Helping enhance the real value of SAP GRC through RouteONE

Contents

RouteONE: enhancing the real value of SAP GRC

RouteONE: The faster, better, more affordable option

The RouteONE framework

Want to learn more? Insights on governance, risk and compliance

Contacts

3Helping enhance the real value of SAP GRC through RouteONE |

RouteONE — enhancing the real value of SAP GRCWhen you commit to an SAP Governance, risk and compliance (GRC) implementation, you want to maximize the value it brings to your organization. You expect the solution to work as expected and to go live within budget and on schedule. You’ll also want to make sure every stage goes as smoothly as possible and that any challenges are overcome with minimal disruption.

However, running a successful project to implement SAP GRC is one thing. Making your investment deliver success in the long term is another. The true value of SAP GRC is only realized when both your leadership and end users embrace it to further improve your business on a broader scale.

RouteONE has been developed to support you to:

• Run more efficient and effective SAP GRC projects, with earlier time-to-value

• Manage risk in a more cost-effective way by reducing capital and associated operating costs

• Accelerate end-user adoption and improve user experience

• Maximize use of SAP GRC to develop a more risk-aware culture with GRC embedded in the business

From a direct business benefits perspective, SAP GRC delivered using RouteONE can thus help:

• Reduce control and compliance operations costs

• Support competitive advantage through processes that work every time

• Enhance your organization’s brand and reputation

RouteONE Overview

4 | Helping enhance the real value of SAP GRC through RouteONE

RouteONE Overview

What is RouteONE?RouteONE is an EY portfolio of innovative software tools, content and methods that helps clients get greater value from using SAP GRC through better and faster projects, and through improved user adoption.

The core of RouteONE is the QuickBuilder, an innovative robot that we use to help build client-specific SAP GRC systems more accurately and in a fraction of the time that a conventional or pre-configured approach usually takes. However, our experience is that it is not all about speed — it’s also about helping stakeholders to be able to visualize what GRC can do — and that underpins greater adoption and improved realization of business benefits.

The transformational approach we now have is realized through the RouteONE Engaging Risk deployment methodology, a framework designed to leverage the RouteONE tools and to help clients get value from their SAP GRC investment. The principle of “engaging risk” addresses how to inspire business users to embed risk thinking in their everyday world to drive performance rather than see it as a centrally mandated overhead.Clients often achieve a step-change in their risk and compliance management through use of EY’s RouteONE GRC content, which covers segregation of duty rule sets, controls catalogs and key risk indicators developed over many years and many clients. The RouteONE methodology consists of three main stages:

Stage 1: Implementation (How we build it)

A RouteONE implementation consists of four phases based on the principles of SAP’s ASAP methodology — preparation, blueprint, realization and go-live. During each phase, the highly advanced RouteONE QuickBuilder robotic engine and library are leveraged by our experienced consultants to support delivery of the client’s business objectives.

RouteONE QuickBuilder first automates the construction of an operational SAP GRC system using your data, even before your project has started.

Having a draft end-result right at the start makes a huge difference in how users and the project team visualize how SAP GRC will work, and this makes a big difference in the end result, operational effectiveness and enthusiastic adoption.

The RouteONE Library provides practical, system-ready GRC content that has been collated and refined over many years. It is a comprehensive store of leading practice resources extracted from many hundreds of SAP GRC implementations. The RouteONE Library helps you to accelerate key stages of an SAP GRC deployment with pre-built templates and data sets spanning roles, rules, key risk indicators (KRIs), controls, reports and more. The resources can be searched for, compiled and configured to suit specific types of businesses on the basis of industry sector, size and requirements.

The end result from the implementation can be an SAP GRC system tailored to your specific needs, built to optimize operational outcomes, in a shorter and more positive project than might have been imagined.

Stage 1: Implementation (How we build it)

Stage 2: Adoption (How you use it)

Stage 3: Support and operation (How you run it better, year-on-year)

5Helping enhance the real value of SAP GRC through RouteONE |

RouteONE Overview

Stage 2: Adoption (How you use it)

The RouteONE Engaging Risk suite of tools has been carefully developed to help you ensure that the system built in stage 1 is fully adopted and your end users actually embrace it to manage your risks better. It is a vehicle comprising a number of different elements to help accelerate user adoption and facilitate faster return on your investment.

1. Hindsight in advance: Real adoption can be significantly improved if end users are able to test-drive your prototype and are then involved in each phase of your system build. Using RouteONE QuickBuilder at the start of the project gives your project teams and stakeholders an accurate glimpse of the future before you commence your blueprint phase. It means you can test-drive a prototype system and use this ”hindsight in advance” to provide invaluable input into the system design and to make sure they are more engaged post go-live.

2. Insight Analytics: One of the most effective ways to engage key stakeholders and end users is to provide them with real-time risk insights from across your business. Using smart data visualization and interactive dashboards, you can provide an aggregated, high-level view of GRC across your extended enterprise, along with the flexibility to drill down into specific areas. With better visibility of your GRC programs and their impact, you can build more confidence while improving the experience your users have with your new SAP GRC approach.

3. Usability: The RouteONE Engaging Risk suite also includes the ability to use both SAP and our own mobile applications, social tools and custom-made Adobe forms that can make your GRC processes more accessible and engaging for end users. It takes advantage of SAP’s user experience (UX) software — Fiori and UI5 — to deliver a personalized, responsive and simplified user experience across multiple devices and deployments.

Stage 3: Support and operation (How you run it better, year-on-year)

To support continuous improvements month after month, year after year, RouteONE includes an ongoing SAP GRC operation and managed service. It provides support for GRC business and control operations, advice and guidance, and SAP GRC application maintenance. It can be seamlessly integrated with your existing SAP-support model and other service providers.

With RouteONE support, you can reap the benefit of an SAP GRC operation and managed services model, which can drive innovation and continuous improvement while supporting your end users with their day-to-day tasks. The service is provided using an onshore, nearshore and offshore delivery model to manage efficiency and effectiveness and is available on a 24/7 basis. The main benefit of using RouteONE managed services is that is allows you to focus your key resources on business priorities, with the peace of mind that experienced professionals are keeping your SAP GRC systems and processes running and providing appropriate support for control operations, monitoring and other GRC activities.

6 | Helping enhance the real value of SAP GRC through RouteONE

RouteONE Overview

RouteONE is available for the following SAP GRC Modules:

• SAP GRC Access Control

• SAP GRC Process Control

• SAP GRC Risk Management

• Security for SAP

ST

AG

E 2

How we build itTechnology implementation

Stag

e 1

QuickBuilder(config and data)

Library

How you use itEngagingrisk user-adoption suite

Hindsight in advance

Insight Analytics

Usability

How you run itSupport & innovation

GRC Support and Operate services

Innovation and improvement

RouteONE benefits realization methodology

Stag

e 2

Stag

e 3

RouteONEThe RouteONE framework

7Helping enhance the real value of SAP GRC through RouteONE |

RouteONE Overview

Creating trust in the digital world: EY’s Global Information Security Survey 2015

ey.com/GISS

Want to learn more?Insights on governance, risk and compliance is an ongoing series of thought leadership reports focused on IT and other business risks, and the many related challenges and opportunities. These timely and topical publications are designed to help you understand the issues and provide you with valuable insights about our perspective. Please view our Insights on governance, risk and compliance series at www.ey.com/GRCinsights.

Enhancing your security operations with Active Defense

ey.com/GRCinsights

Centralized operations: the future of operating models for Risk, Control and Compliance functions

ey.com/GRCinsights

Metrics matter: How Internal Audit can help organizations assess performance measurement

ey.com/GRCinsights

There’s no reward without risk: EY’s global governance, risk and compliance survey 2015

ey.com/GRCinsights

Maximizing value from your lines of defense

ey.com/LOD

Step up to the challenge: helping Internal Audit keep pace with a volatile risk landscape

ey.com/IArisks

Expecting more from risk management: drive business results through harnessing uncertainty

ey.com/REPM

Unlocking the value of your program investments: how predictive analytics can help in achieving successful outcomes

ey.com/PRM

Harnessing the power of data: how Internal Audit can embed data analytics and drive more value

ey.com/IAanalytics

Megatrends 2015: making sense of a world in motion

ey.com/megatrends

Improve your business performance: transform your governance, risk and compliance program

ey.com/transformGRC

About EYEY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.

About EY’s Advisory ServicesIn a world of unprecedented change, EY Advisory believes a better working world means helping clients solve big, complex industry issues and capitalize on opportunities to grow, optimize and protect their businesses.

From C-suite and functional leaders of Fortune 100 multinationals to disruptive innovators and emerging market small and medium-sized enterprises, EY Advisory works with clients — from strategy through execution — to help them design better outcomes and realize long-lasting results.

A global mindset, diversity and collaborative culture inspires EY consultants to ask better questions. They work with their clients, as well as an ecosystem of internal and external experts, to create innovative answers. Together, EY helps clients’ businesses work better.

The better the question. The better the answer. The better the world works.

© 2016 EYGM Limited. All Rights Reserved.

EYG no. 00462-162GBLBMC AgencyGA 0000_05058

ED None

In line with EY’s commitment to minimize its impact on the environment, this document has been printed on paper with a high recycled content.

This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice.

ey.com/sap

Follow us on Twitter: EY_SAP

EY | Assurance | Tax | Transactions | AdvisoryContactsMarcus GötzPartner, Advisory marcus.goetz@de.ey.com +49 89 14331 23471

Gavin CampbellPartner, Advisory gavin.campbell@ae.ey.com +971 4 332 4000

Werner van HaelstPartner, Advisory werner.van.haelst@nl.ey.com +31 88 407 1167

Martyn ProctorExecutive Director, Advisory mproctor1@uk.ey.com +44 20 7951 3989