Institute of Internal Auditors: Philadelphia Chapter
2017 Spring Conference – Our Profession In Focus - 75 Years Strong
April 3, 2017
The Philadelphia Chapter was established in 1943, and is the 5th affiliate chapter of The Institute of Internal Auditors (IIA). The Philadelphia Chapter, its board of governors, its officers, The IIA , and today’s presenters are not responsible or liable for any acts or omissions and specifically disclaim any and all responsibility or liability for acts or omissions.
The material contained herein or communicated is for informational purposes only and should not be construed as accounting, financial, tax, or legal advice. Please seek guidance specific to your questions or concerns from qualified advisors.
All content including graphics or art work is protected by law and may not be duplicated in any form with out the express written permission from the Philadelphia Chapter.
weather analytics gave 36 minutes warning of a tornado using continuously monitored data from 5 miles above earth
VS: sometimes 0 to 5 minutes warning
3/27/2017
11
LEADS TO NEW BUSINESS NEEDS
How to clean up BIG Data?Controls and accuracy - needed for BIG DATA integrity ie: GIGO (GRC)
Conversion of unstructured data
How to better manage the business with BIG DATA?
IT TRENDS – BIG DATA
• First clean up data with CM-Continuous Analysis and CCM-T (GRC selling point)
– Improve efficiency & effectiveness with BPI-Continuous Business Process Improvement
– Better manage of business with BA BuisnessAnalitics; BI- Buisness Inteligence;
TECH CASES: ANALYTICS PROJECTS
CIO Unlocking Business Value through Analytics
• Billings for claims for use of a trademark: CM controls gains increased revenue improve profits
• Channel resellers – reverse engineer successful sales to increase sales – with predicative analytics
IA lead --Analyze and publicize discounts-MARGIN IMPROVEMENT=Loved by C level
3/27/2017
12
STREAM OF NEW BIG DATA COMPANIES
IIA CBOK 2015 PRACTITIONER SURVEY
• IIA Practitioner Survey Results– Survey completed April 1, 2015
– 14,518 usable survey responses
• Participation Levels– 100% representation from IIA institutes
– Responses from 166 countries
– 23 languages
2015 RESEARCH :STAYING A STEP AHEAD
INTERNAL AUDIT’S USE OF TECHNOLOGY
By Michael P Cangemi
Author – Managing the Audit Function; former CAE, CFO, CEO and AC
Chair
Available free of charge:
www.theiia.org/goto/CBOK
3/27/2017
13
IIA -STAYING A STEP AHEADINTERNAL AUDIT’S USE OF
TECHNOLOGY• Technology continues to evolve and
expand in finance, operations, and business systems. – Adding productivity and creating disruptions to
and new business models.
• IA/GRC responded by expanding IT training and adding IT audit functions.
KEY FINDINGS: TECHNOLOGY IN THE IA PROCESS
• use of monitoring and data analytics only increased by 14% from 2006 to 2015.
• Only 4 out of 10 chief audit executives (CAEs) worldwide feel their departments' use of technology is appropriate or better.
INCREASE IN IA USE OF TECHNOLOGY TOOLS
3/27/2017
14
• Electronic Workpapers scored the highest usage.– Most likely due to the use of generalized software
tools
• Great expansion of the use of data mining, data analytics and CA: Tools ie: CaseWare /ACL
• Room for improvement - globally, usage of most technology tools is reported “none” (20%) or “minimal” (40%)
Technology Tools Used by Internal Audit
WHAT SHOULD YOU DO?
1. Identify near-term opportunities to automate processes to enhance efficiency and effectiveness
2. Select and implement independent monitoring
3. Recommend use of appropriate technology by management – for controls and BPI
THE THREE LINES OF DEFENSE MODEL
3/27/2017
15
BUSINESS PROCESS IMPROVEMENT
Managements View vs CAE View:• CBOK survey respondents listed, assuring the adequacy of
internal control , as the top activity of internal audit to bring value to the organization
and• Internal audit adding value through Business Improvement did
not make the top five perceived by internal audit as a value generating activity.
Opportunity –disconnect with C – Suite: technology driven business process improvement should be much more integrated into the internal audit work plan improving the control and compliance processes, as well as the efficiency and effectiveness of operations.
SUMMARY TECH TRENDS:
• Expansion of data: – From structured business applications.
– From explosion of social media and other unstructured data.
• Leads to expansion of data mining, CM and the use of data analytics
• In audit too: IA is turning to more CA software applications and starting to focus on real time audit
SUMMARY –INTERNAL AUDIT TRENDS
• The use of technology by internal auditors has increased over the past decade,
• Use of data mining and continuous audit increased significantly,
• Technology in the audit process continues to grow,
• but there is room for improvement: new era monitoring IOT changes expectations for audit
3/27/2017
16
IA & EXTERNAL AUDIT OPPORTUNITY -- CM
• Further tangential opportunity for IA & EA to recommend even more CM to improve IC systems to Management ,1st line of defense, and compliance departments, 2nd line of defense (Cangemi EDPACS 2010 ) Tools: i.e.: CaseWare
• Then build independent CA application on top – strengthening the 3rd line of defense.
CHALLENGES TO EXPANDING THE USE OF TECH BY IA
• IA foundation skills are in accounting and auditing – need more tech focus
• Capital to invest – you need to fight for it
• Other priorities – time restrictions.
• Need for creativity skills and vision.
• Need to take risks - IT implementations do not always work out as planned
• Need to add value to the business
2016 FEI-FERF RESEARCH PROJECT
Financial Compliance: How Technology is Changing Audit and Business Systems
C- level views: reflects the CFO/Controllers view and concerns:
• GRC costs growth and need for coordination of work performed by IA, compliance departments and external audit
3/27/2017
17
FEI AUDIT FEE SURVEYS
Median increase in audit fees for all SEC filers 2014 and 2015 up 3.4% & 3.2%
• If ineffective IC for then the median increase was 6.4% & 5.1%)
– Top reason for increases: reviews of manual controls from PCAOB Inspections (40%) and other PCAOB issues (46%)
• Total compliance or audit costs pre sox 2002 compared to 2015 – up 100% +– Including large increase in compliance
functions
CAN AUDITS BE MORE EFFECTIVE?
Recent FEI CFIT and CGRC Discussions:
• The cost of compliance is growing and financial executives question the effectiveness of internal control audits
• PCAOB inspections are challenging for PAs
• Audit Firms are exploring/expanding use of “cutting-edge technologies” (WSJ 3-8-16)– Auditing standards were written before today’s
technologies were invented
PA INTEREST IN ANALYTICS & PCAOB
3/27/2017
18
DATA ANALYTICS AND FINANCIAL COMPLIANCE: HOW TECHNOLOGY IS CHANGING AUDIT AND
BUSINESS SYSTEMS
• Research objective:
• Are auditors are making effective use of technologies available – including the status of their use of automated monitoring and analytics?
• Identify leaders in use of automated monitoring and analytics
Note: This builds on 2011 FERF research report “ The Benefits of Continuous Monitoring”
FERF RESEARCH INTERVIEWS
• Internal Auditors
• External Auditors
• AICPA
• Call with PCAOB
• Analytics Vendors with focus on GRCNote: Missing Finance, Operations and Compliance i.e.: second line of Defense; however mentioned by IA and PA (Research Opportunity)
Internal Auditors’ Use of Analytics
Research Highlights:
• Audit quality is the primary goal
• Detection of duplicate payments is easy and
valuable (same finding since 2011 FERF)
• Analytics can be used to identify risks
• Some internal auditors want to partner with the
business; others are concerned with
independence
• There are staffing challenges
3/27/2017
19
SHAW INDUSTRIES - BERKSHIRE HATHAWAY
• $ 4 Billion carpet manufacturing
• CAE reports to VP-Finance
• Automated approach – started with Oversight Systems in P2P, added T&E,P card and most recent FCPA
• Solved problems with data formats and learning scripts – Page 8 last paragraph
• ACL for other ad hoc analytics
SHAW INDUSTRIES BERKSHIRE HATHAWAY
Partnered with Business
• Analytics process becomes part of the company’s system of IC and
• Is seen as delivering value to the business and
• A very efficient cost effective approach
• Only 4 audit staff
CAMPBELL SOUP
• Interest by company supply chain group in looking at complex disparate data– IA worked with them to use Smart Exporter
and connect directly to SAP database and analyze large data sets in IDEA
• Used analytics in disbursement – found cash recoveries and frauds
3/27/2017
20
DOW CHEMICAL AND STARWOODSHOTELS
• Dow Chemical- Improving audit quality and confidence in conclusions: by doing full populations
• Starwood Hotels- transactional analytics to identify anomalous transactions in full populations and to identify possible fraud; look for locations with unusual financial matrices; and created for the business a balance sheet analytics tool
SEEING REAL EXAMPLESIA & EXTERNAL AUDIT OPPORTUNITY -- CM
• Further tangential opportunity for IA & EA to recommend even more CM to improve IC systems to Management ,1st line of defense, and compliance departments, 2nd line of defense (Cangemi EDPACS 2010 ) Tools: i.e.: CaseWare, ACL, Oversight, Microsoft etc.
• Then build independent CA application on top – strengthening the 3rd line of defense.
External Auditors’ Use of Analytics
Research Highlights:
• Audit quality is the primary goal
• Delivering business insights is a secondary goal
• Efficiency is a third goal
• Audit firms need to differentiate themselves
and here again ---
• There is a talent shortage
3/27/2017
21
AUDIT QUALITY
“We want to deliver a higher-quality audit, and that has been central to our audit transformation program.”
“We think that there is a better way to do it, by using data and analytics more effectively.”
Roshan Ramlukan
Ernst & Young
THE TALENT SHORTAGE
“As we evolve into this data-enabled world, the occupation that we call the data scientist today didn’t exist five years ago.”
“There is a talent shortage out there, and everybody’s trying to hire them and develop them.”
Craig Sharples
PwC
PA FIRMS ISSUES WITH EXPANDING USE OF ANALYTICS
AICPA
• There are Issues with data access
– AICPA Audit Data Standard Project: update due 2017
• Issues with auditing standards – currently need to follow up on all identified exceptions
• Many firm partners fear PCAOB review – do it the old fashion way!!
PCAOB
• Briefing call would not, could not, do an interview
• They are meeting with firms and monitoring
3/27/2017
22
ANALYTICS VENDORS
Many software solutions are available with analytics: some generalized and some with a specific focus: Visualization, BI, Data Mining
FERF interviewed three with GRC focus:
• Oversight Systems: Insights on Demand
• ACL
• CaseWare Analytics
ANALYTICS VENDORS
Research Highlights:
Data Analytics solutions provide a means to replace
sampling with 100% of populations coverages
Close the loop- find a problem, make a change, prevent the next incident
• Analytics are part of a process, look at the outputs, measure them, appraise them and make corrections and systemic improvements
ANALYTICS VENDORS
• “We apply analytics to business process as a closed loop control… for many analytical problems you are dealing with gray” Patrick Taylor- Oversight Systems
• “The most impressive thing we are doing with Analytics is closing the loop” referring to AML software that completes required AML reports. Andrew Simpson –CaseWare
• 80% of SOX compliance can be automated with analytics. Dan Zitting ACL
3/27/2017
23
ANALYTICS VENDORS
Customer drivers:
• Regulatory compliance – some require review of every transaction
• Monitoring should be done by the business, as well as, internal audit (and compliance departments)
• Analytics customers look for hard-dollar recoveries or savings
MPC comment/trend : shift of sales efforts to and growth of compliance departments
STAFFING CHALLENGE
Our interviews revealed a number of issues related to staffing for automated audits.
• Internal & PA audit need people who:– Know how to audit,
– Understand work processes, and
– Have expertise in technology or an interest in learning to use new software solutions.
REVIEW --CHALLENGES TO EXPANDING THE USE OF TECH BY IA
• IA foundation skills are in accounting and auditing – need more tech focus
• Capital to invest – you need to fight for it
• Other priorities – time restrictions.
• Need for creativity skills and vision.
• Need to take risks - IT implementations do not always work out
• Need to add value to the business
3/27/2017
24
LEADERSHIP -- RISK TAKING
BUILD A WORLD CLASS AUDIT BUSINESS
My CAE years: high level summary of MAF
• Good People
• Following well thought out procedures
• Focused on significant issues and positive deliverables
• Focused on use tech for E & E
• Using a team approach to management
3/27/2017
25
BUILD A WORLD CLASS AUDIT BUSINESS
My CAE years: high level summary of MAF
• Scope – Assess and improve the systems of Internal Control (COSO principles)
• Independent mind set with company business focus
Lead me to new position – CIO and offer of Divisional President
A UNIQUE C LEVEL PERSPECTIVE ON GRC AND AUDIT
NUGGETS VERSION 2017
Michael P. Cangemi CPAretired CISAFormer CAE-CIO-CFO-COO-CEO
Continuous Auditing (CA) 85% of large audit functions have tools, but very limited usage– Many CAE’s looking at further automation
– Start or expand the pace today
– With technology available today
New Trend: Emergence of Enterprise GRC
• SAP GRC; Oracle GRC
• Good concept – but just a concept; and I reported on the future of ERP vs best of breed!
GARTNER NEW ERA EGRC MQ
We are beginning a new phase – CM in Business Intelligence & Analytics
segment as continuous analytics
– CA tools listed in Transactions Controls Monitoring
– Over time overtime CA CM tools migrate to Enterprise wide E-GRC
Public Audit – will change standards and their audit will use CM and analytics
3/27/2017
32
THE OLD AUDIT MODEL WILL EVOLVE
• Technology and real time data will force a change– Confirmation.com
– SEC Robo-COP
– Real time multi company audit • Rutgers Univ –Coney presentation
• Bitcoin – Blockchain ledger– Real time verification
DIGITAL MONEY AND AUDITING
• Bitcoin operates on the Blockchain ledgers
• Peer to Peer transactions with real time verification – 2015 still not tested
• 2016 now being tested in the main stream of business– JP Morgan, NASDAQ, Delaware
– Major focus of IBM
NEXT ERA: CLOUD INSIGHTS ON DEMAND
• Analytics solutions focused on needs of Business Managers
• Customer Control
• Pricing based on Number of Records and Frequency
• Discounts related to Volume, Frequency, and Number of Insights
96
3/27/2017
33
INSIGHTS DELIVERED
4 Receive Your Insights
AssessmentReport
Executive Dashboard Analyst Workbench
NEXT PHASES OF CM - SUMMARY
• Expanded use of BI
• Expanded CM of social media data
• Expanded CM of video
• Expanded data – Internet of things
• Expanded use of contextual analysis– Looking a multiple sources of data
TREND--- VIDEO CM
• TV Drama – A Person of Interest – Monitors Data and surveillance cameras
• Emerging CM video – retail/Banking– Operations: anticipate need for cashiers; lines
in banks
– Controls – CM ATMs; Retail looking for fraudulent returns
3/27/2017
34
MY CASE STUDY – RETAIL POS
• 75 stores across the country
• Inventory shrink – ½ of 1%
• Asked for Loss Prevention - $500k+ / yr
• Retail software company, adds CM of POS data
• Low cost: by store by month –
• Fantastic results: finding fraud circa 2000
REAL WORLD INSIGHTS
CM IS EVERYWHERE - SPORTS
First use case– Baseball bestseller
– Moneyball – Oakland Athletics
New Frontiers: B ball -March Madness Coaches Gobble UP Analytics USA Today
– Synergy Sports Technology – interactive video box scores – all 30 NBA teams
– Click on a number and see video of the play
– Portland Trailblazers – Analytics Manager
3/27/2017
35
CM IS EVERYWHERE -MEDICAL
IBM Watson – transformation of healthcare
• Phases of technology:– Tabulating
– Programmable - you tell the computer what to do , has limitations
– Cognitive - system is taught not programmed; then it learns and improves
• Watson scales and accelerates human expertise. Basically Watson reads everything fast, which a human could not do in a reasonable time frame.
IBM WATSON – J&J HEALTHCARE
• Watson reading electronic medical records (EMR), looks at X-rays at a more detail level than a human, come up with different options and medical treatments
• plan to capture and integrate CM of medical information from mobile devices
TRANSFORMING TECHNOLOGIES:
• Tech Trends – Summary– Mobile, Social Media, Big Data, Cloud,
Internet of things, shift in ERP applications
• Expansion of analytics and continuous monitoring in the Era of Big-Data
• Future – contextual and video analytics –digital money, real time verification
• Future/now – RPA Robotic Process Automation
3/27/2017
36
• Technology and real time data will force a change– Automated monitoring for gov’t reports
– Real time multi company audit
• Begin your expanded CA/CM processes today!
• Thank you IIA Philadelphia Chapter
THE OLD AUDIT MODEL WILL END
BARRIERS TO AUTOMATION
THANK YOU FOR ATTENDING
• You are the champions
• Use of technology and analytics is changing business and improving lives
• Google, FaceBook, Amazon !!!
• CaseWare IDEA and Monitor, Oversight Systems, ACL and more
3/27/2017
37
SURVEY
HELP US IMPROVE THE CONFERENCE!
You will receive a survey via email in the next few days. Please respond to provide feedback
on the speakers and the overall session.
This evaluation is how we determine the changes needed to make us better!
