Compliance Within Lawson M3

1. Compliance Within Lawson M3 John Chandler Product Management - Financials john.chandler@uk.lawson.com

2. The Lawson Product Offering

3. The Lawson Industry Offer

4. With Focus on Specific Markets….. ..wherever our customers choose to operate…..

5. Sales & order Procurement Production planning Receipt handling Production Warehouse/ Distribution Accounts payable General ledger Accounts receivable Managing the financial flow Monitor the Performance of other flows Global Integrated Financials for IFO’s - Introduction The order flow S u p p l i e r s C u s t o m e r s The logistic flow The financial flow

6. M3 Financials - supporting our Customers Managing the financial supply chain Allowing users to work in ways that they wish Providing information – to internal/external customers Using technology for efficient financial processes

7. Disclaimer regarding future product discussion This presentation includes information about future development plans of the Lawson Product Development organization. By providing this update, Lawson is not promising to develop, deliver or market any specific product, functionality or service. Lawson makes no representations or warranties about the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Lawson reserves the right to change its future products or services offerings at any time without obligation to notify anyone of these changes. Customers under maintenance are not specifically entitled to anything on the roadmap or what is included in this presentation. Disclaimer regarding use of screen shots in this presentation This presentation has been prepared to demonstrate a variety of ways that Lawson software applications and tools can be set up and utilized by customers. The screen shots provided may not be standard, out-of-the-box reports, but may require your organization to engage Lawson Professional Services in order for the applications or tools to work as shown.

8. Introduction – Company….. Business Processes…. Accounting Transactions…… Financial Reporting….… Summary Audit Trail….. M3 Financials and Compliance

9. Compliance - sometimes we get mail on this topic

10. Compliance - sometimes we get mail on this topic

11. Implementing Compliance in Movex

12. Understanding the Law The Sarbanes-Oxley Act established new and enhanced standards for corporate accountability, as well as severe penalties for corporate wrongdoing. Good corporate governance and ethical business practices are now the law. Primary Areas of Regulation under Sarbanes-Oxley

13. SEC.404 - Corporate responsibility for the financial reporting process

14. Sarbanes-Oxley – Relevant Sections Section 404 • Requires management to annually: • State their responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting • Conduct an assessment of the effectiveness of the company’s internal controls and procedures for financial reporting • Requires the independent auditor to: • Attest to management’s assertion (requires a framework such as COSO) Section 409 • Real Time Disclosures: • Issuers are required to disclose to the public, on an urgent basis, information on material changes in their financial condition or operations. These disclosures are to be presented in terms that are easy to understand supported by trend and qualitative information of graphic presentations as appropriate.

15. Section 302 Certifications…….. • Certifications must include: • CEO and CFO have reviewed the periodic filing and to their knowledge, information provided presents fairly the financial results of the company. • CEO and CFO have established and maintain disclosure controls and procedures that ensure that all material information is made known to them. • CEO and CFO have evaluated the effectiveness of the disclosure controls and procedures as of 90 days prior to the date of the periodic report and presented their conclusions in the report. • CEO and CFO have disclosed all internal control deficiencies and any fraud, whether or not significant, that involves management or other employees who have a significant role in the companies internal controls. • Statement of whether the company has established a Code of Ethics for senior financial officers. • Other miscellaneous items.

16. Monitoring • Assessment of a control system’s performance over time. • Combination of ongoing and separate evaluation. • Management and supervisory activities. • Internal audit activities. Control Activities • Policies/procedures that ensure management directives are carried out. • Range of activities including approvals, authorizations, verifications, recommendations, performance reviews, asset security and segregation of duties. Information and Communication • Pertinent information identified, captured and communicated in a timely manner. • Access to internal and externally generated information. • Flow of information that allows for successful control actions from instructions on responsibilities to summary of findings for management action. Control Environment • Sets tone of organization-influencing control consciousness of its people. • Factors include integrity, ethical values, competence, authority, responsibility. • Foundation for all other components of control. Risk Assessment • Risk assessment is the identification and analysis of relevant risks to achieving the entity’s objectives - forming the basis for determining control activities. COSO – Internal Control Framework

17. COSO – A Framework for Internal Control Financial Reporting…….

18. Primary Areas of Focus • …….after analysing Risk and determining the Control Environment • Control Activities • Completion of the documenting of internal controls • Testing and implementing internal controls • Sustaining internal control implementations • Implementation of system based controls • Information and Communication • Financial Reporting from one database • Timely distribution of information • Monitoring • Timely review of reports • Internal audit function • Proactive notification of material events

19. An accountability structure for Sec. 404 compliance

20. Internal Controls at every level in the business

21. First level. Log-on network -User id -Password/fingerprints System Access is controlled

22. Enterprise Level Controls…………… • The term “entity-level controls” as used in this document describes aspects of a system of internal control that have a pervasive effect on the entity’s system of internal control such as: • controls related to the control environment • for example, management’s philosophy and operating style, integrity and ethical values; board or audit committee oversight; and assignment of authority and responsibility • controls over management override • the company's risk assessment process • centralized processing and controls, including shared service environments; • controls to monitor results of operations • controls to monitor other controls, including • activities of the internal audit function • the audit committee, and • self-assessment programs; • controls over the period-end financial reporting process; and policies that address significant business control and risk management practices. The terms “company-level” and “entity-wide” are also commonly used to describe these controls.

23. System Foundation Suite • Ensures and manages the essential applications and functions necessary to run, operate and secure the M3 Enterprise Management System. • Combines an industry standard, open run-time environment with tools for managing deployment, security and performance for all M3 Applications. • Modules Include:- Application Foundation, Workplace Foundation, Web Application Foundation “Java-based solutions like M3 score very high with respect to openness transparency and platform independence.” Jürgen Schmitt - PEPPERL+FUCHS

24. System Foundation Suite • Application Foundation • Contains central supporting application functions, security and features that operate and ensure the management of the M3 Product Line. • The framework the underlying foundation for M3 applications and modules. • Workplace Foundation • Provides the underlying foundation to enable Workplace portal with configuration, layout and access functionality • Web Application Foundation • Platform for M3 modules for web user interface, integration, tools and e-Commerce. • Provides a rich web application deployment environment, and ensures mission critical support and allows companies to enable new innovations.

25. The M3 Application Foundation Modules • M3 Foundation • Security Management • Field Audit Trail • Job Scheduler • Output Management • Environment Manager Solutions • M3 Foundation contains central supporting application functions, security and features that operate and ensure the M3 Enterprise Management System. • It is a well crafted framework that is the underlying foundation for M3 applications and component groups. Signature Features • Highly scalable • Reliable processes management • Secure and traceable

26. Introduction – Company….. Business Processes…. Accounting Transactions…… Financial Reporting….… Summary Audit Trail….. M3 Financials and Compliance

27. Internal Controls at every level in the business

28. Second level. Log-on to M3 -User id -Password First level. Log-on network -User id -Password/fingerprints Access

29. Effective Internal Controls – for any business • It is the responsibility of management to safeguard the assets and liabilities of the business – so its normal part of business life • It is also the management's job to maintain a system of internal controls over the financial reporting process to ensure that the financial statements will be reliable. • The objective of internal control over financial reporting (“ICFR”) is to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles (“GAAP”). • The purpose of the evaluation of ICFR is to provide management with a reasonable basis for its annual assessment as to whether any material weaknesses in ICFR exist as of the end of the fiscal year.

30. Effective Internal Controls – Two Basic Questions • 1) Do my employees understand what they need to do to properly prepare external financial reports? • 2) What information do I need to make sure they have done those things? • The SEC's new management guidance suggests considering these two fundamental questions in three steps. • Step 1 - Identify Financial Reporting Risks and the Controls that address them. • Step 2 – Do your Controls work in practice? • Step 3 – Reporting your conclusions on overall effectiveness and deficiencies.

31. Business Functions Processes Sub Processes Process Controls and Business Transactions Systems and Tools for checking and validation Development of People within the Processes

32. Third level. Access to function in M3 Second level. Log-on to M3 -User id -Password First level. Log-on network -User id -Password/fingerprints Access

33. Business Functions Processes Sub-Process Controls and Business Transactions Sub-systems and Tools for checking and validation Development of People within the Process and sub processes

34. Example: Accounts Payable Process ControlRiskControlObjectiveActivity Completeness Material Accrual of transaction open liabilities not recorded Invoices accrued after closing Issue: Invoices go to field and AP is not aware of liability.

35. Evaluation and Assessment of the ICFR….. • Identifying Financial Reporting Risks and Controls • a. Identifying Financial Reporting Risks • b. Identifying Controls that Adequately Address Financial Reporting Risks • c. Consideration of Entity-Level Controls • d. Role of Information Technology General Controls • e. Evidential Matter to Support the Assessment • Evaluating Evidence of the Operating Effectiveness of ICFR • a. Determining the Evidence Needed to Support the Assessment • b. Implementing Procedures to Evaluate Evidence of the Operation of ICFR • c. Evidential Matter to Support the Assessment • Multiple Location Considerations • Same country or different countries

36. Here is my Balance Sheet … where is the Risk ?

37. Financial Reporting Risks and their related Controls. • Key is knowledge of your business • As applied to the generally accepted accounting principles that apply to your financial reporting • Risk factors inherent in your business, both internal and external • Risks in the way you authorize, process and record transactions that are reflected in the financial statements. • Your company's vulnerability to fraud • How do your entity-level controls relate to financial reporting elements? • With what level of precision do they operate? • Is there more than one control that addresses the same financial reporting risk? • If so, which one provides the most efficient way for you to evaluate how well it works? • Is the control automated? • If so, how sturdy are the relevant IT controls? • Or is the control manual – • If so, what is the risk of human error? • NOT every control within a particular process needs to be identified • only those that adequately address financial reporting risks

38. Minimizing Risk in Financial Reporting • Incorrect numbers or values • Profits under or over stated by a material amount • Liabilities under stated by a material amount • Assets over stated by a material amount • Incorrect presentation of accounts • Impairment adjustments not charged to reserves • Incorrect reporting framework – IFRS v US GAAP • Numbers or values are misinterpreted • Errors in assumptions made in preparing numbers/values • Analysis of data used incorrect/flawed

39. How much evidence is needed ?

40. Reporting if the Internal Controls are working … • 1. Evaluation of Control Deficiencies • 2. Expression of Assessment of Effectiveness of ICFR by Management • 3. Disclosures about Material Weaknesses • 4. Impact of a Restatement of Previously Issued Financial Statements on Management’s Report on ICFR • 5. Inability to Assess Certain Aspects of ICFR

41. Introduction – Company….. Business Processes…. Accounting Transactions…… Financial Reporting….… Summary Audit Trail….. M3 Financials and Compliance

42. Internal Controls at every level in the business

43. Sales & order Procurement Production planning Receipt handling Production Warehouse/ Distribution Accounts payable General ledger Accounts receivable Manage the financial flow Monitor the performance of other flows Integrated Business Processes The order flow S u p p l i e r s C u s t o m e r s The logistic flow The financial flow

44. Third level. Access to function in M3 • Fourth level. • Access to values • Customer • Supplier • Division • Cost center • etc Second level. Log-on to M3 -User id -Password First level. Log-on network -User id -Password/fingerprints Access

45. Integrated Financial Solution…as presented in Sales Procurement Logistics Service Orders Maintenance Orders Rental Contracts Sales Orders Project Orders Human Resources Fixed Assets Time Recording Accounts Payable General Ledger Accounts Receivable

46. Purchase Orders Item Master Customer Orders Bank Accounts Customer Master File Chart of Accounts Supplier Master Fixed Asset Master Service Agreements MPHEAD FCHACC CIDMAS SSAGRH FFASMA OCUSMA CBANMA OOHEAD MITMAS Integrated Financial Solution…the database schema Procurement Logistics Service Orders Maintenance Orders Rental Contracts Project Orders Sales Orders Fixed Assets

47. Update General Ledger Daily Processes 1) Program GLS040 1) Inventory Records Function MMS901 2) Check GLS036 2) Create Accounting Function CAS950-956 3) Inventory Valuation CAS180 3) Update GL Function CAS960 Accounting Transactions Accounting For Logistics FCR040 CINACC Accounting and Reporting for - Inventory

48. M3 Financial Core File Structure with Update Process

49. Stock Transaction. Display History (MWS070) Internal Account Entry.Display (CAS303) MMOPTR MWOPTR CRACTR MITTRA CPO…/ CPOCAW CINACC Internal Account Entry. Open (CAS300) FGLEDG General Ledger. Display Transactions (GLS210) Audit Trail from the GL to the Logistics files WO Operation. Display Transactions (MOS095) MO Operation. Display Transactions (PMS095) Order Costing. Display/ WO Costing. Display (CAS310/ CAS305) Internal Account Entry. Create (CAS950) Internal Account Entry. Transfer To FIN (CAS960)

50. Daily Processes Update General Ledger 1) Invoice Customers Function OIS180 1) Program GLS040 2) Update Financials Function OIS196 2) Check GLS036 3) Create Sales Statistics 3) Audit Trail OIS680 Accounting Transactions Accounting Transactions OINACC FCR040 Accounting and Reporting Flows – Sales Revenues