correspondence). Maintenance of these vendors takes place when an official document for the vendor in question is received usually in a form of a signed letterhead memo from the company or via a revised vendor application. This vendor group is setup as ordering address only and no invoice or payment will be generated against this vendor group; hence, a reconciliation account is optional.

Acct Group Z005:Vendors created under this account group are driven by the information contained in the vendor application or entered via the supplier self-service portal (Section 5 of the Vendor Application - Affiliated Company ( Parent company, subsidiary, joint venture, etc.) and /or Section 11 - Agent, Representative or Employee Authorized to Transact Business on Behalf of the Entity Firm). Maintenance of these vendors takes place when an official document for the vendor in question is received usually in a form of a signed letterhead memo from the company or via a revised vendor application. This vendor group is setup as representative and no invoice, payment, or purchase orders will be generated against this vendor group; hence, accounting information is optional.

7





RtR.3

The ‘reconciliation account’ and ‘field status group variant’ settings for the account groups assigned to the DCPS chart of accounts have not been configured as ‘Required’ entries when creating sensitive G/L accounts (e.g. reconciliation accounts).

The purpose of this setting is to help ensure the completeness and accuracy of G/L account master data and subsequent G/L transactional postings.

KPMG recommends that to help ensure journal entries are recorded completely and accurately, M-DCPS consider setting the Reconciliation Account and Field Status Variant Fields as required entries for sensitive GL accounts (e.g., Reconciliation Accounts).

MDCPS Management Response: Per M-DCPS policies and procedures, all the transactions posted in the system should have complete account structure i.e., fund, GL account, location and functional area. Therefore in order to meet this requirement specific settings were made to each field status group so that all the transactions in the system are posted with complete account structure. In certain instances, the District has maintained specific settings as optional because the values for these fields have been previously defined in Substitution and FM Derivation rules.

8





RtR.4

Posting thresholds are currently set to the SAP defaults. KPMG noted that the default upper limit for postings to be:

- Amt per document: $1,000,000,000,000.00-Amt per open item account item: $9,999,999,999.00

SAP provides several layers of control to restrict to whom and to what extent users can post documents. Once such layer is the parking and posting of documents. A user can initiate a posting and then ‘park’ it, which results in no posting to the G/L and then another user can review the parked document and then ‘post’ it. The posting action does result in an actually posting. Additionally, SAP can be configured to place limits on the individual amts of each line item for users who have access to ‘post’ a parked document.

Thus, as a leading practice organizations should configure the upper posting limits to be in-line with their specific business rules to reduce the likelihood of human error resulting in under or overstatement of the general ledger.

Through inquiry with business process owners and relevant accounting personnel, KPMG was informed that M-DCPS utilizes the park / post, and automated workflow functionality within SAP. Thus, when a posting is made it is initially parked, and based upon the $ amt, among other things, it is automatically routed via workflow to an approver, who has appropriate authorization to approve and post the document.

Therefore, KPMG recommends the following:1. Validate that only authorized individuals have been

granted access to approve and post parked documents.2. Review the current default posting thresholds and modify

them to an amount in-line with M-DCPS business rules , in an effort to reduce the likelihood of human error upon posting the document resulting in and an under or overstatement of the general ledger.

MDCPS Management Response: Recommendation #1 - As noted in the KPMG Observation, M-DCPS utilizes the park/post and automated workflow functionality within SAP. Regarding journal voucher FI (Finance) documents, end users in the MDCPS district have access to create and park journal voucher FI documents. The parked document is then routed through workflow to approvers who have the appropriate authorization to approve the document. The approved journal voucher FI document is subsequently routed via workflow to the Accounting Department for final review and posting by authorized staff. Current accounting department journal voucher posting limits are as follows:

Accounting Directors (or authorized substitutes) < $5,000Assistant Controller (or authorized substitutes) < $1,000,0000Controller (or authorized substitutes) >= $1,000,0000

Recommendation # 2-- Regarding the posting threshold limits pertinent to all FI documents, M-DCPS has implemented KPMG’s recommendation to lower the posting threshold limits as follows:

Amount per document: $1,000,000,000.00Amount per open item account item: $1,000,000,000.00

9





RtR.5

The DCPS Company Code is currently not set to productive, which may result in the deletion of the company code and underlying transactional data should deletion programs be executed.

The company code is an organizational unit within SAP that allows the structuring of an enterprise from the financial accounting perspective.

KPMG recommends that M-DCPS set the DCPS company code to productive to eliminate the risk that deletion programs could delete the company code and any underlying transactional data.

MDCPS Management Response: Management (ITS) plans to follow KPMG’s recommendation and set the M-DCPS Company Code to “Productive” no later than the week of September 20th.

RtR.6

Key fields have not been configured as mandatory when entering internal orders.

In most cases the following fields should be configured as ‘Required’: company code, CO area, identifier for revenue posting allowed, identifier for stat order, order type, responsible cost center, true costs posted to cost center, profit center.

KPMG notes that should these fields not be set as required there is a risk that Internal Orders may not be complete, which can negatively impact management and financial reporting.

Through inquiries with business process owners and relevant accounting staff, KPMG was informed that M-DCPS does not extensively utilize internal orders, if at all, as the shopping cart functionality is used in their place. Therefore, KPMG reviewed SAP security and internal order tables and determined that 64 users have been granted access to create / change internal orders and internal order functionality is used on a very limited basis.Therefore, KPMG recommends M-DCPS perform the following:1. Review M-DCPS processes to determine the need for

internal orders.2. If internal orders are in fact not utilized, remove access

to create / change internal orders.3. If internal orders are utilized then validate that access to

create the internal orders have been appropriately restricted and configure key fields to be required.

MDCPS Management Response: Management has removed the ability to create / change internal orders from all roles.

10



The Procure-to-Pay process is focused specifically on the acquisition of and payment for goods and/or services as required by the organization. Procure-to-Pay enables the full purchase to payment process, connecting procurement and invoicing operations through an intertwined business flow that automates the process from identification of a need, planning and budgeting, through to procurement and payment. Key benefits are increased financial and procurement visibility, efficiency, cost savings and control.

Utilizing the KPMG propriety control matrices in addition to Public Sector SAP Controls matrix, KPMG reviewed the M-DCPS SAPenvironment’s configuration of automated controls for the Procure-to-Pay process which included the following sub-process areas:

The M-DCPS Procure-to-Pay SAP process was mapped against 41 leading practice control activities of which 39 where found to have noconfiguration issues. However, only 2 observations were noted, as depicted within the table below:

Control Configuration Review – ObservationsProcure to Pay


PtP.1

Key fields have not been configured to be referenced during duplicated invoicing checks.

M-DCPS SAP is currently configured to check reference number of the invoice to avoid duplicate invoices.

In similar organizations, the reference number, invoice date, and company code are also included in this check.

KPMG notes that the lack of these other checks could potentially lead to double paying an invoice, which can negatively impact management and financial reporting.

Through inquiry with business process owners and relevant personnel, KPMG was informed that M-DCPS is aware of this situation. M-DCPS is comfortable with the current setup of the duplicate invoicing check configuration. M-DCPS currently only has one company code.

Even though M-DCPS has determined that the current setup adequately addresses M-DCPS’s requirements, KPMG recommends the following consideration:

• M-DCPS investigate the feasibility of adding the invoice date as an additional duplicate invoicing check in configuration to serve as an additional layer of control.

MDCPS Management Response: The review of all invoices with the same reference number regardless of invoice date or vendor, allows us to review all of the selected invoices to determine whether they are or are not duplicates. We feel that adding invoice date as a duplicate invoice check would not add value to the process of identifying duplicate payments because we would exclude any invoices with the same reference number that had a different date.

11



Control Configuration Review – ObservationsProcure to Pay – Cont’d


PtP.2

Key system messages that alert the user that a duplicate vendor exists have been set to warning rather than error.

M-DCPS has SAP system message #144 to warn and not hard error. This warning message alerts the user that they are attempting to create a vendor which already exists in the system. However, the user can simply enter past this warning and continue processing. An error would stop further processing.

KPMG notes that the presence of duplicate vendors could negatively impact management and financial reporting.

Through inquiry with business process owners and relevant personnel, KPMG was informed that M-DCPS is aware of this risk and has other controls in place to limit the possibility of the creation of a duplicate vendor.

Even though there are additional controls in place that M-DCPS management has deemed adequate, KPMG recommends the following:• M-DCPS investigate the feasibility of enabling this system

message as an error rather than a warning as an additional layer of control.

MDCPS Management Response: MDCPS Management has addressed this issue.

12



Other Process Areas: Order-to-Cash

The overall goal of the Order-to-Cash process is to sell goods/services to customers and apply cash received from the customers.Through inquiry of business process owners and relevant end-users, KPMG noted that the SAP Order-to-Cash process is used on alimited basis by the district. Mainly to manage receivables from advertising and facility rental activities. The Order-to-Cash process wasnot within the overall scope of the review, but given the fact that it does have a limited impact on financial reporting, KPMG performeda high-level review of configurable controls as they pertain to in-scope processes within the following Order-to-Cash sub processes:Customer Master; Accounts Receivable; Credit Management; Orders; Billing; and Credit Memos.

The M-DCPS Order-to-Cash SAP process was mapped against 14 leading practice control activities where only 1 observation were noted,as depicted within the table below. It should be noted that due to time constraints these observations were not reviewed in detail withbusiness process owners and relevant end-users. However, KPMG has provided the observations to highlight leading industry practiceswith the understanding that some may not apply to M-DCPS’ processes.

Control Configuration Review – ObservationsOther Process Areas: Order to Cash


OtC.1

Field status settings for customer master data are currently not configured according to industry leading practices.Data integrity is an integral part of any system and even more important for master data. Thus, it is important to configure the Field Status Group settings according to an organizations business objectives by setting key fields as required to help ensure that customer data is appropriately maintained.

Typically, the following fields within the customer master are set to ‘required’: Name 1; Search Term A; Postal code, City; Reconciliation Account; Sort Key; Cash Management Group; Pricing procedure; and Taxes and licenses.

KPMG recognizes that M-DCPS uses the Order-to-Cash process on a limited basis, however, KPMG recommends the following:1. Review current order-to-cash processes and determine

the need to configure the customer Field Status Group settings to include key fields as required.

MDCPS Management Response: M-DCPS has reviewed the Field Status Group Settings to confirm that key fields necessary for the billing process are configured as required fields. However, other fields not pertinent to the District’s billing process, including Cash Management Group, Taxes and Pricing are not set up as required fields, as they do not impact data integrity.

13

miami-dade county public schools-sap

Documents