Transforming access controls for Sarbanes-Oxley compliance at Millicom

As part of Millicom's Global Business Controls team, Beam Global Services led a series of access control projects across Europe, the USA and South America, transforming the processes and systems behind a successful Sarbanes-Oxley (SOX) compliance programme.

How we delivered

Project milestones

1. 01

   Access Controls & Segregation of Duties Strategy

   • Developed a multi-year strategy with the Director of Business Controls to ensure the effectiveness of critical SOX IT access controls for key HQ applications such as the Oracle and SAP ERP systems.
   • Drafted the Segregation of Duties Policy for global enterprise systems, working closely with the Internal Audit team.
2. 02

   Role Based Access Control (RBAC)

   • Developed an RBAC model for the Oracle ERP system across a 100-member Shared Service Centre in El Salvador, HQ entities (USA, UK, Luxembourg) and country entities (Bolivia, Paraguay, Honduras, El Salvador, Guatemala, Costa Rica).
   • Implemented the new RBAC model by working closely with Finance and IT leadership in each entity.
   • Led a team of multi-lingual outsourced subject-matter experts and in-house technology staff to build, test and deploy the new access controls model globally, using a mix of Agile and traditional delivery.
3. 03

   Segregation of Duties (SoD)

   • Developed a SoD Matrix for the Oracle and SAP ERP systems, defining the SoD principles that govern segregation of access and the separation of roles.
   • Agreed the SoD Matrix with the external auditors, Ernst & Young, and the PwC SOX Advisory team.
   • Cleaned all SoD conflicts in the Oracle ERP system to ensure data and access segregation.
4. 04

   SOX Compliance

   • Despite tight timelines, implemented the access controls needed to achieve successful SOX compliance, including quarterly review of Segregation of Duties conflicts, a defined process for requesting user access, an access control security policy, and quarterly re-certification of privileged access.
5. 05

   Global Stakeholder Management

   • Led engagement with C-level stakeholders across multiple geographies (Luxembourg, USA, Colombia, Bolivia, Paraguay, Guatemala, Honduras, El Salvador) to generate buy-in for radically new access management processes.
   • Influenced country Finance and IT teams to collaborate with the HQ Business Controls team to roll out new applications for key risk management processes such as user access administration.
6. 06

   Governance, Risk & Compliance (GRC)

   • Led the implementation of a new SaaS-based GRC tool, from business case, to vendor selection, to solution design, to operating model transformation, to go-live.
   • Led the definition of the Statement of Work and tracked supplier delivery against budget.
   • The GRC tool, SafePaaS, transformed access controls delivery for back-office processes in eight countries.
7. 07

   Business Transformation

   • Led a business transformation programme to centralise the ERP access request process by changing the operating model of the local IT function in seven different countries.
   • Overcame significant resistance from mid-level IT managers in local and regional teams with a well-defined approach to business change management.