Internal Audit Analytics Advantages and Challenges

Transcription

1 Internal Audit Analytics Advantages and Challenges

2 Hello! I am Ziad El Haddad Director with Deloitte & Touche (M.E.). Leading Cyber & Technology Risk services in Abu Dhabi and Data Risk Services in the Middle East You can find me at: zhaddad@deloitte.com

3 1. Analytics: An Overview

4 Increasing importance of Analytics Analytics is not a new concept Analytical computing capacity and analytical tools have evolved It is When? data-driven processes is a revolution in the way companies do business Decision makers need more powerful tools for uncovering hidden patterns that can go undetected.

5 Big Data, Data Analytics, Business Analytics, Risk Analytics.What they have in common? Better decision making Uncover hidden insights Cost reduction Mobility Common Fallacy same skillsets and investment

6 Internal Audit powered by Visualization (1/2)

7 Internal Audit powered by Visualization (2/2)

8 2. Internal Audit Analytics

9 The world as we have created it is a process of our thinking. It cannot be changed without changing our thinking. Albert Einstein

10 Internal Audit through Analytics The Past Reactive / Detective Control based Financial & Compliance Findings identification IA Responsibility Sampling Today the Future Proactive / Preventive Risk based Enterprise risks Consultancy & advisory Organizational responsibility Increased assurance

11 Desired objectives and benefits Audit Quality Better Assurance More robust and challenging More credible findings More confidence and impact Audit Efficiency Automation Speed of execution Delivery of findings Cost reduction Business Value More insightful More visual outputs Control culture evolution Insightful strategies and investment decision Forward Looking Perspective Proactive monitoring Continuous improvement Greater Risk Emphasis Proactive Risk Management

12 Pick battles big enough to matter, small enough to win. Jonathan Kozol

13 Solving the data problems (1/2)

14 Solving the data problems (2/2)

15 There is nothing so terrible as activity without insight Wolfgang von Goethe

16 Reducing false positives with advanced Analytics A noticeable ROI from advanced analytic techniques is the reduction in cost, time and effort, to review transactions and assess if they are truly of concern Model maturity development 99.99% 99.5% 99.25% Random Sampling General Rules Tailored Rules False Positive Rate 60% 30% 25% Risk Aggregation Profile Risk Aggregation Machine Learning Unusual Transactions Identified per period

17 3. How to embark?

18 Key components of an analytics program Vision CAE sponsorship Vison for IA in 3-5 years Aligned with enterprise data and technology strategies Identifies key pilots Consider innovation and transformation People Identify IA owner Setup an organizational structure to support your analytical strategy Align talents required to meet the vision Identify who to engage in other departments and define their roles Analytics Program Technology Vendor selection based on vision and enterprise wide technology /BI strategy Data Visualization and Dynamic reporting must have Data and technology landscape of the enterprise needs to be understood Process Identify the right projects (likelihood of success and value) Pilot evaluation on 2-3 audits Adopt a method (e.g. CRISP- DM) Measure progress

19 Define current and to-be state

20 Establish the operating model New Audit Interaction Model Traditional Audit Steps Confirm Audit Objectives / Scope Develop Enhanced Audit Scope Audit commences Test key hypothesis Communicate results Identify Potential Analytics Extract, transform, and load data Integrated Data Analytic Steps Analyze data; compare, profile, visualize Brainstorm with Audit team and develop Testing Hypothesis Audit sampling, continue to support and iterate on hypothesis Visualize and story board results Critical new interactions the process

21 Multi-disciplinary approach Subject Matter Specialists Integrated Approach Core internal Audit Data Analytics

22 Multi-dimensional Team

23 Competency Model Competency Definition Data Analyst Engagement of Data Advocates Project Management Understanding Business Processes and Systems Data Collection Data Transformation Analysis Programming Develop Data Analytics Output Communicating Data Analytics Results Communicates with stakeholders to increase use of data analytics for internal audit over time. Manages project, subprojects, timelines, and resources to deliver exceptional service. Demonstrates knowledge of business processes and systems. Collects and monitors data needed to conduct analysis. Organizes, separates, and manipulates raw data into a format acceptable to perform analysis and modeling. Applies analysis and modeling techniques to test hypotheses and add insights into audit findings. Uses software development techniques in the data analytics process. Creates compelling deliverables describing data analytics results and procedures performed. Presents data analytics results and procedures performed in a coherent and effective manner to both technical and non-technical audiences. Data Specialist Data Analytics Manager Proficiency Level by Position Data Analytics Lead Auditor Senior Auditor Audit Manager Basic Expert Expert Expert Expert Expert Expert Basic Intermediate Expert Expert Basic Intermediate Expert Basic Intermediate Expert Expert Intermediate Expert Expert Expert Expert Basic Basic Basic Basic Basic Expert Expert Basic Basic Basic Basic Basic Expert Expert Intermediate Basic Basic Basic Basic Intermediate Expert Basic Basic N/A N/A N/A Intermediate Expert Expert Basic Basic Intermediate Intermediate Intermediate Expert Expert Intermediate Basic Intermediate Expert

24 4. Common pitfalls and Guiding Principles

25 Common pitfalls How to avoid them? Data completeness Failure to confirm data completeness though reconciliations Failure to challenge the business to enhance data capture Invest in understanding the data estate and end to end data flows thoroughly Tie in data to trusted, independent sources where possible Identify gaps and provide remediation plans for systems configurations, process change, control frameworks and data structure Data accessibility and availability Lack of visibility of the existence of enterprise data assets Data obtained in an ad-hoc fashion without creating a foundation for continuous audit Prioritise self-service, permanent connections to key data assets Where this is not possible, provide clear requirements for scheduled data extracts and perform testing prior to acceptance Ensure security controls are defined to protect sensitive data Data quality Limited understanding of data Poor quality data affects validity of results Failure to challenge the business to improve data quality controls Earn the right to use the data - build data quality checks into continuous audit / continuous monitoring analytics Use data profiling and visualisation of data to identify immediate data quality, completeness structure, consistency and logic issues Monitor the corrective actions and their impact on your business

26 Guiding principles Link Your Goals and Objectives with Clear Business Drivers Know Your Data Start Simple Leverage Existing Insights Establish a clear understanding of expected benefits from Analytics and ensure linkage to audit planning. This will translate into clear objectives that drive the strategy, long term vision and surface the near term opportunities. Data is the key ingredient. It drives the insights that fuel the benefits from any Analytics program. It is critical to understand both the data you have and the data you don t have when determining how and where you should begin. This knowledge also prioritizes efforts to collect what s missing for future analyses and enhancements to your Analytics program. There is no need to boil the ocean at the outset. Starting with a targeted, analytic program will yield greater benefits in terms of speed to insights, learning and value. Take the time to learn first and then deploy necessary capabilities across the enterprise later. When possible, leverage existing analytics capabilities (look within the business) to jump-start the program and build consistency with prior initiatives. These insights should also provide clues related to the risks and business areas to start with. Make It Actionable and Measurable Develop a plan to take action and measure results accurately early in the game. The organization, systems and process that support execution must be able to take action with the insights that are generated recommendations. Test and Learn Be willing to test different approaches and areas of the business. Learn from results and try new approaches based on what is learned.

27 Thanks! Any questions? You can find me at: