Name: Confident Compliance: Proactive Workday Security and Risk Management with PwC’s Marketplace Apps
Uploaded: 2025-11-06T19:16:20.865Z
Duration: 56 min 32 s
Description: Confident Compliance: Proactive Workday Security and Risk Management with PwC’s Marketplace Apps

Transcript for "Confident Compliance: Proactive Workday Security and Risk Management with PwC’s Marketplace Apps": Hi, everyone. Thank you so much for joining. We're just gonna give everyone a couple minutes to join, and we'll be right with you. Thanks so much. Hello. Thanks, everyone, for joining today. Today's webinar is part of our Looking Forward with Workday series designed to give you insight into how your organization can do more with Workday, including additional ways we support how you manage your people and your business. We may have a few forward looking statements. Please note this is under our safe harbor agreement. A couple standard housekeeping items before we kick off. First, we are recording this session and then we'll be making it available to you via email within forty eight hours. Please be on the lookout for that. Workday uses the Goldcast platform for our looking forward with Workday webinars, which allows you to submit questions and get access to resources and provide feedback. Goldcast really operates best, when using a Chrome browser. So if you're experiencing any issues at this time, please, ensure that you are using Chrome. If you have any technical issues during the event, please notify us using the q and a function. You can get even more out of this webinar by using the tabs in the top right corner of your screen. Q and a is where you can submit your questions via the q and a function, and we will respond to most of as many of the questions as we can live at the end of the webinar. Thank you so much again for joining us today. We will be discussing the Workday marketplace and apps available at a high level and then dig in with PwC security and risk experts. I am Kristin Nicola from the Workday product marketing team focused on our partner built marketplace apps. To kick us off today, the Workday marketplace is your open gateway to innovation. It's a publicly accessible destination where anyone can explore trusted solutions from across the Workday ecosystem. So we've got apps, templates, integration, services, and AI agents all in the marketplace. It's really the digital hub of the Workday ecosystem. It's designed for you, so you can quickly find, unlock, and hopefully soon try apps and agents and templates and integrations, and grab get value from Workday quickly and easily. We've got more than 600 solutions from over a 130 certified partners on the marketplace. So you can explore platform extensibility, find solutions that align to your industry or your business needs. And, again, this is where you'll be able to discover Workday validated AI agents as well. For today, though, I'd like to direct us toward the apps that are on the Workday marketplace. So all our apps are built by our trusted partners to quickly meet your needs. Marketplace apps are built and operate directly in Workday for a native and seamless experience. Marketplace apps allow you to quickly solve your problems that may pop up. And, again, they're built they're all built by our partners like PwC who are approved to innovate on the Workday platform. Shortly, you'll see a demo how showing how the apps that are built on Workday's adaptable, trusted, and secure platform will be able to add value to your investment really quickly. Also important to note, these apps don't require any additional Workday product licensing. Our partners work really closely with our customers and the Workday product team to build apps that solve for very common use cases. Some examples of where PwC focuses in particular are around increasing your HR efficiency so you can focus on your people while scaling and saving time. They also work to help organizations maximize ROI with their deep knowledge and understanding around what drives profitability. Today, we're focusing on their simplified security and regulatory compliance apps, which build which are built to address specific regional and industry needs while streamlining security and reducing complexity. Today, we're joined by the CW PwC team, to share their risk and security and risk management apps. We have Nick Stone, partner and coleader of PwC US Workday Security and Control Practice. We've got Rolandy Treska, National Enterprise Technology Risk Solutions leader of PwC Canada's Workday Security and Control Practice, and Bilal Raffai, Workday Risk and Controls lead of PwC Canada's Workday Security and Control Practice. Thank you all so much for being here with us today. Nick, take it away. Alright. Thanks, Kristin. Guys, it's it's great to be able to talk to the Workday community about our progress in the marketplace, so thank you. We're really excited for the chance to talk to you all. Now when I talk to my clients about Workday and and specifically about security and control, which is where my team spend most of their time, I I find myself explaining really what a cool time this is to be in the Workday ecosystem. Waves of new technologies are really helping us solve business challenges in more creative and efficient and even disruptive ways. The Workday ecosystem, it's increasingly open, encouraging creative thinkers to tackle perennial business challenges. And as a result, persistently manual resource intensive processes are giving way to some of these purpose built solutions. And as Kristen said, it's it's really only been a year or so since built on Workday in the marketplace were announced. Today, again, there's there's hundreds of apps out there. PwC has been here from the start and today is a leading Workday partner with about 27 and counting apps in the marketplace. PwC's partnership with Workday drives businesses forward really by reimagining processes and enhancing the employee experience. We combine deep industry expertise and customer led innovation to deliver native Workday solutions that help take our clients to the leading edge. So on today's webinar we're going to show you a few examples of our built on Workday apps. We'll focus on security and ways to protect your work investment and your workforce data using apps that are built to help customers secure and control their Workday journey. Alright, so security. Effective security. It's an expectation. It's table stakes for every Workday implementation. It safeguards the integrity of your Workday tenants. It protects your global workforce data. It enables the routine transactions that run your business. But staying on top of Workday security isn't always easy. When we talk to our customers we hear common security and control challenges across industries and these aren't isolated issues. They're recurring themes that reflect the complexity of managing security risks in a global dynamic and increasingly regulated business environment. The Workday security model is robust but it can also be complex. Effective security really requires thoughtful design and controlled maintenance. And without effective controls organizations can quickly find themselves exposed. So I mean one of the most common challenges we hear about, they relate to security fundamentals like visibility to privileged access and effectively controlling segregation of duties risk. So without need of tools to prevent privileged access and segregation of duty risk, before the access is provisioned. Organizations had to get creative usually with time consuming manual processes, spreadsheets to detect and then correct those issues. For regulated companies and those subject to audits and I'm guessing that's many of you if not most of you, that challenge is emphasized and multiplied. So in response we built a Workday native application that allows clients to proactively test for segregation of duty and sensitive access risks directly in their tenant. This means no data leaves your environment, risk management is done in real time and results are fully auditable. So just to wrap up, in today's session we're gonna walk you through a live demo so you can see firsthand how the app simplifies security, streamlines compliance, and improves audit outcomes. My friend Bilal from our Canadian firm who played a really big part in bringing this app to life is going to pick things up from here. Perfect. Thank you, Nick, and hello, everyone. I'm delighted to be here with all of you today to talk about and showcase, two of PwC security related built on Workday applications, that are available for you today on the Workday marketplace. As you can see here on the screen, the first application is security suite, which streamlines role based and user based security assignments directly in Workday, with built in automated workflows and audit trails. And then the second application, which we will be discussing, today, as well as run a live demo on during this presentation, is the segregation of duties and sensitive access application, which really enables Workday customers to conduct end to end segregation of duties and sensitive access assessments, also directly within your Workday environment and your Workday tenant. And both of these solutions help organizations proactively manage risk and compliance, and together today in this, presentation and in the demos, we're gonna discover how that is done, during the session. So let's now take a look at POC security suite. This is, essentially the screen that you have here, showing up right now, and this is our comprehensive solution for managing role based and user based security assignments, as I mentioned, directly in Workday. The premise behind this application is that one of the biggest challenges we often hear from clients is the lack of visibility and control over how security is assigned and maintained across their tenants. So in in to address this concern, security suite was developed, and this allows users to request access for themselves or their teams using configurable templates that are built into the application that simplify the end to end process. And these requests are effective dated. They're routed through built in Workday, approval workflows and are automatically applied. And this ensures organizational controls are enforced without manual intervention. Now what makes this solution powerful is that it's fully auditable. So every request approval that you receive, the the the audit trail tracks that approval and assignment that is made is tracked within the application. And then this would effectively support your compliance and makes audit preparation significantly easier. And because this is built directly into Workday, as we mentioned, there's no need for any external tools or interfaces. Everything happens directly inside your tenants in real time. So this effectively prevents having teams manually requesting access and assigning security, and it keeps provisioning of access more controlled and streamlined. At PwC, we've designed this suite to be intuitive for end users, scalable for large organizations, robust enough to meet complexity or complex security requirements. So all of these were kept in mind as we were designing this, and it was really something that was developed as a result of constant demand, not only from the regulators who are expecting more robust, audit trails around activities, around user assignments and provisioning, but also client requirements around managing, these requests and ensuring that that is being tracked appropriate appropriately in the system. So whether you're onboarding new employees, adjusting access for role changes, or conducting periodic reviews, this, application streamlines this entire process, while also reducing risk and increasing transparency. And this is just one example of how we're helping, clients, move from being, or from move from being, reactive into more proactive when it comes to security management in Workday. So that was the first application. As you can see now here on the, on the slide, the application provides you with the dashboard view, allowing you to determine, metrics such as the total number of requests by requester, whether these were self requested or came through delegation. There are tasks for users on the left hand side, as you can see here on the app, that allow them to request access either for themselves or for their teams. They can also further customize the access request templates and perform additional mass review of access requests that may have come through. On the other side that you see here, this is where, a staff member within your organization, may use the application to request access or request security for their team. So as you can see here, there's a effective date, at the top that can be chosen, And then, along with the team member, the template that can be used, which as we said is configurable, that can be customized to meet your needs, and, what access and security groups are requested. So all of this within the app that allows for easy tracking, auditing, as well as ensuring that these are approved through the built in workflow, as we mentioned. Alright. So, let's turn over to our second POC, solution for this presentation, the segregation of duties and sensitive access application. I'm super excited to be presenting this one, given that I was leading the production of this POC, and there was a lot of thought and and and previous expertise that we had from our, previous engagements that went into creating this application. So it's another powerful solution that we have in our suite of, solutions on the workday marketplace. And really as tenant owners ourselves, as well as auditors, we do know firsthand how difficult it is to manage segregation of duties and sensitive access risks, in Workday without native tools. Currently, as it stands, a lot of organizations really rely on external spreadsheets for, for conducting the assessment. Some of them rely on different accelerators too, which are, in most cases, disconnected. They don't speak directly with Workday, which allows for slow, manual, and often incomplete or incomprehensible, assessment to be performed over segregation of duties. We know here at PwC how complex this can be and the level of detail that is required to conduct, as I said, a comprehensive assessment because there are multiple levels in which security is assigned and can be granted to users. And it's important to understand that, properly in order to effectively perform an assessment. And all of this was built into design or into designing this application, which you'll see, shortly, in the live, demonstration. And really, that's why we built this application. It's really to bring SOD testing and monitoring inside the Workday tenant itself where it belongs. Again, at PwC, we had, a legacy solution where we helped our clients conduct SOD and sensitive access, but that was, living outside workday. And at the time, we had to request some data and reports from the system, put it into that accelerator or tool, and then provide the outcome. Versus now, that's no longer the case. And everything is in the workday tenant directly. Your data does not have to leave. And as you'll see again shortly in the demo, it's it's it's all within the system allowing you to click on hyperlinks, take you directly to pages and configuration, pages where you can come in and look at the, various policies that have been configured in the system. And and as you, of course, know, organizations cannot go without testing and and monitoring for access assignments and segregation of duties, which is not really or or which is not only required by the regulator, but also a way to assess your own application security and ensure that it is set up in a way that reduces risk, reduces fraud, inaccuracies, or inappropriate access within your enterprise. So this app that you see here on the screen, our SOD and sensitive access app, clients can or have various options, and it comes with various features. So clients can run preventative simulations to identify access conflicts before they happen, which is really a neat feature, that allows them to proactively manage risk. Right? As we mentioned, being more proactive as opposed to reactive, in addition to a built in functionality allowing for detective assessments to monitor existing risks, all of this in real time. So, effectively, you're scanning your system, and it's telling you if someone, by design, have any conflict conflicting access or some, rights that they shouldn't have access to, in the system. Now this preventive simulation, as I mentioned, is essentially a lot of analysis that tells you preemptively if a certain proposed combination of access rights that you are considering assigning to a user will result in a breach of security requirements, versus, as I said, conducting more of a detective assessment or a point in time assessment, in your system. The app also comes with built in, default leading practice rule sets of various segregation of duties and sensitive access rules to be tested. But in addition to this, it does allow for for full customization by our clients. So clients can tailor their assessments to their specific needs. So essentially, if we take an example, you you'd be able to select a specific rule book in this application to run an assessment, and determine if there are any conflicts. This rule book that is, or can be configured in the system may be for HCM, finance, payroll, or or across all areas, all these three areas, and could have rules such as, you know, like, as rules such as, you know, the the user or the security group that has access to, let's say, managing supplier master data or or or their bank accounts, that user or security group cannot, for example, at the same time, settle supplier payments as an example. Right? Like, these would be two rules that are built into the system, and then you would test your, work day tenant or environment to determine if if a user or a security group is able to do these two, conflicting abilities and so on. You can also use it to manage sensitive access reviews, such as conducting reviews around who can view compensation information, who can run integrations, who can approve invoices, and so on and so forth. So, all of this is, done in a very user friendly and automated fashion, and hopefully, you know, in an intuitive way that allows teams to to, perform these exercises on a more regular, basis and a more streamlined, manner. Maybe the last thing I'll mention here before jumping into the demo is, this application also includes built in enhanced dashboards, audit ready reporting, any change that someone makes in the app, whether doing a review, of a possible conflict, making changes, adding comments, all of that is recorded. You've got audit reports and audit tracking that allows for for reporting. And it has a built in case management functionality, to track and resolve all of these conflicts efficiently and, again, in a in a user friendly manner. And, you know, as we mentioned, because this is work in native, all of this done in the system, there's no need for any additional lead extraction, no external interfaces. It's just seamless and secure compliance. Now I'm sure you're probably curious to see what we've been discussing so far in action. So let me walk you through a live demo, and you can see how this looks and feels, and how this can simplify your compliance efforts even further, while, at the same time strengthening your controlled environment. Now I I will mention, due to time constraints, I will focus on some of the key features and functionality only. However, if anyone is interested in exploring this in a bit more detail, if they're interested in, you know, a longer demo, you know, we're more than happy to schedule a one on one demo and walk you through this in in, in more detail. So with that said, I will take the screen and and and share or I will share my screen, and I'll I'll open up my Workday tenant and walk you through, a live demo of this application. Alright. I think it's loading now. Perfect. Alright. So, this is the dashboard view of the application. Maybe what I'll do is I'll take you to the home page just to, show you how you can navigate, from your workday tenant to the application. I'll walk you through the various functionality and key things that I wanna highlight in this presentation, and then we can, go back to the to the rest of the agenda items in in today's presentation. So, as we said, because this is built in Workday directly, this would be your Workday tenant. And in order for you to access this built on Workday application, all what you need to do is really just search for segregation of duties and sensitive access. This will take you to the application itself. There's this landing page that provides you with some information around how it's used, the different features, and and areas, that you can take advantage of. And here on the left hand side, you can see a series of different tasks and and things that you can perform, in the application that allows you to do. So there's this about section. There's a glossary of key terms, this which is provided. There's this section around running assessment that we're gonna be discussing which what each one of this, represents. There's three different types of assessments that you can perform. The first one, as you can see here, is running an SOD or sensitive segregation of duties and sensitive access assessment. Essentially, a tenant wide, scan of your of your tenant, and it provides you with an output, that you can come in and assess. This is essentially the dashboard that I showed you here, which we'll get into, in a second. However, if if you're interested in doing an assessment over the security setup of a specific user or a specific, security group, you can do a validation exercise. So rather than scanning an entire tenant, you may come in and you may select a specific user or a security group, let's say, maybe an accounting manager. You can click on run, and it'll tell you the accounting manager has any, any access rights that are inappropriate or that are not in line with your organizational policies around SOD and and and and access. And then the last one is the simulation, which I'll probably end my demo with. This is where, as we said, rather than running a detective assessment scan of your tenant to see who has inappropriate access, simulation allows you to conduct a what if analysis as we said. So you you would put in the security group that you're interested in assigning new access rights. You would determine or identify what these new access rights are, and you would click on run, and it would tell you immediately whether this will result in any violation. So that's kind of the use case for simulation. As you can see, there's three different, you know, types of assessments that you can done. If I were to summarize it, first one is really a detective tenant wide assessment. Second one is rather than doing a tenant wide assessment for all your security groups and all your users, you can do a more, targeted one. And then the last one is more preventative in nature. So these are the assessments. This, this section over here or this tab shows you the various results, which I'm gonna cover in a few seconds. You're able to also search across the app for any historical issues or conflicts. So there's there's the search functionality. And lastly, there's admin portal. So this is where you can customize everything you need in the app pertaining to the rules, pertaining to the different areas that you wanna assess in the system. With this application, it always comes with, like, a default built in rule sets, which was, as I mentioned, curated by PwC over the years, combining our, you know, workday security expertise and our audit hat on. We built in a rule set that we believe is is best practice around proper or or appropriate segregation of duties to build in into the workday environment. But you may wanna customize some of this to your own needs. Right? You may have some different use cases that you wanna highlight. You may wanna, build a rule book, maybe, perhaps, specific around data privacy. Perhaps you may wanna build a rule book that you wanna share with your auditor versus for your internal reporting. So there's a lot of different use cases as to why you may wanna customize, and I I will show you as well how that's done and how that looks like. But maybe the first thing I'll start is with the assessment results. As you can see here, each one of these cards represents a historical assessment. So, essentially, when someone runs in this tenant wide assessment that we covered, earlier, it's gonna generate a new card for you. The reason why you have multiple cards is two things. Number one, a card is created for each rule book that you select. So in this case, you can see there's this default rule book that was, again, delivered by PwC for sensitive access only. We have another rule book for segregation of duties only. You have a rule book for consolidated view. You can also scroll to the bottom, and you can see some of the custom rule books that you may have. So as we said, you can create your own rule books and determine what the assessment is gonna look like. And the the nice thing about this application is that security is flexible. So you can decide who has access to this full application as well as who has access to each one of these specific cards. So as I said, if you want your auditor to look at one of these only, you're able to do that. Let's say, for example, you may want your HR team to review HR rule books versus your finance team to review your finance rule books, you can also do that. So there's a lot of flexibility in that sense. But coming back to this, the other reason why you have multiple ones is because each one of these, represents a historical assessment at a point in time. So here, for example, you can see that this was the latest assessment under this rule book, which is conducted in September 2025 on specifically September 13. Over here, that's an example where you conducted two different assessments in the past for this consolidated rule book. So the first one was conducted in q three twenty twenty five. Second one was conducted in q four twenty twenty five. We see that clients typically conduct this on various frequencies. Some clients like to do it on a quarterly basis. Some clients like to do it on, you know, biannual basis or once a year. So it really depends. But the idea is that every time, as we said, you run it, you're gonna get a card. Now to get into one of these, you click on the assessment results, and it's gonna take you to that dashboard view, that I mentioned earlier. So over here, there's a number of things that you can see. You've got the event name. So whether this is your September run or your January run, you've got the rule book. You there's a number of features here, which we don't need to get into too much detail here, but you're able to exclude some security groups from your assessment and so on and so forth. The key thing on this dashboard is it summarizes the different rules that were tested. So each rule book could have a different number of rules. In this case, this specific rule book that we were looking at for SOD only has 15 rules. Right? And maybe to show you an example of what a rule is, this table summarizes all these 15 rules. So as you can see, the 15 items. So, for example, one of the rules here is, the person who is opening and closing periods in your in your tenant should not be able to initiate process or approve journal entries. Right? That can be a rule that you define and you say, you know what? We wanna enforce this policy and no one should have access to this. You may have stuff around payroll. So payroll input shouldn't be the same person who's processing payroll and so on. Now coming back to this table here at the top, so this shows you the total number of rules. So we just gave some examples of what these rules look like. It also shows you how many conflicts are detected after you run the assessment. So what this dashboard is now telling me is out of the 15 rules, I had 11 with potential issues or conflicts that I may that that I may need to investigate. Out of these 11, there were 54 total cases that I need to review. What a case represents is essentially an issue or, a scenario that you need to review to determine if it's an actual true conflict versus not. So to give you an example, and we're gonna go to that screen in a second, but to give you an example, around opening periods versus initiate or approve journal entries, that one rule has five security groups with conflict. So you may have a controller. You may have an HR partner. You can have different security groups with conflict. Each one of these represents a case. Hence, you have 54 in total. And then the last two columns here, it's basically a tracker that tells you, okay. Out of the 54 cases, I've already reviewed two, and I've determined what the conclusion is. And I have 52 remaining that I I've yet to review. So that's kind of the summary that you get at the top. There's other cool things that you get here, including, you know, the, the grouping of these cases by area. So it effectively tells you that per functional area, whether suppliers, whether procurement, customers, you're able to tell which one of these functional areas requires a bit more effort and has a larger number of conflicts. So, maybe the next thing I'll show you here is, in these tabs, this represents, a number of things. The first one is how many net new conflicts you have. So we would have started with 54, but after doing some reviews, that 54 became 52. And then once you click on all these new conflicts, the list of rules are listed. And within each rule, you can see the level of detail. So going through the list, let's say I wanna take, I wanna look at something for suppliers as an example. So I expand this, and as you can see, there's 15 different security groups. So now I know that for this rule, which is to, you know, initiate or process supplier master data, and, approving or initiating invoices. Those are two rules or those are two abilities I wanna segregate. For this rule, I have 15 different security groups that have a potential conflict. So if a person wants to go in and review, all what they need to do is click on, one of these. Let's say I wanna click to see supplier contract specialist. K? You click on review, and it's gonna take you to the case itself, which is the page that shows you, the conflict. So as you can see, this is the case detail. It gives you the security group. Notice how everything is a hyperlink because it's all within the workday system. You can see the security group type. You can see the risk statement, which, again, is customized to your needs. And as you could probably imagine, internal audit would love this given that this is linked to your controls and your risks and all of that is audit auditable. And then at the bottom, there's a number of things. Before getting to this piece at the top, I wanna show you this table here, which is pretty important. This table is effectively or essentially telling you what is causing that conflict. Right? And this is based on the default mapping that PwC provides you with. Now as I said, that mapping may be customized further. So you, as a customer or user of this application, may come and may decide to make some changes to this. But in this case, this is telling you that for supplier master maintenance, these are the domains or business processes that are granting that security group access to this. Versus for invoices, these are the BPs and domains. So, for example, you've got supplier recurring invoice. You've got supplier contract invoice schedule event and so on. Again, all of these are hyperlinked, so you can click on this and it shows you, how is that being configured in the system. If you scroll to the bottom, it shows you all the 67 users as well assigned, to the, to the security group. And then at the top, this is where you conclude on your analysis. So assuming we came in, we looked at it, and we determined whether this is appropriate or not, you can come here and you can change the status. So you can change the status to either require remediation, meaning this is wrong, you gotta fix it, or this is something we've fixed, it's resolved, or this is something that we accept for whatever reason, maybe due to organizational size, maybe due to, existing compensating controls, whatever that assessment is. And then you can, give a reason, and then that's it. And then this would effectively once you click on okay, it will be, you know, updated, and it will be reflected in the summary table, over here. So as you noticed or as you may as you can see here, the number of total cases reviewed increased from two two to three. This went down from 52 to 51, and then whatever changes we made would be here in the top. With the time that we have left, I do wanna cover one last quick thing. Firstly actually, two quick things. The first one is around rule books. So this is where the rule books are. You can come in. You can view these rule books, and it shows you all the different rules and the abilities and then the configuration. So, for example, if you're interested to see or manage if you wanna test, for example, who has access, to to view or set up compensation, you're able to do that. If you're if if you if you wanna take a look at other abilities, you can also make changes. But as you can see here, this is where you do the mapping of, you know, who can set up compensation and what access in the system allows you to set up compensation, view compensation, and so on. So I'm not gonna spend too much time here, but that's kind of the idea in terms of the rule book and how you can manage it. The last thing that I wanted to quickly run through is the simulation exercise. So as we said, this is where you preemptively come in and and run assessment to see if it's gonna result in a conflict or not. So and and maybe one point I'll mention, all of this that you would have seen applies at the security group level and user level. So even the SOD results that we went over for supplier contract specialist, there's another view that does the exact same thing around the user. Because you may have a user that has a conflict because they're assigned to two different security groups that grant them conflicting access. So that's kind of the idea. So over here, if you click on security group, and you wanna run an assessment, let's say I'm interested in assigning new access for the accounting manager, and I'm able to select a security group. We'll give it a couple seconds to load. What the app is doing here in the background, it's effectively scanning the entire system to determine what current access the accounting manager has in order to determine whether the new access will result in a conflict. So if we pick this rule book and I wanna grant new access around business process. Let's say I wanna grant, access to the purchase order event, and I wanna give them access to approve. And then I also wanna give them something that typically should be done by, another individual, let's say, supplier invoice. K? So selecting supplier invoice, also gonna give them access to approve, and then I'm gonna display the rules. So this is gonna display all the rules that are built into this default rule book. You can expand on each one of these, and it tells you if there's any conflict. Yes. No. Because this is under procurement, I'm just gonna focus on procurement. As you can see, this is telling us that there's no existing issue or no existing conflict, but you can probably imagine that once I click run, this is gonna, the first one is is gonna be flagged at a minimum because we know that we gave access to a proof purchase order and a proof supplier invoice. So if I click on run analysis here at the top, boom. It's telling us that there is or this will result in a conflict. And in fact, it's not only resulting in a conflict for the rule that we were planning on providing, but also it resulted in a conflict for another combination of access, which is initiating approving purchase order versus initiating approving goods receipt, which which is something that, as you may imagine, doing this manually would be very tough and very cumbersome. And then you can click on view details, and it tells you what is causing the access or what is causing the conflicts. So for example, for goods receipts, the accounting manager already had something around supplier accounts match exception override, and now they have access to purchase orders, so that's resulting in a conflict. So that's that's mainly what we wanted to cover in this demo. I know this was super quick. So as we said, if anyone's interested in, in learning more or booking a one on one demo, we're more than happy to schedule that. And with that, maybe I'll hand it over to Rolandi, to wrap up this, this presentation. Great. Thanks. Thanks, Bilal. That was a great demo, and it's great to see how, you know, solution like that can run very seamlessly, and natively in the Workday tenant. So to, shift gears a little bit, and I do see we've got quite a number of questions, coming through. So we'd like to spend some time on those as well. But we did think it would be interesting to share with you all a real world example that, one of our clients in terms of how these types of solutions, you know, come into action. And to set the stage a little bit with this particular client, they are a large global company. They operate across multiple countries with a very large workday footprint. And like many of you, they have stringent, regulatory requirements and a complex security landscape. And for years, they've relied on, you know, manual reviews of segregation of duties and sensitive access. Generally, these reviews were costly. They were slow, inconsistent, and, ironically, they still resulted in, you know, audit issues or findings. There were point in time reviews, which really only caught issues after they happened. And, you know, when you're dealing with hundreds or even thousands of users and roles across, your Workday tenant, that's, that's a recipe for a lot of work and a lot of risk. And so how did we help? Well, our team worked very closely with, with this client to implement our automated segregation of duty solution, for Workday. And it wasn't just a technology project, as I'm sure you can imagine. It was really also a change management effort, because it required them to sort of shift their thinking from the usual detective controls and point in time reviews to really bringing in this level of automation, into their business processes, whether it was from an internal audit or controls perspective or even their IT team, using the solution to simulate access and prevent issues from happening. So internal audit absolutely, use the solution to do all their assessments directly in Workday. They didn't have to rely on the good old Excel spreadsheets. Everything as you saw in Bilal's demo was managed natively in the solution, and, all of those issues and findings were tracked directly in the system. Their IT team also had a pretty important role. They built the solution into their IT logical access management processes, to simulate access, be it at the user level or changes to their security groups, you know, to ensure that they were preventing issues before they even transpired, which obviously brought their level of, conflicts down significantly. And one big game changer, with the client was that, as you saw on the demo, the ability to cumulatively, look at results on a ongoing basis meant that they could really manage by exception. So, of course, the baseline assessment was the most challenging, but once a number of remediation efforts took place, then they really were looking at outliers that may have changed from period to period or quarter to quarter, which significantly reduced the work for their teams. And in terms of outcomes, I mean, the results speak for themselves. Their internal audit efforts on SOD and sensitive access were down by about 65% per quarter. Those resources were obviously redeployed, to do more value added and strategic work at the organization. The time to complete the reviews dropped drastically, and their audit findings related to segregation of duties and sensitive access decreased significantly. So there's one key takeaway. It's this. Automated solutions for security and control are not just nice to have anymore. As you heard in Nick's opening remarks, they're critical. They're table stakes, and it's really the only way to manage compliance and risk management in complex work day environments. They save time. They reduce audit findings, and they free your teams to really focus on what matters at the end of the day. So with that, quick call to action. On the next slide, you'll see some of the contacts on the page that you can certainly reach out to as far as, you know, wanting to see more or having a more comprehensive demo. There is also a QR code, that you'll see later in the presentation. That'll take you to the Workday marketplace. You can learn more about the segregation duties app or any other apps, that we have available. And, of course, you know, you can always feel free reach to reach out, for a conversation in in more detail. So with that said, and I do see here that we do have a number of questions flowing in. Maybe we'll turn it over to the q and a period. And there is a question here on the key use cases of the solution. You obviously saw a couple of those in action. But the question is, what are the key use cases of the solution, and who are the typical users of the solution? So maybe, Nick, I'll hand that one to you. Okay. Two use cases primarily, but I'll start with the personas. When we're talking to our clients, there there's usually two folks we're talking to. One is the office of the CIO and then maybe the office of the CFO, and I'm going to include, like, compliance and audit in the office of the CFO. For the office of the CIO, first use case is the preventive simulation that the law took us through. This is, you know, in serving this assessment into the provisioning process. Second use case is the office of the CFO, you know, including potentially audit use cases which is all about the detective assessment to monitor risk and even automate the testing of controls. So that's that's how I would focus on the two primary use cases. Great. Thank you, Nick. Next question here, maybe, Kristen, I'll hand this one over to you. The question is asking whether this, SOD app is an add on for Workday or built in, and another question, sort of talks about whether you need a Workday extend license to deploy this app. Sure. So the SOD app and all of the apps found on the marketplace are additional, licenses, but they do work natively within Workday. So it's a little bit of both. And you do not need extend licenses to run this or any, marketplace app. Perfect. Yes. Thank you, Kristen. We have a question here, Balal, regarding the rule books that you walked. us through. The question is, can a rule book be created to monitor specific domains and access to those, and can it monitor access to specific features within domains or business processes? Yeah. No. That's a very good question, and the answer is absolutely. That's where the customization comes in where, as you would have seen, your you have the ability to take a look at the rule books, and then those are further drilled down into these abilities. Under these abilities, you can specify which specific domains you're interested in in reviewing and and using that as as its own rule that you wanna test and monitor. So answer is yes. Absolutely. Fantastic. Thank you, Balolt. We have another question regarding, whether these applications are available to existing customers of PwC. Maybe I'll take that one. The short answer is yes. In fact, these solutions are available to any, Workday customer. There is obviously, a licensing component involved with, the ability to use the solutions, but, the short answer is, any Workday customer in theory can use the solutions. The next question, maybe, Bilal, another one for you. The question is really around whether there is a centralized multi tenant capability for the solution, or is it on a per tenant basis, that it's used? Yeah. So so these applications are are usually licensed on a per tenant basis. You can certainly have these deployed at multiple tenants, but it's per tenant. However, they can within that tenant, you can deploy it, for, you know, for one customer. You can have it in your sandbox versus production. That is definitely doable. But, yes, those are per tenant pieces. K. Fantastic. Thank you, Bilal. There is a couple of questions here with respect to, pricing. So maybe I can I can answer those? One question for for example, is asking whether or not, the app, is paid for, by sort of an app basis and the implementation, and any sort of, key differentiators between the solution and others. So, so on the pricing, there is a license fee, of course, associated with the application, and there's generally a one time, deployment or implementation fee. That's essentially to, you know, get the app deployed into the tenant. And then there are a variety of advisory services that, you know, some of our clients, generally look to us for, whether it's helping them to design a custom rule set for their needs, helping them to review the results of certain assessments, or other remediation efforts that they may have. But these sort of, mandatory components are the licensing fee and the deployment fee. Another question for maybe yourself, Bilal, does the rule book have the feasibility to identify conflicts between intra role and inter role conflicts based on defined rule sets? So in other words, can you look at, you know, multiple rules across, you know, security groups and vice versa? Yeah. Yeah. So, I mean, the short answer is is is yes. You're able to kinda look at different rules and different security groups and inter role as as as mentioned. I think one of the biggest, values here is you're also looking at SOD across different functional areas as opposed to just within one process or one business process, which typically be is a very difficult exercise to do in a in a manual manner. But, yes, you can customize your rule books, to do to do that as long as it's all, as we said, within the workday tenant, and it is something that we can point to from a domain security policy or a business process security Fantastic. Nick, maybe next question for for you. The question is, policy. it's easy to see how this would accelerate manual processes. Can you share more about the journey, the value, and the expected effort to bring this on as a net new capability, where SOD and SA aren't necessarily part of current processes at. an organization? I would I would probably answer it, from the perspective that security matters. It matters at all organizations. So if an organization is not really prioritizing understanding what the security risks are, whether it's sense of access or segregation of duties, they probably should. So, you know, that's one thing. But in terms of the journey, what we've tried to do with this app is to really accelerate the time to value. And, you know, one of the ways of doing that is with the sort of off the shelf rulebooks that are already provided to you. And I mean, if listen, PwC, if there's one thing we are really good at, we've been in the industry a long time specific to audit, risk assurance, risk management, We know what to do. We have pressure tested and audit tested, rule books that we're gonna give you quickly. So if your priority and your intention is to make sure that you are identifying the key risks, simply those over fraud or financial reporting, we're going to accelerate the time to that with the rule books. If you have more nuanced risks or objectives, we can customize those. But, maybe just to round out the answer, it's it's an off the shelf app, We have off the shelf rule books. We have a very quick implementation time, which is really about just deploying the application and putting it in the hands of the customers. Fantastic. Thank you, Nick. Couple other product related questions. Maybe we'll all, I'll I'll direct these to you. One is, are there any performance issues while running these solutions during, during business hours? No. No. There shouldn't be any, whether during business hours or not. I I wouldn't say there I wouldn't say there should be. Yeah. And maybe I'll just add to that that, you know, given the, inherent design of the solution where you can assess very specific things, you know, short of running a tenant wide assessment, there's also ways to, you know, speed up the processing, if you will, if you wanted to say, look at finance independent of HR, or if you wanted to assess very specific rules. So that's another way that you can sort of accelerate the, the time for the assessments. Nick, maybe another one for you. There is a few questions on, sort of the, you know, comparison of this particular solution, to those, of, you know, other products in the markets that offer, workday monitoring. The example here is Obsidian and what is sort of the differences in scope in terms of how it works, etcetera. Okay. Yeah. I mean, security matters again, and this is not a new challenge. So the challenge has been out there for for years, and a lot of, you know, really great organizations have brought, forward some good solutions. The the the two key differences between this application and some of the others that you may find, at other organizations, the first is this is native. This is inside of Workday. Your data stays in Workday. You don't have to leave the Workday experience to go and manage risk in another system that needs to be maintained. So that's the first thing. The the other significant difference I I think is what the law ended with which is the preventive simulation. The ability to ask what happens if, you know, during your provisioning process. I I don't believe anything else out of the market currently does that. So, and and maybe just the third big difference, I I just mentioned PwC. You know, we we have the, you know, pressure tested perspective on many types of risk. And we also have the services to help ensure customer success. So we have the app. We have the automation. We've got the rule sets. We've got the services if you need them. So kind of all those things kinda help differentiate this this product from others. Fantastic. I know we're coming up on time, so maybe one final product question that, you can answer, Bilal. The question is, can the request framework also be used for the user access review where users can have their access revoked, and everything kept in Workday? So I think the question there is, can you sort of weave this as part of the user access review that many of our clients would typically have in place? So so two things I'll also share. So in terms of part of the process, or control around user access review, this app can certainly support, and you can customize rules that allow you to manage, user access review. In terms of the, request framework, that's currently not in place, but certainly one of the road map areas that we have to to bring into the app, as we continue enhancing and developing it. Great. Good questions. Okay. Well, with that, I do see that we're coming up on time. So, maybe, Kristen, I'll turn it over to you to, bring us to a close here. Great. Thank you so much. Again, huge thank you to PwC and this amazing team for joining us today. I hope you found this information valuable. You will be receiving, this within forty eight hours again. So, any questions that come up, please feel free to reach out. We look forward to helping you further, and thank you again, and enjoy the rest of your day.