2013, Asprion, Petra, Knolmayer, Gerhard, Sprague, Ralph H.

In this paper we follow a theory-based approach to study the assimilation of compliance software in highly regulated multinational enterprises. These relatively new software products support the automation of controls which are associated with mandatory compliance requirements. We use institutional and success factor theories to explain the assimilation of compliance software. A framework for analyzing the assimilation of Access Control Systems (ACS), a special type of compliance software, is developed and used to reflect the experiences obtained in four in-depth case studies. One result is that coercive, mimetic, and normative pressures significantly effect ACS assimilation. On the other hand, quality aspects have only a moderate impact at the beginning of the assimilation process, in later phases the impact may increase if performance and improvement objectives become more relevant. In addition, it turns out that position of the enterprises and compatibility heavily influence the assimilation process.

2008, Asprion, Petra, Knolmayer, Gerhard

In diesem Beitrag wird diskutiert, welche Aufgaben GRC Software unterstützen soll, wie die Funktionsbreite von GRC Software anhand von Frameworks wie COSO beurteilt werden kann und welche wirtschaftlichen Auswirkungen mit dem Einsatz von GRC Software auf interne und externe Kontrollen verbunden sein können.

2011, Knolmayer, Gerhard, Asprion, Petra, Kotlarsky, Julia, Willcocks, Lessli P., Oshri, Ilian

Companies and their business processes are subject to many regulations. Today’s business processes are widely supported by IT systems. Therefore these systems play an im portant role in assuring compliance. The need to assure compliance can influence IT out sourcing decisions. We summarize some frameworks that give recommendations on assuring compliance of outsourced activities. For a service provider with many globally acting customers similar audit activities of many auditors would be time-consuming and expensive. To avoid these costs, the American Institute of Certified Public Accountants (AICPA) suggested that an auditor may provide a SAS 70 Audit Report Type II which confirms the existence and effectiveness of internal con trols. Recently, the AICPA replaced the SAS 70 with the attestation standard SSAE 16. Based on frameworks and guidelines we discuss compliance issues in special cases of outsourcing relationships such as Subcontracting and Cloud Computing.

2009, Asprion, Petra, Knolmayer, Gerhard

ERP-Systeme bieten zahlreiche Kontrollmechanismen an, deren systematische Nutzung unter Wirtschaftlichkeitsgesichtspunkten attraktiv sein kann. ERP General Controls sollen die Ordnungsmäßigkeit des ERP-Einsatzes sicherstellen und sind Voraussetzung, um ein ERP-System als Instrument für Compliance-Nachweise nutzen zu können. ERP Application Controls können als Instrumente genutzt werden, um die Compliance von Geschäftsprozessen nachzuweisen. Die in ERP-Systemen vorgehaltenen Kontrollmechanismen können COBIT-Domänen und -Prozessen zugeordnet werden; wir zeigen dies am Beispiel von SAP ERP.