E #

More Than Just an Audit…

Why Not?

Assurance & Advisory Business Services

Eckardt Kriel

!@ #

AGENDAAGENDA

Current State Overview CAATs

Brief Description of our progress in E&Y - Canada EY3D Continuous Auditing Look Into the Future

!@ #

The following is an extract from the Audit Methodology.

It defines, largely, the current state of data analytics within the assurance/attest function - but what is lacking is that it does not address the future state. Also it assumes the auditor has a choice.

However the future is going to be VERY different for the auditor of tomorrow.

Current StateCurrent State

Con

fiden

ce

Con

fiden

ce

Precision

Precision

High Narrow

Low Wide

LITTLE

LITTLE

SOM

E

SOM

E

CO

NSI

DER

ABL

E

CO

NSI

DER

ABL

EPERSU

ASIVE

PERSUASI

VE PERSU

ASIV

E

PERSU

ASIV

EC

ON

SIDE

RA

BL

E

CO

NSID

ER

AB

LE

SOM

ESO

ME

LITTLE

LITTLE

PR

ED

ICT

OREX

PLO

RE

RPR

OFIL

ER

TR

EN

D, D

ISTR

IBU

TIO

N,

TR

EN

D, D

ISTR

IBU

TIO

N,

DIG

ITA

LD

IGIT

AL

M i n i m a l L o w M o d e r a t e

L o w M o d e r a t e H i g h

M i n i m u m M o d e r a t e M a x i m u m

C o n t r o l R i s k

L o w e r

H i g h e r

In

he

re

nt

Ri

sk

LEVELS OF DETECT RISK ASSURANCE FROM ANALYTICSThe levels of detect risk assurance we obtain, by tool, at the activities leading to Risk Assessments and Customised Solutions are indicated on the “pyramid” diagram below. The exact level of assurance gained will be a matter of professional judgment and supporting documentation will be key in this area.

!@ #

Data Capture Extract & sample Sort Summarize Footing Stratify Sequence testing

Recalculate Aging Duplicate Testing Graphs - histograms Merge, join & split Confirmations Statistics

Traditional Audit CAATs can be characterized as follows

Current State contd...Current State contd...

!@ #

Business Drivers for ChangeBusiness Drivers for Change

As eCommerce and other initiatives advance many established business practices are being shattered.

In this world of the future, economic events will be captured, measured, recognised and reported electronically (read as “instantaneously”), without any paper-based trail.

Data volumes increase exponentially, data being stored in disparate data stores and in a variety of different forms.

The convergence of electronic processes toward real-time financial management will drive traditional audit methods to be displaced by ‘smart’ electronic analytics and continuous auditing techniques.

Auditors are facing increased pressure on fees and demands to increase value.

!@ #

Evolution of Computing - Data Characteristics

Mainframe

Monitor

IBMCompatible

Modem

IBMCompatible

LAN

Mainframe Client Server

OracleSAP

BAAN

WAN

INTER/INTRANETeCOMMERCE EXTRANET

1970 1980 1990 2000

Virtual

• Monthly Transaction-based Processing• Tape/DASD based Data Stores• Sequential Files• PC Introduction 1978• Restricted Central Storage

• Daily Update Transaction-based Processing• Relational Databases Technology• Multiple Distributed Databases• Diverse/Portable Technologies• Restricted Remote Storage and Access

• Instantaneous Updates• Object Oriented Database Technology• Data Made up of Sound, Images• Increased Storage Methods, Types• Differing Standards

Technology

Data Disbursement Increases Data Volume Increases Data Variety Increases

!@ #

Future StateFuture State

In addressing the needs of the auditor in the future state, E&Y has invested in the development of tools like EY3D which have the potential of playing an important role of gaining insight and adding value :

Tests of Controls Substantive Tests System Conversion

Application Reviews

Unique Value Add

Services

!@ #

EY3DTMEY3DTM

!@ #

FeaturesFeatures

A distinguishing feature of EY3DTM is that we recognize the power of analytical tools to detect the conditions associated with maturity of certain business risks, including fraud.

We have developed the evidence profile for some common fraud risks – e.g., in the Payment Stream Analysis module we have identified payments to fictitious suppliers, reprocessing existing invoices, expense account abuse, as risks that mature frequently and are capable of detection by data analysis.

!@ #

The EY3D analysis can be run before a conversion to give a ‘diagnostic’ or current state analysis to identify current problems in the processes and/or data that should not be converted to the new system.

When performing a post-conversion review the auditor can increase his coverage and effectiveness by utilizing tools like EY3D to detect whether problems arose during a conversion.

System ConversionSystem Conversion

!@ #

Application ReviewsApplication Reviews

Similarly, EY3D can play a powerful role in diagnosing business process issues, including ERP systems like SAP.

As a complement to his Application Control Review work the auditor can look to the results of EY3D to obtain hard evidence of issues arising out of the data stream analysis. As we configure EY3D for particular ERP systems the auditor can then pinpoint the source of various problems in say, a particular table or configuration setting, adding to the value of his review.

!@ #

So Where’s the Value?So Where’s the Value?

Audit Role: 100% transaction testing- no samples. Look to data for source of evidence.

Payments to terminated employees. Payments to inactive, invalid vendors. Unusual payments. Check payment authorization limit testing.

Business Process Improvements: Cash Management; lost discounts/interest paid, payments to suppliers too early/

too late. supplier spend analysis. Vendor master file analysis.

Cash Recovery: Duplicate payments to suppliers, overpayments of GST/PST, employees abusing

expense accounts. Irregular Activity:

Fictitious suppliers on master file, re-processing supplier invoices. Benchmarking/KPI’s:

No. of days to process invoice payments, no. of invoices processed per month. Risk Management:

Canadian Soc Insurance Number analysis – invalid SIN nos., immigrant status.

!@ #

BenefitsBenefits

High impact on the bottom line. Productivity gains through controlled management of risk . Clean-up of vendor master file. Demonstrate a pro-active approach to fraud detection and

management. Opportunities to recover cash from vendors which have been

paid more than once. Opportunities to recover cash from employees who have

abused the system. Opportunities to improve future cash flow by preventing

further cash leakage. Opportunities to negotiate better terms from suppliers.

Growth of stakeholder confidence in the stewardship function.

!@ #

In addition to running this tool periodically we can run it continuously.

The tools exist today to make this viable. Example: AuditMaster Inea, etc

Why Not Go Even Further?Why Not Go Even Further?

!@ #

An integral part of any Audit vision is to provide value to clients through the continuous flow of ideas and early warnings. To achieve this vision, the concept of Continuous Auditing can be the enabler through:

more frequent interaction with the client;

taking a proactive business process view of the client;

the timely consideration of industry knowledge; and

accessing clients’ information electronically.

Continuous Auditing or Real Time Assurance

Continuous Auditing or Real Time Assurance

!@ #

Industry auditco-ordination

Scheduleddatacollection

Analytics Communication

Real Time Assurance tools

Datawarehouse

Clientinformation

AuditEngagement

Audit Guidance

Benchmarks

Datamodel

Standardanalytics Benchmarks Standard

& ad hocreports

Exceptionand highlightsreporting

Continuous Auditing or Real Time AssuranceContinuous Auditing or Real Time Assurance

!@ #

Key BenefitsKey Benefits

standard models are built for each industry, which define the data to be captured and provide a set of tools to investigate the data in the context of business and financial statement risks;

data capture is provided on an automatically scheduled basis, or at least with the minimum of human intervention, thus minimizing the need for technical support and enabling up-to-date data to be captured frequently;

the use of standard models facilitates the gathering and sharing of benchmark data across an industry or segment;

the standard tools provided include a powerful multi-dimensional technique for investigating data which neither restricts the audit team to a standard set of “canned” procedures, nor requires them to write numerous separate ad-hoc query programs to satisfy their needs. Thus the team can interact with the data in real time, investigating issues as soon as they identify them.

!@ #

ABC Life Casualty - Real Time AssuranceABC Life Casualty - Real Time Assurance

ABC LIFE CASUALTY