2017 IIA Central NoDak Chapter Fall Seminar

Transcription

1 2017 IIA Central NoDak Chapter Fall Seminar IT Auditing for Non-IT Auditors & Continuous Auditing & Data Analytics with Root Cause Analysis Seminar Instructor: Raven Catlin, CIA, CFSA, CPA, CRMA Raven Global Training November 1 & 2, 2017 MDU Resources Group, Inc W. Century Avenue Bismarck, ND

2 Day 1 - IT Auditing for Non-IT Auditors Course Overview Are you dabbling in audits of Information Technology (IT)? Do you hear words like encryption, firewalls, security access, and application controls and cringe? Do you want to understand more about Information Technology risks and controls? Are you looking for something to alleviate the fear of auditing Information Technology? If you answered yes to any of these questions, the IT Auditing for Non-IT Auditors is the course for you. This course was designed for business auditors who are not IT experts who realize the importance of integrating IT controls and evaluation into their business audits. Attendees will learn how to plan, test, and communicate the results of the audits to both IT and business owners. During this course, you will acquire baseline knowledge for IT general and application control concepts and skills and their importance and relationship in your business processes. You will learn the fundamentals of issues concerning IT controls and the scope of IT risks that must be addressed in today s business environment. Attendees will learn using a variety of techniques, including lectures, group discussions, and case studies. Who should attend Operational, financial, and compliance auditors interested in learning about the auditing of IT general and application controls. Auditors new to IT auditing Auditors practicing Integrated Auditing Learning Objectives At the end of this program, attendees will be able to: Explain General and Application Controls Identify risks and controls of IT and its impact on business processes Test IT controls effectively Communicate IT components of audit results, gain agreement from IT and Business Owners, and monitor remediation efforts Program Level - Basic Course Outline 1. Introductions & Learning Objectives 2. Introduction to Information Technology Auditing Concepts and definitions Control frameworks (COSO, COBIT, Netcentric, FISCAM, NIST Special Publication 800-series on Security Controls for Federal Information Systems, GAIT, GTAG) Statements on Auditing Standards No. 109 and related IT risks and control objectives Role of Internal Auditors for IT and IIA standards and practice advisories

3 3. General and Application Risk Assessments [Case Study: Business & IT Risk Assessment] Understand the IT risks and continue to build on identified control frameworks Explore General and Application controls and their importance in core business processes, including the initiation, authorization, processing, summarization and reporting of critical business functions and data Explore the relationship between general and application controls 4. Define General Controls and Controls Objectives Types of General Control audits (security management, change management, disaster recovery/business continuity planning, IT governance, IT infrastructure) Global Technology Audit Guide (GTAG) Guide to the Assessment of IT General Controls (GAIT) 5. Defining Application Controls and Application Control Objectives Input Controls Processing Controls Output Controls 6. Types of Application Controls Embedded and configurable controls Input, processing, and output controls Integrity controls Preventive and detective controls Balancing and file version controls Application recoverability controls 7. Planning IT General and Application Control Audits [Case Study: Identify IT Controls & Defining Tests] 8. Communicating Audit Results to Business Process Owners and IT Selling the audit results Monitoring remediation activities

4 Day 2 - Continuous Auditing & Data Analytics with Root Cause Analysis Course Overview Internal auditors must use continuous auditing and data analysis to maximize our effectiveness and meet management s expectations to improve operations and add value. How do you implement a continuous auditing and data analysis program? What elements are essential to having a successful program? How will our ongoing, continuous program differ from management s monitoring efforts? How can data analysis aid in root cause analysis? Learn the answers to these questions and more by attending this interactive session on continuous auditing and data analysis. Participants will create a strategic continuous auditing and data analytics plan and learn how to incorporate data analytics into root cause analysis. Who should attend Auditors performing data analytics Managers developing data analysis / continuous auditing program IT, Operational, Financial Auditors CAEs Audit Managers Learning Objectives At the end of this program, attendees will be able to: Explain the fundamentals of continuous auditing and data analysis Create an implementation plan for a continuous auditing program Address challenges and pitfalls in continuous auditing Identify and obtain data for analysis Communicate continuous auditing results to management Incorporate data analytics into root cause analysis Program Level - Basic Course Outline 1. Introductions and Learning Objectives 2. Data Analytics & Continuous Auditing today Differences between continuous auditing, pre-audit approach, continuous monitoring, and data analysis Using continuous auditing in the pre-audit approach Common analytics for auditors Evolution of data analytics Raising control awareness through continuous auditing

5 3. A holistic view and approach (IT-savvy, risk-focused, operational control view) Brainstorming for options Identifying and acquiring data Building data analysis into the audit process Case study: The journey to Continuous Auditing 4. Jumpstarting your data analytics program Discovering business questions and sources for answers Determining testing objectives Determining types of queries / tests Brainstorming Skills Practice Using data analysis in risk assessments, audit selection, and ongoing monitoring Create a data analytics implementation plan 5. Four steps to implementing an effective continuous audit process 6. Assessing your data analytics maturity 7. Continuous auditing and data mining tools 8. Communicating continuous auditing results: 4 key questions that must be asked and answered! 9. Using data analytics in root cause analysis (RCA) RCA tools and methods Fishbone analysis Pareto analysis 10. Wrap-Up and Review

6 Seminar Instructor Raven Catlin, CIA, CPA, CFSA, CRMA Raven is a globally recognized speaker and instructor in risk management and internal audit. She possesses over 20 years of diverse internal audit experience and risk management, and 16 years of instructing and facilitating a variety of courses. With this diverse experience, she helps professionals add dimensions to help them grow for a successful future. She performed reviews and audits of not-for-profit and philanthropic organizations, mutual funds, general banking operations, trust operations, real-estate lending, construction activities, benefits, compensation, payroll, procurement activities, accounting operations, marketing activities, governance activities, information technology, treasury & cash management, derivatives, secondary marketing, and debt issuance. Her industry expertise and audit experience includes mortgage operations, mortgage backed securities, and capital markets. She served as an integral member of the financial restatement team for Freddie Mac. Additionally, she created project plans and coordinated the efforts of over 150 individuals responsible for correcting security pricing as part of the Fannie Mae financial restatement. Most recently, Raven performed a business process analysis and redesign (using Six Sigma and Lean) at the World Bank/IFC and a Fraud Risk Assessment for a Regional Bank and Trust Company. She developed and redesigned the auditing infrastructure for internal audit functions, including developing internal audit policies and procedures, implementing audit software, designing reporting and time management templates, designing audit committee packages, and implementing databases to report and track progress of audit concerns. Raven embraces the definition of internal auditing as a value-added service and operations owners have welcomed the fresh approach to internal auditing. Raven is the proud mother of a seven-year-old angel, CC, and an adorable Maltese puppy, Pepper Sugar Spice. They both typically travel with her on training assignments. In her spare time, she enjoys cooking, island hopping & world traveling, tapping into her inner child at amusement parks (especially Disney World), and spending quality time with her family!

7 Seminar Fees IIA and NDCPAS* Members Non-Members Students 1 Day Both Days 1 Day Both Days 1 Day Both Days $350 $525 $400 $575 $200 $ % Discount for Groups of 3 or More Use Discount Code: GROUP 10 We now have online registration!! Follow the link below to complete your registration. After you register, you will receive a confirmation from iiacentralnd@mail.com. We do still require payments be made via check or ACH. Mail checks to: IIA Central NoDak Chapter PO Box 64 Bismarck, ND Refunds will not be given for cancellations received after October 27, Seminar Hours 8:30 a.m. 4:30 p.m. Both Days Registration Fee Includes: Enrollment All course materials Refreshments, snacks & lunch CPE Credits 8 Credits (1 Day) or 16 Credits (2 Days) For Questions or Additional Course Information contact: Kim Reinke (701) kim.reinke@mduresources.com