Welcome to the 404 Institute Webcast

Transcription

1 Welcome to the 404 Institute Webcast Leveraging data analytics and continuous auditing processes for improved audit planning, effectiveness, and efficiency Thursday, October 25, :00 p.m. 3:00 p.m. ET Help Desk Hotline (Outside the U.S., ) Institute webcast series Past webcast presenters have included: 3M Aviva Boeing Digital Realty ING Group Microsoft Pfizer Symantec Webcast replays are located in the Events section of the web site A replay of this webcast will be available on the web site within three business days Register for institute 1 1

2 Webcast presentation and CPE credit Supporting materials link on screen: Download a copy of today s presentation/slide deck in color or black & white CPE regulations require that online participants must answer at least four questions during the webcast: Polling questions will appear on your media player on top of the slides Hit the Submit button after answering each CPE question If you choose not to participate in CPE polling, click the X to return to the main slide presentation 2 Submit questions to our speakers; call help desk Questions for speakers Use the ask question bar on your screen to submit questions to our presenters Type question; click Submit Submit questions for our presenters at any time during the sebcast Webcast Help Desk (Outside the U.S., ) 3 2

3 Today s agenda & presenters Agenda Common terminology Current trends and observations Development lifecycle CA/CM case study Presenters Jim Littley, Global and Americas leader for CA/CM services, KPMG LLP Vijayant Sitani, Director, Internal Audit, McDonald s Corporation Q&A Contact Information 4 Common terminology Definitions and characteristics of continuous auditing/monitoring Activity Definition Unique characteristics Common characteristics Collection of audit evidence and Third Line of Defense indicators by an auditor on Not intended to become part of information technology (IT) the internal control Technology-enabled process systems, processes, environment transactions, and controls on a Analytic capabilities include: frequent or continuous basis, Process can also be used for Efficient ETL processes throughout a given period Continuous Risk Assessment for dynamic audit planning Flexible types of analytics purposes Scalable and extendable Frequency can be modified Continuous Auditing (CA) Continuous Monitoring (CM) Feedback mechanism (monitoring method) used by management to ensure that controls operate as designed and transactions process as prescribed First and second lines of defense Responsibility of management Important component of the internal control structure Can provide automated controls and processes Wide variety of organizational Data Dynamic reporting with actionable output Workflow management capability Integration with a process Definitions taken from KPMG LLP s Continuous Auditing and Continuous Monitoring: Transforming Internal Audit and Management Monitoring to Create Value,

4 Common terminology Definition of data analytics A process by which insights are extracted from operational, financial and other forms of electronic data internal or external to the organization. These insights can be historical, real-time or predictive and can also be risk-focused (e.g., controls effectiveness, fraud, waste, abuse, policy/regulatory non-compliance) or performance-focused (e.g., increased sales, decreased costs, improved profitability, etc.) and frequently provide the how? and why? answers to the initial what? questions often found in the information initially extracted from the data. 6 Current trends and observations Technology, data analytics and continuous auditing Convergence of Business Intelligence; IT-Governance, Risk & Compliance; and CA/CM tools and techniques. Increased interest in CM by financial services, healthcare/life sciences, and public sector due to expanding regulations. CA/CM strategic development link to enterprise initiatives: Partnering with the business and joint business case; Drill down into KRIs and KPIs for management use; Enhancing risk assessment activities with quantitative information and moving toward dynamic audit planning Internal audit focus on building repeatable and sustainable ETL (Extract, Transform, Load process) and analysis for meaningful reporting; not long lists of anomalies. Trend toward leveraging BI tools: As part of monitoring of KPIs/KRIs; For continuous risk assessment for audit planning purposes; For profiling of populations to focus transaction analysis and testing. 7 4

5 Continuous auditing/monitoring maturity evolution 8 Current trends and observations Common scenarios for initial implementation of CA/CM Scenario 1 Internal Audit department focuses on making historically performed data analytics more repeatable and sustainable OR on expanding scope. Scenario 2 Internal Audit department focuses on leveraging existing management systems and tools for better risk assessments. Scenario 3 (e.g., Today s Case Study) Internal Audit department serves as the pilot for continuous monitoring systems on behalf of management. Scenario 4 Tactical or burning platform issue drives the implementation of continuous monitoring. 9 5

6 Current trends and observations CA/CM/data analytics implementation challenges General Determining and establishing consensus on objectives and success criteria. Measuring and demonstrating success. Limited resources (technology and human know how). Data Availability and Quality Lack of access to data Disparate information systems with different data formats. Incomplete data sets, inconsistent data quality. Data privacy/security issues to navigate. Data Analytics Inability to effectively leverage data analytics to achieve audit objectives Definition of exception; addressing false positives and false negatives. Workflow around exception resolution; managing volumes of exceptions. Change Management Managing impact of CA/DA processes on auditors and other business processes. 10 Development lifecycle 6

7 Development lifecycle Sample CA/CM development lifecycle Develop a Strategic Plan/Roadmap Define the objectives you are trying to achieve. Identify key stakeholders and define the success criteria and related measurements Build an effective business case. Develop Tactical Plans Design governance and reporting structure for continuous auditing activities. Evaluate data analytic skills and competencies. Integrate data analysis into IA methodology and processes. Evaluate and select technology tools. Design and Execute Implementation Plans Manage organizational change (internal to Internal Audit and business facing change) Design and deliver trainings i Identify focus areas for implementation of CA to satisfy strategic objectives. Design and establish data connection/extract; analysis; and reporting mechanisms including risk- and performance-based analytics, dashboards, scorecards, reports and alerts, etc. Evaluation of Existing Continuous Auditing Processes 12 Development lifecycle Develop a strategic plan or roadmap Define the objectives Sample objectives Leverage CA to Enhance the Audit Planning Risk Assessment Process More robust and continuous risk assessment for dynamic audit planning. Increase Efficiency and Effectiveness in the Audit Process Use CA to reduce manual testing time and focus on other areas or different audits: Continue to perform core audit work more effectively and efficiently. Use CA to monitor fraud and misconduct Key Risk Indicators (KRI s) focus on traditional areas of risk (e.g., Journal Entries; Order-to-Cash; P2P; Payroll; T&E expense; etc.). Use CA on low and moderate risks where audits may be less frequent and/or less robust. Identify stakeholders and success criteria Consider stakeholder needs for business performance and risks Accountability, system performance, data integrity, reduce effort Agree on measures to define continuous auditing success Quantitative factors like hours, number of audits and audit findings; Qualitative factors like enhanced governance and auditee satisfaction 13 7

8 Development lifecycle Develop a strategic plan or roadmap (continued) Build an effective business case Identify risks not adequately covered Enhance auditing techniques will provide better coverage Align with business objectives for initial wins and momentum Technologies leveraged jointly by the business and audit for controls performance and evaluation Potential of continuous auditing and monitoring for the business Better risk identification and timely resolution 14 Development lifecycle Develop tactical plans Design governance and reporting structure Define owners and responsibilities for internal audit, IT and business Establish communication plans and schedules Determine Audit Committee reporting, as appropriate Evaluate data analytic skills and competencies Compare existing skills with necessary skills Evaluate short-term and long-term required skills Integrate data analysis into IA methodology and processes Consider opportunities to replace traditional procedures Assess the impact of changes on audit delivery and personnel Evaluate and select technology tools Identify and evaluate tools that will meet department requirements Assist with understanding pricing and licensing scenarios 15 8

9 Development lifecycle Model data analytics process Define the audit objective(s) Determine what analytics are relevant in achieving the audit objective(s) Design the analytics and confirm the logic Determine the definition of exception Identify relevant IT systems and assess availability and quality of data Acquire data (i.e., extract, transform, load process) Develop analytics (i.e., script, program, etc.) Run analytics and perform initial validation of results to identify data and/or logic flaws Confirm the results of the analytics support achieving the audit objective(s) and revise, abandon or rerun analytics as necessary Validate results of analytics with business owners Research, follow-up, and determine root cause of identified exceptions Report findings and recommendations to business owners and management Update analytics repository and enhance repeatability, as appropriate 16 Development lifecycle Evaluation of existing continuous auditing processes Sample leading practice questions Is your continuous audit/continuous monitoring (CA/CM) process defined? Do your CA/CM activities assess the relationships between key economic indicators? Do you regularly meet with senior management and critically review management and risk information? Do you take into account regulatory and market developments timely? Is your process linked to your risk assessment and audit planning process? Does your process utilize technology effectively? Does your process lead to more efficient and effective auditing? Does your process assist in focusing auditing efforts on higher risk areas? Does your process help identify trends, patterns, and other pervasive issues? Are your activities documented appropriately? Do your activities assist in expanding coverage more efficiently? Do your activities assist in identifying emerging issues more quickly than traditional activities? Do your activities increase the detection and prevention of fraud, misconduct and regulatory non-compliance and reduce the number of incidents? 17 9

10 CA/CM case study Continuous auditing case study Design and implementation of a technology-enabled CA/CM process Business reason and objective(s) of initiative Solution Description Outcomes/Results 19 10

11 Continuous auditing/monitoring areas of focus Vendor Master Duplicate Payments Invoice Processing T&E Data Validation Duplicates Same Aged Open Invoices Out Of Pocket Vendor & Inv. # Duplicate Vendors Aged Debit Balances Excessive Mileage Duplicates Same Inv. #, Unfavorable Even Payment Amounts Even Amount Diff Vendor Payment Terms Manual Checks Gift Cards Duplicates Same Employees Added To Vendor, Amount, Date Payments To Employees Duplicate Submissions Vendor Master Payments prior to Invoice Suspicious MCC Payment Method date/due date (Non-ACH) Company Car/Mileage Retroactive POs OFAC & Banned Countries Non Preferred Vendors Payroll GL/JE Fixed Assets FCPA Payments Beyond JE by User Id Useful Lives Payments to Government Termination Date Suspicious/Unusual JE CIP Aging Payments to Multiple Merit agents/consultants Duplicate JE Negative CIP balance Increases/Bonuses Gifts/Donations Prior Period JE Asset Classification Duplicate Employees Entertainment Expenses JE posting trend Same Bank Account & Diff Clock Numbers GL accounts by User Id Employees & Vendors Suspicious GL accounts With Same Address/ Bank Account 20 Process Plan, design and implementation Process Prepare list of Obtain Develop Understanding di Scenarios electronic data analytics Execute analytics No Validate report Yes Schedule and Publish the reports 21 11

12 Process Sustainability Busines ss (CM) Check exceptions Solve the issues on timely basis Update Exception Management Continuous Auditing Verify that exceptions are followed up Gather the results and root cause from the users Report to senior management results and action plans 22 Project Plan Planning Design Implementation Execution Project Methodology Determine Scope Develop a Project Plan Design SharePoint Site Evaluation of Technology Tools Analysis of IT landscape Preliminary discussion with key stakeholders Document process under review Gather requirements from key stakeholders Prepare list of scenarios Define electronic data requirements Review download procedures with IT Develop analytics Testing of analytics Develop testing cockpit Stakeholder Training Status meetings with stakeholders Business Process Procedures Execution of test script Follow up on exception report Document results in SharePoint Update and report results 23 12

13 Keys to success Dedicated Resources Key Stakeholder Support Quick Wins Investment in Technology Collaboration (Internal/External) Perseverance 24 Key challenges Getting the Data Finding the Right Resource/Talent Management Follow-up of Exceptions Conflict with Traditional Audit Approach 25 13

14 Q & A Thank you! 14

15 Today s presenters Jim Littley Global and Americas leader for CA/CM services KPMG LLP jlittley@kpmg.com Vijayant Sitani Director, Internal Audit McDonald s Corporation vijayant.sitani@us.mcd.com 28 The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act upon such information without appropriate professional advice after a thorough examination of the particular situation. ti 2012 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative ( KPMG International ), a Swiss entity. All rights reserved. The KPMG name, logo and cutting through complexity are registered trademarks or trademarks of KPMG International. 15