Internal Audit and Technology Sustainable Analytics

Internal Audit and Technology Sustainable Analytics Neil While, Partner, Internal Audit Analytics Deloitte Advisory December 14, 2015 0

Survey Results 74 organizations were included in the survey, predominantly in UK. 3

Maturity of internal audit analytics Is the profession fully developed, or is it still early days? 74% of firms surveyed are in limited and developing maturities categories 4 Copyright 2015 Deloitte Development LLC. All rights reserved.

Maturity of internal audit analytics What proportions of audits are supported by analytics? An average of 24% of audits are supported by analytics across participants Advanced firms are supporting 43% of the audit plan, whilst developing firms are supporting 21% Advanced firms are using statistical platforms such as SaS, SPSS and R 5 Copyright 2015 Deloitte Development LLC. All rights reserved.

Maturity of internal audit analytics How much budget is spent on analytics? Advanced analytics teams are on average 3% of the total internal audit function cost, whilst developing are on average 6% 6 Copyright 2015 Deloitte Development LLC. All rights reserved.

Aligning delivery approach to strategy What are analytics teams striving for? Two strategy outcomes for analytics were identified from survey participants: To create efficiencies for internal audit through automation; or Analytics driven insights 7 Copyright 2015 Deloitte Development LLC. All rights reserved.

Leading Practices What do the leading companies do well? Buy-in from senior stakeholders Analytics team integrated in to internal audit function Investment in skills of the analytics team Identify solution to data issues Leveraging analytics capabilities across the business 8 Copyright 2015 Deloitte Development LLC. All rights reserved.

Future ambition What are the ambitions of the leading firms? Analytics to be a core element of internal audit process Driving the audit plan through continuous risk assessment Targets of 70% of audits to be supported by analytics Big Data Research and development teams Developing basic analytics capability of core business auditors 9 Copyright 2015 Deloitte Development LLC. All rights reserved.

Sustainable Analytics Based on a strong foundation of people, process, and technology, sustainable analytics will drive value for internal audit 10 Copyright 2015 Deloitte Development LLC. All rights reserved.

Planning the journey, cont. Key Questions to Ask Building Blocks Key Questions to Consider Strategy Process Data People Technology Analytics vision for audit services Identifies key projects/programs, stakeholders and metrics Aligned with corporate and information technology strategies Organizational structure and program sponsor/manager Capability / competency acquisition or development Collaboration and communication planning Operating model for developing and consuming insights Analytics prioritization and project management Methodologies and approaches for analytics Solution requirements, evaluation, selection and set-up Technology vendor / license management Technology architecture and solution optimization Data acquisition and enrichment Data model architecture Data governance and security S P P D T Building a sustainable analytics function requires a foundation of the fundamental building blocks of People Process, Data and Technology, informed by an Analytics Strategy. Who is the accountable IA owner? What organisational structure do we need to put in place to support our analytical strategy? Who do we need to engage in other departments and what are their roles? What other talents do we need and what is the plan for getting them? How do we identify the right projects on which to focus our efforts? What are the steps we need to take to ensure that these projects are a success? How will we comply with relevant regulations? What are the risks and how do we mitigate them? How will we measure our progress and test the validity of the insight? What data do we need to answer the business questions? From where is it sourced internal, external, licensed, open? How do we bring it together and what are the challenges in transforming, linking and publishing it? What about quality and accuracy? What tools do we need to process the data? How do we scale up the technology when we need to roll out our solution to the rest of the business? 11 Copyright 2015 Deloitte Development LLC. All rights reserved.

Purple People Technical skills Data analysis Testing Defining, developing and implementing quality assurance practices and procedures for technical solutions and validating hypotheses. SQL querying Querying and manipulating data to facilitate the solving of more complex problems Data modelling Structuring data to enable the analysis of information, both internal and external to the organization Data analysis skills Evaluating data using analytical and logical reasoning for the discovery of insight, e.g. predictive modelling Reporting software Understanding of the underlying theory and application of key reporting software Technology alignment Understanding how technology can be leveraged to solve business problems Macro-perspective Understanding of the organization strategy, current issues and priorities and current trends Business knowledge Understanding of business measurement of key performance indicators and business frameworks. Business commentary Articulation of insight to explain current and forecasted trends, their impact and opportunities for the organization Soft skills Communication and interpersonal skills are necessary to articulate insight gained from analysis Business acumen Storytelling 12 Copyright 2015 Deloitte Development LLC. All rights reserved.

Operating Models Business area Analytics project Corporate centre Function unit Analytics project Dispersed model Department driven for organisations with minimal overlap of analytics requirements across departments De-centralised CoE Analytics project Corporate centre Business area Function unit CoE model Functional driven with overlap of analytics requirements across functions and the need to drive standardisation Analytics unit Analytics project Corporate centre Business area Function unit Centralised model A group of analysts, acting as a core unit, serve the entire company cross functional boundaries. Centralised = Analytics capability 13 Copyright 2015 Deloitte Development LLC. All rights reserved.

Selecting the right areas to focus on Value drivers Assessment framework Strategic risk alignment Cost reduction Understanding the Data Value High value and Low risk should be top priority Reasonable return on investment should be prioritized Capability build Identify risk Reasonable return on investment and should be prioritized High risk with too Low value to be prioritized Protect brand Risk 16 Copyright 2015 Deloitte Development LLC. All rights reserved.

A noticeable ROI from advanced analytic techniques is the reduction in cost, time and effort, to review transactions and assess if they are truly of concern Model maturity development 99.99% 99.5% 99.25% Random Sampling General Rules Tailored Rules False positive rate 60% 30% 25% Risk Aggregation Profile Risk Aggregation Machine Learning 0.01 0.5 0.75 40 60 75 100 Unusual transactions identified per period 18 Copyright 2015 Deloitte Development LLC. All rights reserved.

Data Visualization Data visualisation focuses on presenting data in the most meaningful way, for quick delivery of insight to support decision making or convey a message. It involves making best use of graphical means to reinforce the message and facilitate understanding of insight. With technological advances that make it easier to routinely collect enormous amounts of data, there is an ever increasing need to understand large volumes of information at once. As Internal Auditors we need to find ways to communicate to garner greater business support and help the business transform and better manage risk. 19 Copyright 2015 Deloitte Development LLC. All rights reserved.

About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee ( DTTL ), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as Deloitte Global ) does not provide services to clients. Please see www.deloitte.com/about for a detailed description of DTTL and its member firms. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting. Copyright 2015 Deloitte Development LLC. All rights reserved. 36 USC 220506 Member of Deloitte Touche Tohmatsu Limited