The automated control system for risks and compliances to requirements of the law Sarbanes-Oxley in CTC Media

The Software AG & IDS Scheer company helped to implement the new automated control system for risks and compliance to requirements of the law Sarbanes-Oxley with CTC Media company. A system is constructed based on the product ARIS Risk & Compliance Manager.

Stocks of CTC Media Ink. company are quoted in the stock market of the USA. Therefore its activity should conform to requirements of the law Sarbanes-Oxley (SOX) which provisions define requirements to document flow and financial statements of the company. Point 404 of this law requires to include "internal" reports in the annual reporting of the company from where need of establishment and maintenance of work of structures of internal control and procedures of financial statements and also need of regular efficiency evaluation of these structures and procedures follows from company management.

The division of internal control and risk management is responsible for similar activities for testing of efficiency of control procedures and risks assessment in CTC Media. It acted as the project orderer on implementation of a specialized information system. The division already had not only the complete list of control procedures and tests to them, but also completely developed procedures of internal control, in particular, the adjusted practice of testing of control procedures on observance of requirements of the law SOX. However the software product which was earlier used for automation of process of testing of internal control ceased to satisfy to the growing requirements of the company.

For transition to the new automated control system for risks and verification of procedures of internal control of CTC Media selected the product ARIS Risk & Compliance Manager (ARIS RCM) of IDS Scheer company, including thanks to the fact that this media company was already familiar with the ARIS platform – simulars of processes of the ARIS family are actively used here. The product ARIS RCM represents a management system for the flows of works (workflow) connected with risks assessment and testing of efficiency of the control procedures intended for decrease in probability of their emergence or damage from their emergence. Using a system the staff of the company who is responsible for internal control can quickly and easily create, check, release and publish on internal the intranet portal the consolidated documentation on all carried-out tests prepared for audit. A system also contains the means of the analysis of the relevant data allowing to reveal "narrow" places in an internal control system.

The project was executed from September to December, 2010 and included, in particular, modeling of pilot process (it was selected by the client) and the related risks. Consultants of IDS Scheer developed models of reference books of general purpose (organizational structure, information systems), described pilot process up to detailed models of the third level, developed hierarchy of risks and a tree of risks, created models of an environment of control procedures for the selected process, simulated reference books for the description of risks.

Then all models created in ARIS Business Architect were exported to the unrolled ARIS RCM system. After trial operation by users and introduction of corrections a system was brought into commercial operation. Now with its help automated management of testing of the control procedures, risks assessment, appointment and task performance connected with risks assessment and testing of control procedures.