5th CAE Annual Conference

Transcription

1 5th CAE Annual Conference 6 7 December 2015 Lead to Innovate, Innovate to Lead Data-Enabled Auditing Thomas Pulling

2 Data-Enabled Auditing

3 Welcome and introduction 3

4 Introductions Thomas Pulling Background Leading Data-Enabled Auditing in the IT Risk Assurance practice of in the Middle East Provides IT risk consulting services to a wide range of global and local clients Knowledge and experience of multiple industries, including utilities, petrochemicals, oil & gas, logistics and automotive Experience in business operations, data management and assurance activities Area of Expertise and Skills ERP and GRC solutions with a focus on security and controls Data analysis such as process mining and process utilization Data visualisation using QlikView Internal Controls and financial audits 4

5 Agenda 1. Introduction 2. Data and the megatrends why data is so important to Internal Audit today and in the future? 3. Data Analytics Maturity Curve assessing the effectiveness and value of data analytics 4. Maturity Assessment exercise where do you think you are? 5. Using data analytics in Internal Audit what does good look like? 6. Questions and answers 7. Wrap up and close Feel free to ask questions at any time 5

6 Data and the megatrends Why data is so important to Internal Audit today and in the future? 6

7 The new trust dynamic By building trust you will be able to maximise your growth potential and manage the risks in the opportunities available in the digital age. Opportunity Social media Mobile Analytics Cloud Hyperconnectivity Digital identity Speed of change 7

8 Megatrends technological breakthroughs Do you know what data you have? How are you using your data? 7

9 State of IA Profession 2015 Risk focus, alignment across the lines of defense, talent and data analytics are seen by CAE s and stakeholders alike as significant factors enabling internal audit to contribute to strategic initiatives. N Significant factors enabling internal audit to contribute to strategic initiatives 88% 91% A focus on the right risks at the optimal time in the process 57% 63% 53% 54% The talent and business acumen to be relevant and offer valuable insights 34% 32% Stronger alignment with ERM and other line of defense Proficient use of data analytics to provide powerful insights into the business Risk focus Talent Business alignment Data Internal audit functions adding significant value All other internal audit functions 8

10 Data Analytics Maturity Curve Assessing the effectiveness and value of data analytics 10

11 IA Delivery efficiency Value to organisation Business enabler Analytics maturity model The analytics maturity model represents how the effectiveness and value change as the data analytics maturity of the Internal Audit function increases. Auditing is performed using observation, walkthrough or hard copy documents. Audit sampling is statistical and/or judgmental. IA function own analytical tools such as IDEA or ACL Analytics. Bespoke analytics are run on a one off basis to address specific audit requirements. Analytical scripts are automated and standardised for specific reviews. Opportunity to utilize analytics is part of scoping for every IA review. Specialist staff support extraction and analysis of data. A physical and logical repository linked to key systems is accessible to only internal audit. Overlay with dashboards and alerts to enable IA to monitor exceptions and hot spots on a continuous basis. Key input in defining and updating the IA plan. Automated controls are monitored on a real time basis. Responsibility to operate the programme typically rests with the business. Control weaknesses are identified and remediated in a real-time manner. Extensive data structures are dissected within a tool to understand activities. Normality is learned on demand using scenarios to train the tool. Exceptions to patterns and subtle risk concentrations are exposed. Proactive and predictive actions taken. Manual Internal Audit function Piloting and ad-hoc Sustainable and periodic analytics Continuous auditing Continuous transactional monitoring Predictive analytics Reactive Effectiveness in monitoring of key risks Predictive 10

12 Results from other regions Manual IA function Piloting and ad-hoc Sustainable and periodic analytics Continuous auditing Survey results suggest no clients are yet delivering continuous auditing 22% 67% 11% 0% Internal Audit are focusing on several drivers with 100% sampling and credibility in the business being priority Cost reduction Global coverage Benefits of full populations for data Credibility Insight Benchmarking Fieldwork focus Availability of tools Business demand Current Driver Future Driver 12

13 Maturity assessment exercise Where do you think you are? 13

14 Maturity assessment exercise We need 3-4 volunteers who would be happy to talk about their Internal Audit function and respond to the following maturity assessment questions What are your core IT systems? (Examples are SAP, Oracle, Hyperion) Have you used data analytics in your Internal Audit function? Where do you plan to use data analytics in the future? Where are you on the analytics maturity model? How are you planning to organise your IA data analytics function? What sort of tools are you using? (Examples are ACL, IDEA, SQL) What benefits do you see from using data analytics? What are the likely barriers to using data analytics? 13

15 Using data analytics in Internal Audit What does good look like? 15

16 Internal Audit data analytics framework Continuous improvement Strategy & vision Operating model What do we want to achieve and how will we measure success? How should we structure ourselves (geography / functional)? Performance monitoring People, capability management and training What people, skills and training do we need? Technology and tools What tools do we need for analytics and reporting? Methodology, policies, standards and processes How should we manage and execute our audits? 15

17 What is required? Smart People Make the best use of resources you have Empower the team with skills and technology to make more informed decisions Free up the team to focus on adding even more value to the business Smart Approach Focus the internal audit process to add value using advanced tools Leverage top down and bottom up approaches to risk assessments Streamline the audit process and better manage interaction with management Smart Technology Appropriate level of data analytics and data integration techniques to provide insight on operations Tools to underpin a continuous monitoring process Smart People Smart Approach Smart Technology Smart Audit 16

18 Data analytics in the audit lifecycle You can increase the value of data analytics to your Internal Audit process by leveraging data in every aspect of the audit lifecycle. Planning Analytics Risk Assessment Analyse historical trends to provide insight to business risks. Planning Baseline process performance and determine the effort required by reviewing performance KPIs. Risk Assessment Planning Scoping For each risk identified, consider whether a data analytic could streamline the work. Internal Audit Methodology Full data extraction Fieldwork Analytics drive more targeted questioning and any required scoping changes before fieldwork. Reporting Reports will be more succinct but at the same time more information rich. Monitoring Use the results of the audit to refine the analytics that can be continuously monitored. 17

19 Questions and answers 19

20 Appendix Examples of data analytics solutions 20

21 Procure to Pay process mining map Invoices received without an invoice could be services or a breakdown in controls. This suggests a breakdown in control as payments have been made without invoices. Goods have been received without a PO being in place indicating the three way match may be ineffective. Many invoices not received for GRNs suggests 3-way match tolerances could be too restrictive. 21

22 Process mining The process view is over twice stock days suggesting this flow is inventory not expected to remain in stock. The proportion of items sold compared to inbound stock suggests overbuying or poor performance. The policy for received stock is to inspect on arrival. This flow shows the items violating this control. This flow shows a high level of returns indicating supplier performance is very weak. Only a small proportion of inventory classed as fast moving was sold suggesting classifications are incorrect. 22

23 Data visualisation 21

24 Examples of analytics in the lifecycle 1.Risk Assessment: Utilise data and KPIs to perform an innovative risk assessment to understand the way the business operates. 4.Reporting: Visually support findings related to performance against KPIs. 2.Planning/Scoping: Create clearly-scoped audit objectives using key risk/performance indicators. 3.Fieldwork: Target outlier transactions using a risk-based approach to replace traditional sampling procedures. 24

25 Thank you for attending This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, PricewaterhouseCoopers does not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it PricewaterhouseCoopers LLP. All rights reserved. refers to the UAE member firm, and may sometimes refer to the network. Each member firm is a separate legal entity. Please see for further details. 25