Compliance Monitoring & Controls Hub

The client’s SAP and D365 systems already produced rich security and transaction logs — but day-to-day compliance work still lived in Excel, email and SharePoint folders.

• SOX & internal control matrices maintained as static spreadsheets per region.
• Access reviews triggered by email, with responses scattered across attachments.
• Sensitive journals and configuration changes checked manually before audits.
• Issues discovered late by Internal Audit instead of through continuous monitoring.

In steering committee language, the CFO summarized it as: “We are paying for enterprise systems but running compliance like a side-car.”

Design and stand up a Compliance Monitoring & Controls Hub that would:

• Bring SAP/D365 logs, access changes and control tests into one place.
• Shift from point-in-time testing to continuous, exception-based monitoring.
• Give Finance, IT and Internal Audit a shared, trusted view of control health.
• Produce audit-ready evidence with full lineage from event → control → remediation.
• Be governed, not fragile — using Power Platform with clear environment strategy.

Before Sapnity, the compliance story was not a single system — it was a patchwork of tools and habits. Each team had its own “truth” for controls:

• Finance tracked key controls in regional Excel files.
• IT relied on security logs and ad-hoc SQL extracts.
• Internal Audit maintained its own issue tracker and evidence folders.
• No one could see end-to-end: event → control test → remediation → re-test.

Sapnity replaced the patchwork with a single Compliance Monitoring Hub. Instead of each team maintaining its own spreadsheet, everyone now works off the same architecture pattern:

With this pattern, new controls are now modeled as configuration — not as new spreadsheets — and re-used across geographies and business units.

Phase 1 — Risk & Controls Blueprint

• Catalogued existing SOX and internal controls across 4 regions and 3 ERPs.
• Grouped controls into patterns: access reviews, journals, configuration and reconciliations.
• Defined which signals would come from SAP, D365, Azure AD, ticketing and manual attestations.

Phase 2 — Controls & Exceptions Model

• Designed Dataverse tables for controls, tests, exceptions, remediation actions and evidence.
• Introduced a global taxonomy: process area, assertion, risk rating, entity and owner.
• Configured row-level security to keep legal entities and regions segregated as needed.

Phase 3 — Monitoring Rules & Flows

• Built Power Automate flows that translate events into exceptions (e.g. conflicting roles, late journals).
• Established risk-based SLAs and escalations to control owners and Internal Audit.
• Ensured every exception must link to remediation and re-test before closure.

Phase 4 — Integration with SAP / D365 / Azure AD

• Connected SAP and D365 to feed journals, configuration changes and high-risk transactions.
• Ingested Azure AD JML events to track timely deprovisioning and role changes.
• Aligned ticketing system (e.g. ServiceNow/JSM) incident types to exceptions for full traceability.

Phase 5 — Rollout, Governance and Scaling

• Rolled out initially to two SOX entities, then scaled to additional countries.
• Set up Dev / Test / Prod with managed solutions and automated deployments.
• Trained a small “controls product owner” group to maintain rules without code changes.

• Pattern-first compliance design: We delivered a reusable monitoring pattern, not just a one-off dashboard.
• Deep SAP/D365 + identity integration: Controls are wired directly into where risk is created — systems and roles.
• Audit-grade Dataverse model: Built for traceability, evidence and clear ownership across entities.
• Exception-first mindset: Focus moves from blanket testing to targeted remediation of what actually went wrong.
• Governed low-code foundation: Clear environment strategy, ALM and DLP so compliance can scale safely with Power Platform.

For this client, Sapnity turned compliance from a quarter-end scramble into a continuous, shared service that Finance, IT and Internal Audit all trust.