Automating Audit Analytics: The benefits, the concepts and the road to Continuous Auditing

Size: px

Start display at page:

Download "Automating Audit Analytics: The benefits, the concepts and the road to Continuous Auditing"

Georgina Stokes
6 years ago
Views:

1 Automating Audit Analytics: The benefits, the concepts and the road to Continuous Auditing

2 Agenda 1. Why automation for data based audits? 2. What options are available? 3. Automation Considerations 4. Automation Mapping processes 5. Automation Best Practice Principles 6. The future of Internal Audit? 7. Continuous Auditing or Continuous Monitoring?

3 Why automation for data based audits? 1. Standardised Approach / Consistency of delivery 2. Greater potential for 100% population testing 3. Ability to perform greater amount of analysis 4. Ability to analyse large and complicated systems and datasets 5. Can be used to apply policies that cannot be programmed into the underlying systems themselves (Virtual Preventative Controls) 6. Perform value added services to the business by providing solutions to business needs/issues 7. Move into Continuous Auditing/Monitoring looking at better identification of trends

6 What options are available? 1. Make use of existing ERP system reporting tools 2. Integrate Business Intelligence tools 3. Make use of existing desktop software 4. Purchase pre-defined audit analytics 5. Make use of Computer Aided Audit Tools and their automation functions 6. Consider a Continuous Auditing/Monitoring solution

7 Make use of existing ERP system reporting tools

8 Make use of existing ERP system reporting tools

9 Integrate Business Intelligence tools

10 Make use of existing desktop software

11 Options Discussed Solution Ease of Use Cost Repeatability Non programming based automation Cross System Analysis Data Integrity Audit Focused Capabilities ERP Reporting Tools Low Low/Medium High Low Low Low Low/Medium BI Tools Medium Medium/High High Low/Medium Medium/High Low Low Excel High Low Medium Low Low Low Low Access Low Low/Medium High Low Medium Low Low CAAT Medium Medium High Medium/High High High High

12 Computer Aided Audit Tools

13 CAATs Smart Analyzer

14 CAATs Smart Analyzer

15 CAATs Smart Analyzer

16 CAATs Smart Analyzer

17 CAATs Smart Analyzer

18 CAATs Smart Analyzer

19 CAATs Smart Analyzer

20 CAATs Smart Analyzer

21 CAATs Smart Analyzer Marketplace

22 CAATs Smart Analyzer SDK Do you have an idea? You can build an app!

23 Automation Process 1. Standard data request to aid data acquisition 2. Front end dialog for end user 3. Linking field names in source data to field names in automated routines 4. Selecting which tests to run 5. Enter parameters 6. Export of data into common formats or reports 7. Schedule when the routines will run 8. the exported results to the end user

24 Good News!! If you already have a Computer Aided Audit Tool you can

25 CAAT Automation 1. Visual Script 2. IDEA Script

26 CAAT Automation Visual Script

27 CAAT Automation IDEA Script 1. IDEAScript is a programming language similar to Visual Basic for Applications. 2. IDEAScript can be used inside the IDEA application or inside an application developed in a higher programming language, such as Visual Basic or Visual Basic for Applications. 3. As well as having the ability to be driven by other applications, can also drive other applications e.g. Word or Excel.

28 CAAT Automation IDEA Script

29 CAAT Automation IDEA Script

30 CAAT Automation IDEA Script

31 CAAT Automation IDEA Script

32 CAAT Automation IDEA Script

33 CAAT Automation IDEA Script

34 CAAT Automation but where do I even begin??

35 CAAT Automation Map the process 1. Purpose/Audience? 2. What tests do I want to automate? 3. Frequency of testing? 4. Source of data? 5. Structure and format of output reports? 6. Delivery? 7. Structure of macro?

36 CAAT Automation Purpose/Audience? 1. Audit? Basic data preparation script? End-to-end solution? 2. Value added service for the business?: Reviewed by the business? Reviewed by Audit as value added service?

37 CAAT Automation What tests do I want to automate? Could be based on: 1. Creating efficiencies within audit processes 2. Business areas in needed of more immediate assurance 3. Business areas with limited resource 4. Business areas in need of monitoring of indicators for improvement or deterioration of controls due to risk to revenue or reputation

38 CAAT Automation What tests do I want to automate? Analysis, Calculations, Exception Testing, Data Matching & Comparing, Gaps & Duplicates, Sampling Accounts Payable Analyse individual balances & turnover, Age Analysis, Duplicate payments/invoices. Purchases and Payments - Missing Goods Received Notes, Analyse purchase orders issued on non working days. Accounts Receivable Analyse average sales, Calculate day to payment, Compare balances to credit limits. Sales and Receipts - Analyse sales and profitability by area, salesperson, month, store, category, vendor. Creditors Ensure no payments are made to employees by cross-matching with the payroll database. Debtors - Stratify and analyse debit value by debtor amount, Test for duplicate debtor names and addresses. Fixed Assets - Recalculate expense and reserve amounts using replacement costs, Test for duplicate reference no s General Ledger - Total the balances to ensure they balance to zero, Provide detailed analysis of selected accounts. Inventory and Stock - Report on products in order of profitability, Identify surplus obsolete/damaged inventory. Payroll - Duplicate employees, Search for ghost employees, Starters and leavers analysis. IT Audit Analysing computer security, logs, firewalls, telephone logs, building access logs.

39 CAAT Automation Frequency of testing? 1. Hourly, Bi-daily, Daily, Weekly, Monthly, Bi-Yearly, Yearly? 2. What time of day? Anytime? First thing in the morning? End of day? Overnight?

40 CAAT Automation Source of data? j CAATs allows you to import and export data from and into a multitude of formats, including files originating from large mainframe computers and accounting software.

41 CAAT Automation Source of data? 1. Direct access to database (Open Database Connectivity (ODBC)) Data will not need to be requested quicker turnaround time Location of data in tables is unlikely to change Field names are unlikely to change Format of data is unlikely to change Revisions can be made by the scriptwriter rather than the person writing extracted reports As an alternative ODBC connections can be used to access Data Warehouses with compatible ODBC drivers

42 CAAT Automation Source of data? 2. Extracted files Data may need to be requested potentially slower turnaround time Extract may not be based on a saved template Fields may be missing Field names may change Format of data may change

43 CAAT Automation Structure and format of output reports? 1. Remediated by CAAT user: CAAT? Microsoft Excel? Text file (.csv,.txt )? Other format e.g. Print Report? 2. Remediated by non CAAT user: Microsoft Excel? Text file (.csv,.txt )? Other format e.g. Print Report?

44 CAAT Automation Structure and format of output reports? 3. Data view - Standard rows and columns view? Reduced number of columns? Reordered view of columns? Cleansed view of data Text conversion to uniform case, removal of double spaces? 4. Data view Graphical view? Pivot Table? Pivot Chart? Graph? Dashboard?

45 CAAT Automation Structure and format of output reports?

46 CAAT Automation Structure and format of output reports?

47 CAAT Automation Delivery? 1. Script opens final CAAT file at end of run 2. Script opens final CAAT dashboard at end of run 3. Script opens another application and presents final view e.g. Excel 4. Script s output file to another member of staff (requires 3 rd party software freeware available Blat, Chilkat, vbsendmail)

48 CAAT Automation Structure of macro? 1. Will the script be run manually or scheduled? Manually I. Front end GUI II. Message box prompts or input box information requests III. Dialogs to select input files IDEA or other IV. Optional Parameters e.g. codes or date ranges V. Link fields in data to variable names in macro using drop downs VI. List multiple tests and let end user choose which to run

49 CAAT Automation Structure of macro? 1. Will the script be run manually or scheduled? Scheduled ( Lights Out )? I. No longer can have front end GUIs, message box or input box prompts II. III. Required information will have to be hardcoded into the macro or into an editable file that can be changed and the macro can reference May need to liaise with IT to: Configure ODBC connections Create user accounts with required permissions Agree the best time to schedule the extracts

50 CAAT Automation Structure of macro? 2. Other considerations? Will you need to keep a historic file for certain tests to avoid reporting new and old results each run? Will this need to be manually or automatically maintained? Manually Excel file loaded back into CAAT and joined with new report items Automatically CAAT file kept and joined with new report items and historic file then becomes old and new items appended together

51 CAAT Automation Map Your Routine Start Enter Parameters User GUI Cancel Stop Select File(s) Cancel Stop Select Tests & Run Cancel Stop Import & Prepare Data Test 1 Test 2 Test 3 Test 4

52 CAAT Automation Map Your Routine Test 1 Prepare Data Extraction based on rules Zero Records Stop Match with historical file to find new items Zero Records Stop Create Exported File and to Reviewer Tidy up Data Project

53 CAAT Automation Create you routine 1. Write your routine 2. Test your routine 3. End user testing 4. Revision process 5. End user testing/revision process 6. End user acceptance 7. Fully document macro and procedure

54 The Future of Internal Audit? KPMG Transforming Internal Audit Report

55 CA or CM/CCM?? Definitions: Continuous Auditing: 20 year old term, Continuous auditing is an automatic method used to perform auditing activities, such as control and risk assessments, on a more frequent basis Continuous Monitoring/Continuous Controls Monitoring: Continuous monitoring is the process and technology used to detect compliance and risk issues associated with an organisation's financial and operational environment. Through continuous monitoring of the operations and controls, weak or poorly designed or implemented controls can be corrected or replaced.

56 The Future of Internal Audit? Controls Effectiveness Traditional Testing QA 1 6 Months QA 2 6 Months QA 3 6 Months QA 4 Actual Expected Effectiveness Time 18 Months

57 The Future of Internal Audit? Controls Effectiveness CM CM Continuous Monitoring CM CM CM CM CM CM CM CM CM CM Actual Expected Effectiveness Time 7 Days

58 Continuous Controls Monitoring A Continuous Controls Monitoring solution provides a single controls portal that enables all stakeholders within any organization to independently monitor controls and transactions across multiple businesses and systems. It is a solution that will enable you to: Get data from any source system Allow you to create your analytic process Apply your logic and business rules against the data Generate Exceptions based on the data and business rules Assign the exceptions against your Risk Matrix Assign the exceptions for action and workflow with Dashboarding

59 Continuous Controls Monitoring

60 Continuous Controls Monitoring

61 Continuous Controls Monitoring

62 Continuous Controls Monitoring

63 Continuous Controls Monitoring

64 Continuous Controls Monitoring

65 Where can Continuous Monitoring help? AML Compliance - Transaction monitoring, Know your customer, Suspicious Activities, Watch list searches, Remittances, Fund Transfers & Staff Monitoring Procure To Pay - Inventory Analysis, Invoicing, Payments, Purchasing, Receiving & Vendor Management Payroll Monitoring - Duplicates, Suspicious Activities, Overtime Exceptions & Master Data Exceptions Travel and Expense Monitoring - Improper Claims & Expenses (Duplicates, Airfare Claims, Car Mileage & Fuel, Accommodation & Meals, Suspicious Expenses), Policy Violations (Recording Approval, Disbursements) & Profiling (Spend, Vendor, Expense) Data Quality Management - Cross-Matching Data from Multiple Sources, Data Accuracy & Data Cleansing

66 Any Questions?

67 finally don t forget No matter what your job, you can always try to make it more interesting

68 Thank you for your time James Loughlin

Microsoft Dynamics 365 for Financials. CAPABILITIES GUIDE Fall 2016

Microsoft Dynamics 365 for Financials. CAPABILITIES GUIDE Fall 2016 Microsoft CAPABILITIES GUIDE Fall 2016 Microsoft THE BETTER WAY TO CONNECT YOUR BUSINESS Microsoft is a business management solution that s connecting people and processes like never before. From day one,