Risk & Continuous Controls Monitoring: How to implement issue remediation workflows the business will love

Size: px

Start display at page:

Download "Risk & Continuous Controls Monitoring: How to implement issue remediation workflows the business will love"

Leon McGee
6 years ago
Views:

1 Risk & Continuous Controls Monitoring: How to implement issue remediation workflows the business will love Jason A. Gross, CPA, CIA, CFE, CISA, ACDA Vice President, Controls Management, Siemens Financial Services, Inc. Robert Luu Senior Solutions Consultant, ACL

2 Presenters Jason A. Gross CPA, CIA, CFE, CISA, ACDA Vice President, Controls Management, Siemens Financial Services, Inc. Robert Luu ACDA Senior Solutions Consultant ACL

3 Agenda Methodologies and Concepts Supporting Continuous Controls Monitoring(CCM) Strategies for Implementing a Successful CCM Program Use of ACL Technology in Developing and Sustaining Issue Workflow Resolution Q & A

4 Methodologies & Concepts Supporting CCM

Elevating the Level of Control Assurance Reasonable Assurance Internal control testing SOX testing Internal audits External audits Opportunity to Elevate Control Assurance Level Limited Assurance

5 Elevating the Level of Control Assurance Reasonable Assurance Internal control testing SOX testing Internal audits External audits Opportunity to Elevate Control Assurance Level Limited Assurance Self Assessments Periodic reviews Interview based w/o testing Continuous Monitoring Continuous Auditing Continuous Assurance Absolute Assurance No such thing as absolute assurance, Continuous techniques can move the needle as far as possible

6 How to elevate the level of control assurance? Manual Sample Testing Automated Universe Monitoring Audit Risk Audit Risk Sampling Risk Materiality Sampling Risk Materiality Lowers Control Assurance Raises Control Assurance

7 Process Flow of a Continuous Controls Monitoring (CCM) Program Data imported from source systems into ACL or Exchange ACL CCM system validates accuracy of corrections ACL Data evaluate against established rules and criteria (policies, guidelines, etc.) Correction of errors performed by owners in the source systems Exception alerts identified, generated and routed to process and control owners

8 3 Key Techniques of Continuous Monitoring Heuristic and predictive Anticipated Level of Sophistication Trending and patterns Careful consideration of the mix to satisfy targeted objectives! Specific Identification/ Rules Based Potential for False Positives

9 Continuous Assurance Attributes Authorization Data Completeness Table Maintenance Edit Checks Calculation Verification Data Integrity Change Management Trending & Analysis

10 CCM Control Types CCM Program Detective Control Corrective Control

11 CCM Control Types CCM Program Detective Control Corrective Control Preventative Control

12 How Can CCM Become a Preventative Control? Improving the controls in the Accounting Closing Process: Detect Errors in Sub-Ledger Correct Errors in Sub-Ledger Prevent Misstatements to General Ledger Reduce Need for Correcting Journal Entries Daily Daily Daily Month-End

13 Strategies for Implementing a Successful CCM Program

14 People Process Technology Cultural Awareness Foundational Pillars Enabling Continuous Assurance Continuous Monitoring Continuous Assurance Continuous Auditing

15 Sponsorship Strategy Partnership Coordination Technology Integration Communication Oversight Build the Bridge to Continuous Assurance Continuous Assurance Continuous Monitoring Owned by Management Is a Management activity May be preventive, detective and corrective in nature CM is a control itself Continuous Auditing Owned by Internal Audit Is an Audit activity and responsibility Independent of the control; therefore should not be preventive in nature IA should evaluate CM activities, trending and change management Continuous Assurance Built upon the integration of continuous monitoring and continuous auditing

16 ACL CCM Program at Siemens Financial Services, Inc. Data imported from source systems into ACL or Exchange CCM Program Implemented in 2010; Currently 100+ users and ~ 300 analytics running daily covering financial reporting, operational, IT and compliance topics ACL CCM system validates accuracy of corrections ACL Data evaluate against established rules and criteria (policies, guidelines, etc.) Proven instrumental to remediation solutions of deficiency topics of the past with quick implementation Correction of errors performed by owners in the source systems Exception alerts identified, generated and routed to process and control owners Demonstrated as an effective detective control to identify errors, but also as a preventative mechanism to ensure errors corrected before month-end accounting closing Utilized in SOX/ICFR program & by External Audit in their audits

17 Timeline of our Journey Towards Continuous Level of Assurance 2018 Good Better Ideal CCM Maturity Model Ad-hoc Repeatable Sustainable

18 Use of ACL Technology in Developing and Sustaining Issue Workflow Resolution

19 Our ACL CCM Implementation ACL Exchange (AX) Scheduling of the ACL routine ACL CCM engine Importing of systems data Performance of analytics ACL Results Website Repository of exceptions and alerts Workflow management Triggers Questionnaires

20 Fundamental Steps of the CCM Program ACL ACL Exchange (AX) Import Data from Source Systems into ACL Perform JOINs and EXTRACTs CCM engine Importing of Perform systems Data data Performance of analytics Scheduling of the ACL routine Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated ACL Results Website Repository of exceptions and alerts Workflow management

Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data ACL Publish to Results Manager ACL Exchange (AX) Perform Publishing

21 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data ACL Publish to Results Manager ACL Exchange (AX) Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated Scheduling of the Key Concepts for Continuous Monitoring (e.g. CCM Daily): engine ACL routine Imports of source data used in analytics required Importing each of day to re-analyze the data systems data Performance of Establish means of discerning data between analytics different days using variables Website Each table name ends with a 3 digit Run #: Today Repository = ACL %v_run_seq_t% Results of exceptions and alerts Establish consistent naming conventions for tables Workflow and management paths for storing data Use SET FOLDER to organize ACL project to keep tables organized and by Run# SET FOLDER /CCM_RUN_SEQ_%v_RUN_SEQ_T%/A_IMPORTS_SAP_%v_RUN_SEQ_T

22 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data ACL Publish to Results Manager ACL Exchange (AX) Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated CCM engine Importing of systems data Performance of analytics Key Concepts for Continuous Monitoring (e.g. Daily): ACL Results Scheduling of the ACL routine Aggregate data to large extracts tables to offer most flexibility for analytics to use as a base Invest more effort in holistic extract tables for quicker access to analytics Maintain principle of appending each table with Run# Today = %v_run_seq_t% EXTRACT_TABLE_1 Analytic#1 Analytic#2 Analytic#3

23 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated Source Import Tables Standard ACL Processes Extract Tables (EX_) ACL Daily Testing Tables (PZ_) Universe Being Tested ACL Adaptation to CCM processes (3-way comparison) Exchange (AX) PZ_Analytic1_852 (Today) IMPORT_TABLE_1 EX_TABLE_1 PZ_Analytic1_852 IMPORT_TABLE_2 PZ_Analytic1_851 (Yesterday) PPP_Results_Analytic1_852 (Today) IMPORT_TABLE_3 IMPORT_TABLE_4 EX_TABLE_2 RX_Analytic1_852 Total RX+RC = 100% RC_Analytic1_852 Total Clean PI_Analytic1_852 Publish= YES to Results! Determines what needs to be published to Results: New exceptions for Today Improperly Closed from Results Does not re-publish same Open items in Results

24 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated Adaptation to CCM Process (3-way comparison) ACL ACL Exchange (AX) Use Standard Scripts to Assign Unique ExceptionID s to All : PZ_Analytic1_852 (Today) PZ_Analytic1_851 (Yesterday) PPP_Results_Analytic1_852 (Today) PI_Analytic1_852 Publish= YES to Results!

Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control

25 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated Adaptation to CCM Process (3-way comparison) ACL Status Codes ACL Exchange (AX) PZ_Analytic1_852 (Today) Use Standard Scripts to flag needing to be published to Results: PZ_Analytic1_851 (Yesterday) PPP_Results_Analytic1_852 (Today) PI_Analytic1_852 Publish= YES to Results! New Exception; Must re-publish Improper Closure; New Exception; Must re-publishmust re-publish Improper Closure; Must re-publish

26 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated ACL ACL Exchange (AX) How to Import from Results into ACL

Owners of New Auto Close Remediated ACL ACL Exchange (AX) How to Import from Results into ACL :

27 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated ACL ACL Exchange (AX) How to Import from Results into ACL : Import metadata for status and publish information as well as key fields for data to perform 3-way comparison!

28 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated ACL ACL Exchange (AX) How to Export to Results into ACL :

29 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated ACL ACL Exchange (AX) How to Export to Results into ACL :

reconciliations are performed each day: 1) Ensures all of today s exceptions were properly published in Results 2)

30 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated Two reconciliations are performed each day: 1) Ensures all of today s exceptions were properly published in Results 2) Cumulative reconciliation ensures all unresolved exceptions are still open in Results>>Improper closures will re-publish!

31 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated Various methods are possible to notify Analytic Owners of New : 1. GRC Notifications and Custom Triggers 2. NOTIFY command within AN

32 Fundamental Steps of the CCM Program Import Data from Source Systems into ACL Perform JOINs and EXTRACTs Perform Data Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated Each day CCM Program examines all open exceptions on Results and auto-closes those that have been resolved (no longer exceptions from the analytic). Each day, deemed corrected by the 3- Way compare, are flagged with AC/DC Status and AC/DC Comments and re-exported from AN to Results for the ExceptionID to refresh these fields. Then a Trigger automatically Closes the!

33 Return on Investment (ROI) with ACL

34 ROI with ACL Control Assurance: Converted ~ 30% manual SOX/ICFR controls to become automated controls via CCM Program (97 analytics) ACL Process Improvement: Process owners utilize CCM analytics that prevent issues (i.e. pre-bill verification before loading IT system) ACL Exchange (AX) CCM controls drives higher degree of control precision by removing sampling risk (population testing & monitoring) CCM engine Importing of systems data Performance of analytics Daily CCM identifies exceptions before they impact the financial reporting at EOM. Controls monitoring possible in an automated and comprehensive fashion Proves that controls are working while at same time illustrates exceptions to be remediated ACL Results Scheduling of the ACL routine The CCM analytic becomes an automated control replacing manual controls SOX/ICFR Program saving hundreds of hours of avoided testing of manual controls (ACL analytic test of one ) Website Repository of exceptions and alerts Workflow management External and internal audit reliance on analytics saving valuable audit hours

35 Next Steps in our Journey

36 Developing Questionnaires Guided by Triggers for Enhancing Workflows ACL Exchange (AX) CCM engine Importing of systems data Performance of analytics Scheduling of the ACL routine ACL Results Website Repository of exceptions and alerts Workflow management

37 Developing Questionnaires Guided by Triggers for Enhancing Workflows ACL Exchange (AX) CCM engine Importing of systems data Performance of analytics Scheduling of the ACL routine ACL Results Website Repository of exceptions and alerts Workflow management

38 Developing Questionnaires Guided by Triggers for Enhancing Workflows ACL Exchange (AX) Scheduling of the ACL routine ACL Results Website Repository of exceptions and alerts Workflow management

Developing Questionnaires Guided by Triggers for Enhancing Workflows Fields from the Questionnaire Scheduling of the ACL routine ACL Results Website

39 Developing Questionnaires Guided by Triggers for Enhancing Workflows Fields from the Questionnaire Scheduling of the ACL routine ACL Results Website Repository of exceptions and alerts Workflow management Questionnaire responses populate Exception tables for driving Analysis and Triggered Actions

Siemens has been recognized in the CCM community by Rutgers University & AICPA as noted in the Case Study published by the

40 Siemens Financial Services, Inc. in AICPA Publication Case Study A: Developing Continuous Assurance at Siemens ACL Exchange (AX) Scheduling of the ACL routine Siemens has been recognized in the CCM community by Rutgers University & AICPA as noted in the Case Study published by the AICPA ACL Results Website Repository of exceptions and alerts Workflow management Source:

41 Questions

42 Fundamental Steps of the CCM Program ACL ACL Exchange (AX) Import Data from Source Systems into ACL Perform JOINs and EXTRACTs CCM engine Importing of Perform systems Data data Performance of analytics Scheduling of the ACL routine Publish to Results Manager Perform Publishing Reconciliations NOTIFY Control Owners of New Auto Close Remediated ACL Results Website Repository of exceptions and alerts Workflow management

43 Thank You! Jason A. Gross, CPA, CIA, CFE, CISA, ACDA Robert Luu, ACDA

The Road to Continuous Assurance. Jason A. Gross, CPA, CIA, CFE, CISA, ACDA Vice President, Controls Management Siemens Financial Services, Inc.

The Road to Continuous Assurance Jason A. Gross, CPA, CIA, CFE, CISA, ACDA Vice President, Controls Management Siemens Financial Services, Inc. Agenda Key Drivers for Successful Implementation Technology