This is the best summary I could come up with:
Birmingham City Council, Europe’s biggest local authority, has no way of knowing if financial fraud has been committed after it failed to run security and audit features in a new Oracle Fusion ERP system.
The English council, which was responsible for £3.7 billion revenue [PDF] in 2021, also continues to struggle with “segregation of duties” features that set who is legally allowed to see and control transactions, essential for preventing fraud.
Fiona Greenway, director of finance and statutory officer, told the Audit Committee yesterday that the council would almost certainly never know if fraud had been committed.
The cost of implementing a functioning system that allows external auditors to sign off accounts is expected to be more than £100 million more than initial estimates.
In October last year, a 12-page public interest report from external auditors Grant Thornton highlighted concerns over security and governance from when the system was first introduced.
Earlier this month, Councillor Fred Grindrod, chair of the council’s audit committee, asked why the Oracle system was still not “safe and compliant” in terms of legal and statutory obligations going into the new financial year, something Grant Thornton said would be “absolutely crucial.”
The original article contains 516 words, the summary contains 195 words. Saved 62%. I’m a bot and I’m open source!
My bank, they had the Oracle experts to take care of the Data center and they experienced a whole week of downtime. In 2024, a week of downtime for a bank. Imagine the cost of that.
Don’t understand the companies that they’re intentionally going with Oracle
One would almost suggest making it easier to commit fraud is a feature, not a bug.
Lowest bidder and/or the exec got wined and dined.
Its always the case. Always.
As an auditor myself, this is ridiculous. This is what happens when you don’t properly involve auditors in software.
So is this Oracle’s fault for over promising, council’s fault for not communicating its needs, or a lack of training/induction?
My guess is that Oracle has audit logging support but it was not turned on by the implementation vendor. Typically a customer uses a partner for professional services to get it up and running for training and handoff. So it’s probably a mix of people that kicked it up. The one constant with Oracle deployments is that they are always over budget and rarely work and it’s somehow always a mix of faults. So from a high level view it is probably something to do with the way Oracle engages or who they partner with or both.
They literally went bankrupt spending $166 million (600% over budget) on a financial auditing system… and it can’t be audited. What a dumpster fire.