Board Audit Committee Training Automation of Audit Function. Anthony Wanyoike TeamMate Consulting East, Central & West Africa

Transcription

1 Board Audit Committee Training Automation of Audit Function Anthony Wanyoike TeamMate Consulting East, Central & West Africa

2 Agenda 1. Automation of Audit Function Steps of developing automated Audit Operational data, data access & Audit apps

3 Part 1 Steps of developing automated Audit

4

5 What comprises Audit Function - Ecosystem Audit Analytics Controls

6 Lines of Defence Relationships 2 nd Line (Risk & Internal Controls) Risk & Control Assessment Library Source Audit Universe Risk Assessment 3 rd Line (Audit) Self-Assessment Audit Plan Functions that provide Risk Management & Compliance Testing Certifications Users Taxonomy Issue Tracking Resourcing Audit Execution Audit Reporting Functions that Provide independent assurance Dashboards

7 Manual Audit Files Word/Excel Evidence in hard copy Hard Copy review Decentralization Distributed work papers Manual follow-up/tracking Physical Cabinets to store audit files Lots of printing cost issue! Physical BAC reports!!

8 Key Audit challenges! Which areas of the organisation should be audited? How to provide visibility on Audit activities. Easy access to audit reference documentation. Efficient and consistent execution process (what do I have to do next and how?) Objectivity of audit findings; supporting documentation easily available and traceable. Efficient off-line working. Documenting audit and committee reports.

9 Automation of Audit Function - Tools To achieve new heights, finding the right balance of audit tools is essential. Audit Management Systems Controls Management Systems Data Analytics

10 3 key drivers for Audit Automation Instant audit report Audit committee reports Efficiencies

11 Efficiencies to the Audit Process Spend 28% more time auditing (value added Auditing auditing) and less time documenting and reviewing Documenting 33% 11 10% 9% 3% Review 6% Report Preparation 4% 7% Other 50% of your time is spent documenting and reviewing workpapers and preparing the report Planning Travel & Meetings Scheduling & Timekeeping On average, users experience productivity gains of 20% - 25% in the first year of Automation.

12 Why Automate? Compliance with IIA Standards 2007 IIA Emerging Issues report included these recommendations following from results of external QA reviews Formalize the annual audit planning and risk assessment process Use metrics to compare actual use of resources to the budget Develop and enforce working paper standards, including sample formats, documentation requirements, indexing, and cross-referencing techniques with sufficient flexibility to serve as guidance for all types of audits, reviews, and evaluations Enhance supervision of auditors by conducting/documenting reviews of audit work and results at key milestones rather than just at the end of the engagement Improve the timeliness of audit reports Audit management systems can contribute to addressing these recommendations 12

13 Why Automate? Cont d Add efficiencies and effectiveness in the following activities Risk Assessment Planning Working papers/files Reporting Time and Expense Capture Project Tracking Issue Tracking and Follow up Data mining Increasing efficiencies will reduce audit reporting cycle time 1 Drive standardization and consistency throughout the audit process 1 1 PwC 2011 State of the Internal Audit Profession study 13

14 Key Benefits to Automation Audit process Risk Assessment Targeting & Resourcing Audit execution Audit committee & management reporting Issue tracking and knowledge management Risk Assessment Identify risks & controls Risk profile reports Self-assessments Build audit plan Electronic Working Papers Audit templates drive consistent methodology & improve efficiency Follow best practice to assess and test controls Document results & issues consistently Review work Generate audit report at the click of a button Share Knowledge Issue Tracking/Follow-up Monitor and follow-up issues Help auditees to take responsibility for implementation tracking Produce Audit Committee reports Monitor and improve performance Questionnaire Planning & Scheduling Gantt based audit scheduling Find right auditor for the job Maximise utilisation Time & Expense Sheets Time and Expense Capture. Manage budget versus actual time and expenses Library Communicate best practices Re-use and evolve the audit approach Share knowledge

15 Automation Success Factors Management Support Training (Knowledge on using the tool) Automation Success Factors Getting the right tool Technology Champion

16 Key Success Factors a 5-STEP Strategic framework 1. Convey the right Tone at the Top 2. Make technology use a high priority or even compulsory 3. Selectively hire technology-skilled people 4. Train, train, train then train some more 5. Measure what really matters because what gets measured gets done

17 1. Convey Right Tone at the Top Single biggest factor for enhancing technology effectiveness is strong support from the CAE (Chief Audit Executive)/ Director Audit Another Key Factor: Openness to Change

18 1. Convey Right Tone at the Top Effective CAE leadership is essential for internal audit to have a good relationship with management IA needs management support to get the budget needed to implement a technology strategy Inadequate budgets: Second most frequently cited barrier to achieving greater success with technology, according to TeamMate survey respondents IA needs effective leadership to address this potential barrier

19 1. Convey Right Tone at the Top CAE leadership can provide clarity about the benefits being sought from technology The CAE, using clear communications, can help members of the internal audit staff understand the anticipated benefits from technology, starting with more efficient audits Conducting more efficient audits: Most sought-after benefit of technology, by far Our top benefit, say 64% of survey respondents #2 Improve issue tracking #3 Improve the quality and consistency of audits #4 Improve risk assessment process

20 2. Prioritize Technology Use Make technology use a high priority or even compulsory It is imperative that the audit staff both understand and use the technology tools on every audit Technology use needs to be an expectation as opposed to a nice to use.

21 3. Hire Technology Skills Selectively Inability to dedicate sufficient staff to technology activities and the lack of technology skills the most cited barrier to leveraging technology To address these obstacles: a.) hire outside talent with strong technology skills to jump start major technology initiatives b.) establish a technology champion within your department c.) partner with IT to create value d.) tap outside resources to expand expertise TeamMate Observation: The ability to hire people with significant technology skills is challenging in today s operating environment: Technology talent is likely to remain in short supply Adequate budgets can be difficult to obtain

22 If you do not have a Technology Champion, why not? A. Budget limitations B. Staffing limitations C. Haven t considered it before now D. Don t consider it necessary

23 If you have a Technology Champion in your internal audit group, is that position a full-time or part-time position? A. Full-time B. Part-time

24 Invest Wisely

25 Benefits of the TC Role Survey results and individual interviews confirm that organizations that have established the TC position see direct benefits Creating a TC position: o Helps enhance the overall internal audit process o Provides a single point of focus and contact for technology o Provides forward-thinking, strategic thinkers Note: Some organizations also report measurable improvements in their audit processes in terms of productivity and audit plan completion

26 IA Management Perceptions of TCs More than one third are viewed as a key strategic player or a key member of IA management The majority of TCs are viewed in various roles that are technical in nature *

27 IA Management Perceptions - Communication is Key

28 4. Train, train, train Training does more than any other practice to help utilize technology more effectively.

29 Which best describes your department? Few staff are proficient with the technology we use 2. Most staff are proficient with the technology we use 3. All staff are proficient with the technology we use 16% 63% 21% 21% 16% 63% Few staff are proficient with the technology we use Most staff are proficient with the technology we use All staff are proficient with the technology we use

30 Which best describes your department s approach to technology training? % 32% 1. Formal instructor led training provided by outside party 2. Formal training by existing members of the department 3. on-the-job training 6% 32% 63% 63% Formal instructor led training provided by outside party Formal training by existing members of the department on-the-job training

31 5. Measure what Matters Measure what really matters because what gets measured gets done Performance Measures Take on New Importance Some internal audit groups have implemented performance measures to assess the nature and extent of their technology utilization. A solid program of performance measures may be the missing link to enhance technology effectiveness. survey responses: 76% rate their own performance measures as inadequate, marginal or adequate Metrics can include: Length of Audits pre and post technology Days to issue report Timeliness of issue follow-up Time to prepare audit committee reports Timeliness of audit file review QAR results 80% lack performance measures to know how effectively they are leveraging technology 73% do not track or measure the extent to which they utilize technology to perform audits

32 Our chief barrier to making more effective use of technology is: 1. An inadequate budget 2. Lack of technology skills/training 3. Insufficient focus on technology within the department 4. Inability to make a compelling cost/benefit justification 5. Lack of reasonably priced, effective technology tools in the market 6. Inability to dedicate sufficient staff to technology related activities 7. Inability or unwillingness to reengineer cost internal audit processes in order to leverage technology effectively 2016 An inadequate budget 20% 20% Insufficient focus on tec... Lack of technology skills/... 17% 12% Inability to make a compe... 8% 8% Inability to dedicate suffi... Lack of reasonably priced... 10% 25% Inability or unwillingness... 9% 9%

33 Relative to the overall use of technology by our organization, the audit group is? 1. Viewed by the organization as making very effective use of technology 2. About on par with the organization as a whole 3. Making progress, but failing to keep up with the technological advancements of the parent organization 4. Significantly falling behind the overall technological advancements of the parent 28% 59% 12% 1% % 1% 59% 28% Viewed by the organization as making very effective use of technology About on par with the organization as a whole Making progress, but failing to keep up with the technological advancements of the parent organization Significantly falling behind the overall technological advancements of the parent

34 Where is technology usage expected to increase the most in the next two years in your department? 1) Data Analytics 2) Risk Assessment Tools 3) Issue Tracking / Follow-up Tools 4) Continuous Controls Monitoring Tools 5) Audit and Resource Scheduling Tools 6) Electronic Workpapers 7) Audit Technology extended to Mobile Device / Smart Phones

35 Where is technology usage expected to increase the most in the next two years? Data mining despite its widespread use, is a relatively new practice for many organizations. Risk Assessment was #1 and Data Analytics was #2 last year

36 Pace of Technology

37 Part 2 Operational data, data access & Audit apps

38 What is Data Analytics? Data analytics is an analytical process by which insights are extracted from operational, financial, and other forms of electronic data internal or Data external analysis to the as organization. used by internal These auditors insights is the can process be historical, of identifying, realtime, or gathering, predictive Data analytics and validating, is can defined also analyzing, be as risk-focused the process and interpreting (e.g., of inspecting, controls various cleaning, effectiveness, forms of data fraud, within waste, transforming, abuse, organization and policy/regulatory modeling further data noncompliance) with the purpose the goal and of or highlighting mission performance of internal useful focused auditing. (e.g., information, increased suggesting sales, decreased conclusions, costs, and improved supporting profitability) decision making. and frequently - IIA Various Global Sources Technology provide Audit the Guide how? 16 (Data and Analysis why? Technologies) answers to the initial what? questions frequently found in the information initially extracted from the data. - KPMG

39 IIA Standards and Data Analytics Standard 2300: Performing the Engagement Internal auditors must identify, analyze, evaluate, and document sufficient information to achieve the engagement s objectives. Standard 2310: Identifying Information Internal auditors must identify sufficient, reliable, relevant, and useful information to achieve the engagement s objectives. Standard 2320: Analysis and Evaluation Internal auditors must base conclusions, and engagement results on appropriate analyses and evaluations. Standard : Analytical Procedures Internal auditors may use analytical procedures to obtain audit evidence. Analytical procedures involve studying and comparing relationships among both financial and nonfinancial information. The application of analytical procedures is based on the premise that, in the absence of known conditions to the contrary, relationships among information may reasonably be expected to exist and continue. Examples of contrary conditions include unusual or nonrecurring transactions or events; accounting, organizational, operational, environmental, and technological changes; inefficiencies; ineffectiveness, errors; fraud; or illegal acts.

40 Example Areas of Focus for Data Analytics Audit Area per Internal Audit Plan Improve Audit Efficiency Ensure Financial Integrity Contribute to Operational Excellence Improve Cash Flows Promote Governance, Risk, and Compliance Purchase to Pay High Potential High Potential High Potential High Potential High Potential Order to Cash High Potential High Potential High Potential High Potential High Potential Treasury Moderate Potential High Potential High Potential Moderate Potential High Potential Inventory Mgt High Potential Moderate Potential Moderate Potential High Potential High Potential Payroll and Benefits High Potential Moderate Potential High Potential Moderate Potential Moderate Potential Fixed Assets High Potential Moderate Potential Moderate Potential High Potential Moderate Potential Financial Close High Potential High Potential High Potential Moderate Potential Moderate Potential

41 Operational Data: Data Volume Concern: Ever-increasing volumes of data More data being created than ever before New systems coming online generating new data sources Pressure to increase scope of reviews Sampling not effective Time consuming Very low coverage Traditional audit methods no longer appropriate in a computerized world

42 Data Access

43 Data Access - Six Step Process 1. Scoping Data 2. Acquiring Data 3. Data Preparation 4. Testing Data 5. Analyzing Results 6. Reporting Results

44 How data analytics helps Audit huge transaction volumes as quickly as testing a single transaction Reduce time consuming tasks and free up resources Manual testing Sample checking Document hunting Ticking & Bashing New testing capabilities Facilitates continuous auditing/monitoring

45 Rate your department s level of performance in effectively using data analytics A. Excellent B. Adequate C. Somewhat Adequate D. Inadequate 10% 15% 25% 50% Excellent Adequate Somewhat Adequate Inadequate

46 Which factor do you believe is the biggest impediment to gaining more value from Data Analytics? A. A shortage of requisite skills B. Inability to gain direct access to data C. Inability to understand data once available D. Concerns about data quality, format or integrity E. Lack of strong support from management and IT F. Lack of time to pursue data analytics

47 So, why are we not using analytics to their full potential?

48

49

50

51

52

53 The tool is just 1 factor

54

55

56

57

58

59

60

61

62

63

64

65 In Summary

66 Audit Automation Apps Workpapers TeamMate Audit Management System Mk Insights Pentana MetricStream AutoAudit ACL GRC Auditol Auditor Assistant Magique Galileo Audit System SAP

67 Audit Automation Apps Analytics TeamMate Analytics IDEA ACL Active Data