04/21/2011 Meeting - Auditing with Data Analytics
Upcoming SlideShare
Loading in...5
×
 

04/21/2011 Meeting - Auditing with Data Analytics

on

  • 218 views

 

Statistics

Views

Total Views
218
Views on SlideShare
218
Embed Views
0

Actions

Likes
0
Downloads
10
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

04/21/2011 Meeting - Auditing with Data Analytics 04/21/2011 Meeting - Auditing with Data Analytics Presentation Transcript

  • 1 Copyright © 2010 Deloitte Development LLC. All rights reserved. ACFE April 21, 2011 Taking Your Audits to the Next Level with Data Analytics
  • 2 Copyright © 2010 Deloitte Development LLC. All rights reserved. Speakers Dale Livezey Senior Manager NorPac Regional Technology Leader Deloitte & Touche LLP Audit and Enterprise Risk Services San Francisco, CA 415-783-4208 dlivezey@deloitte.com
  • 3 Copyright © 2010 Deloitte Development LLC. All rights reserved. • Benefits of Analyzing Data • Audit Planning with Data Analytics  Integrating Data Analysis into the Audit plan  Planning Considerations  Best Practices for Sustainability • Case Study  Example Deliverables • Business Cycle Examples  Detailed Data Analytics by area • Data Analysis Execution Phases Agenda
  • 4 Copyright © 2010 Deloitte Development LLC. All rights reserved. Benefits of Analyzing Data
  • 5 Copyright © 2010 Deloitte Development LLC. All rights reserved. More efficient and effective manual testing Assist in root cause analysis Test Validity and accuracy of reports Target and assess specific risk areas Identify control weakness / effectiveness gaps Data Analytics can help in many aspects of business process testing Overall more effective control testing services for our clients Data analysis improves the quality, effectiveness and efficiency of audits • Performs 100% recalculations and verification of transactions in a timely and repeatable fashion • Compares data from multiple / disparate systems • Provides business insights and identifies process improvement opportunities • Presents quantifiable results from analysis based on complete population Benefits of Analyzing Data
  • 6 Copyright © 2010 Deloitte Development LLC. All rights reserved. Why Use Data Analytics? Enhanced Risk Identification • Early identification of risks and trends • Enhanced capabilities for identifying fraud and management override of controls Deeper Insights • Fact-based insights that are difficult to glean from interviews Enhanced Efficiency and Coverage • Greater focus on high risk areas than is possible with sampling • Greater coverage of the entire population than is possible with sampling Fact-Based, Quantifiable Findings • Ability to quantify control weaknesses • Ability to provide detailed examples of exceptions at the transaction level
  • 7 Copyright © 2010 Deloitte Development LLC. All rights reserved. Benefits of Analyzing Data Approach Benefit Profiling and trending • Focus on specific areas of risk or interest • Provide insights into transactional history and behavior • Test internal controls effectiveness • Identify hidden relationships between people, organizations and events Customized transactional analysis • Geared towards a clients specific business process • Reduction in manual testing procedures • Perform proactive instead of reactive audits • Identify potentially improper or fraudulent transactions Statistical Sample selection and evaluation • More efficient and accurate selection procedures • Reduces time spent on selections of little or no interest • Analyze the full population of transactions instead of a traditional sampling approach • Focus on risk! Report re-performance and metric recalculation • Validate operational reporting systems and assist in the documentation of current reporting process • Reduce manual testing procedures
  • 8 Copyright © 2010 Deloitte Development LLC. All rights reserved. Integrating Data Analytics into the Audit Plan
  • 9 Copyright © 2010 Deloitte Development LLC. All rights reserved. Integrating Data Analytics 1) Data analysis needs assessment A Data Analysis needs assessment should cover each major business process area. Identify audit areas to benefit most from the use of automated data analytics Select a pilot area and a prioritized list of all areas for future audit automation 2)Plan, design and implement data analytics for a Pilot area Design, Develop and Implement the data analysis methodology, deliverables and tools for a pilot area. Assess the success of the pilot area; Identify lessons learned; and modify the approach, as needed, for the extension of the project to other areas. 3) Develop and implement data analytics to other areas Extend the approach used to the pilot phase to the other key business process areas
  • 10 Copyright © 2010 Deloitte Development LLC. All rights reserved. Planning 2. Pilot Business Process Scripts Design & Implementation 3. Other Business Processes Same phases as the pilot business process, adding lessons learned during the pilot project assessment 1. Data Analysis Needs Assessment Test Select desired analytics Data Needs Assessment Identify relevant business areas Identify relevant computer systems Review prior findings and audit summaries Risk rank business areas Develop Implement Document Design Assessment of hardware/software requirements Integrating Data Analytics
  • 11 Copyright © 2010 Deloitte Development LLC. All rights reserved. In many cases, obtaining the data will be the most time-consuming part of the data analysis. If you have your IT group provide the data: Communicate the following in writing: • Dataset(s) to be received (Field and Table names) • File format (character set, structure, etc.) • Delivery media • Control totals • Documentary evidence • Delivery date Obtain an idea of the size of the file(s) that will be provided Obtain a sample file before the complete data file Planning Considerations
  • 12 Copyright © 2010 Deloitte Development LLC. All rights reserved. Your technology platform may lend itself to auditor self-service. If you obtain the data for yourself: Be cognizant of complex data models Take advantage of ODBC, if possible • Open Database Connectivity  MS Access  ACL  IDEA  SAS Be aware of the performance impact on production or warehoused data Perform Data Integrity tests upon receipt of data (i.e. Reconcile to Control Totals, etc) Planning Considerations
  • 13 Copyright © 2010 Deloitte Development LLC. All rights reserved. Best Practices for Sustainability 1) Use Data Analytics to assist Planning each Audit Each Business Process area has varying challenges and risks; which may change over time: Data Analytics profiles activity in each area, to help focus the scope of the audit Early identification of potential risk areas allows more time during the audit to analyze the root cause of issues identified during the planning phase Examining 100% of an account balance allows more comfort over the application of automated controls Treat anomalies found during data analysis in planning phase as selections 2)Ownership over Data Analytics Establish a Data Analytics Champion to support the integration of tools, and repeatable analytics throughout the audit process Formalize policies and procedures around how data will be acquired, used, and maintained by the internal audit department Support Recurring use of Analytics as a part of each audit; incorporating time to design new procedures, as appropriate, each time the audit is performed
  • 14 Copyright © 2010 Deloitte Development LLC. All rights reserved. Best Practices for Sustainability 3) Consider applying Continuous Control Monitoring Data Analytics embedded into regular reporting can reduce required audit procedures 4) Routinely Redesign Analytics Data analytic procedures will often become routine, and lose their focus if the approach and scope are not regularly challenged and modified as variables change Source Data Changes Operational Risks change over time  Reward innovation Some organizations provide incentives for auditors who identify new techniques and routines
  • 15 Copyright © 2010 Deloitte Development LLC. All rights reserved. Case Study
  • 16 Copyright © 2010 Deloitte Development LLC. All rights reserved. Data Analytics in Procurement Audit Travel expenses have always been a concern at ABC Company since it is an area where controls are weak. • When traveling, employees have a maximum per diem rate and are required to submit receipts coinciding with their actual expenses. • Established maximums for meals are:  Breakfast = $10  Lunch = $20  Dinner = $20 Analytics were performed to identify meal expenses that were in multiples of $10.00 Transactions meeting the criteria were compared to receipts to ensure that the amounts expensed were appropriate The results… Many employees were charging the maximum rates for meals even though their receipts did not justify the amounts
  • 17 Copyright © 2010 Deloitte Development LLC. All rights reserved. Data Analytics in Procurement Audit Identify additional insights to questions such as: • Is your company paying invoices on time? – Are payments consistently too late, leading to missed vendor discounts and/or resulting in potential late fees or finance charges? – Are payments consistently too early, leading to potential cash flow issues? – Are payment patterns in line with your company‟s guidelines? • Are there vendors who currently owe money to your company? – Are these balances associated with vendors with whom you no longer do business? – Are these balances such that they should be recorded as receivables? • Have payments been made to unauthorized or restricted vendors? – Is the vendor master being maintained in a timely manner? – Is there a break in the controls surrounding vendor master maintenance? – Is there a pattern in users posting such payments? • Are you paying invoices to vendors with potential relationships to your personnel? – Are these payments related to a legitimate business purpose or is there a potential for fraudulent activity? – Who is posting these payments?
  • 18 Copyright © 2010 Deloitte Development LLC. All rights reserved. Percentages of invoices paid late or early are easily ascertained, as well as the corresponding invoice amount. Sample Analytic: Payment Date vs. Due Date • Uncover potential lost discounts or cash management issues • AP tests with further ad-hoc analyses can yield additional insights such as: • Do payments relate to a single vendor? • Do late/early payments relate to only certain individuals within the AP department? • What was the available discounts vs. discount lost? • How much interest was paid due to missed due dates?
  • 19 Copyright © 2010 Deloitte Development LLC. All rights reserved. Sample Analytic: Disbursements to Invalid Vendors Identify potential circumvention of or issues with system controls, and the corresponding financial impact. •Drill into detail transactions to understand the vendors •Determine whether there is an issue with timely maintenance of the vendor master file •Are there noticeable patterns in the users posting these transactions?
  • 20 Copyright © 2010 Deloitte Development LLC. All rights reserved. Sample Analytic: Duplicate Disbursements Identify potential duplicate payments based on multiple sets of criteria, as well as potential financial impact. •Detailed transaction information can provide insights into: •Are duplicate payments consistently related to the same system user? Are they the result of potential duplicate invoices? •Are these erroneous payments or an indication of fraudulent activity? •Further ad-hoc analyses can help refine the set of criteria to zero in on the payments that present a greater risk of being “true” duplicates.
  • 21 Copyright © 2010 Deloitte Development LLC. All rights reserved. Tests by Business Cycle Area
  • 22 Copyright © 2010 Deloitte Development LLC. All rights reserved. Business Cycle Testing Areas • Revenue • Expense • Fixed Assets • Payroll / Personnel • Inventory • Financial Reporting
  • 23 Copyright © 2010 Deloitte Development LLC. All rights reserved. Tests by Business Area: Revenue Process Area Potential Tests Maintaining Customer Master File • Assess customer master file for duplicates / integrity Managing & Processing Orders • Analyze sales data by customer, product, region, etc. • Identify customer purchases over approved credit limit • Calculate order fulfillment time from customer order to shipping Ship / deliver Orders • Identify gaps or duplicate in shipping document numbers Invoicing, Sales, Returns & Adjustments • Identify duplicate invoices • Analyze lag between shipping and invoicing • Compare cost with profit margins to identify trends and opportunities to improve pricing • Generate profitability reports by sales person, product, customer • Generate invoice summaries by customer, invoice, amounts, etc. • Report and automatically age total receivables • Identify top customers for past due accounts, outstanding balances, etc. • Identify duplicate credits • Analyze customer returns and identify outliers Process Receipts • Identify duplicate cash receipts • Profile customer payment history / average customer collection time. • Average collection time by salesperson / location Manage Collections • Determine carrying costs by comparing days in collection by customer • Determine the percentage of receivables written off as bad debt. Perform trend analysis to determine significant changes over time.
  • 24 Copyright © 2010 Deloitte Development LLC. All rights reserved. Tests by Business Area: Fixed Assets Process Area Potential Tests Asset Maintenance and Classification • Keywords wearch: „Fix‟, „Maint‟, „Break‟, „replace‟, etc to confirm whether items should be capitalized or expensed • Identify cost and net book value less than or equal to zero • Identify fixed assets with no associated useful life • Identify duplicate fixed assets. • Identify active plants with no fixed assets at closed locations Depreciate Assets • Recalculate depreciation for any or all assets Asset Transfer, Reclassification and Retirements / Disposal • Identify asset additions, disposals, and transfers throughout the year • Identify disposals before end of useful life
  • 25 Copyright © 2010 Deloitte Development LLC. All rights reserved. Tests by Business Area: Expenses Process Area Potential Tests Purchasing • Identify duplicate purchase orders • Stratify POs by purchase approval limits • Analyze purchasing card activity • Analyze employee entertainment & travel expenses Receiving • Identify duplicate receipts and receipts with out purchase orders • Analyze receiving adjustments (i.e. returns, short / over shipments, damaged goods) Processing A/P and disbursement • Extract invoice pricing and receipt quantity variances by vender and PO • Extract invoices posted with duplicate PO numbers / receipts • Identify all invoices that were not subjected to three way match • Identify duplicate payments for single invoices • Identify missing, duplicate, void or out of sequence check numbers • Identify payments to unapproved venders / brokers • Identify low-dollar payments to the same vendor for potential consolidation of payments • Analyze payment cycles and processing time. Payments made before / after invoice due date to identify discounts lost to early payment. • Identify vendors with net debit balances • Generate cash requirements by bank, period, product, vendor, etc. Manage Supplier Master File • Identify vendors of interest such as duplicate vendors, vendors who are employees, vendors with addresses at Mail Boxes Etc.
  • 26 Copyright © 2010 Deloitte Development LLC. All rights reserved. Tests by Business Area: Payroll / Personnel Process Area Potential Tests HR / Employee Master File Maintenance • Check employee master file for invalid social security numbers, potential duplicate employees, invalid / incomplete address information • Profile salary ranges to identify outliers • Identify pay rate higher than the corresponding pay grade rates. Payroll Disbursement • Identify employees in payroll that are not in the employee master file • Compare time-card rates and pay to payroll and indicate variances. • Identify employees making over a certain amount in annual salary that do not have any benefits deducted from their payroll. • Compare and summarize costs for special pay, overtime, premium, etc. • Provide statistics related to Equal Employment Opportunity Commission (EEOC) requirements • Analyze payroll disbursement to identify outliers (e.g. trends in bi- weekly payments, excessive hours worked, etc.). • Identify employees who received overtime pay but did not have the full required hours in a time period. • Extract all payroll checks where the gross dollar amount exceeds set amount. •Identify duplicate or missing payroll checks
  • 27 Copyright © 2010 Deloitte Development LLC. All rights reserved. Tests by Business Area: Financial Reporting Process Area Potential Tests Perform Financial Analysis • Analyze account balances including significant changes and reclassifications. • Calculate financial ratios (and changes) for sales/assets, debt/equity, etc. • Track year-to-date activity for large operating accounts (rent, taxes, etc.). Analyze and Validate Journal Entries • Analyze journal entries to identify significant transactions, as well as, groups of transactions. • Identify and analyze reversal entries, recurring entries, late adjusting entries. • Perform a dollar stratification • Analyze revenue entries on volume, amount and timing (large credits to revenue just before period close, etc). •Search for invalid entries (i.e. blank User ID, blank GL account number(s), entries that do not net to 0, invalid GL Effective Date, negative debit or credit amount, blank posted date, blank description) • Search for key words of interest in journal entry descriptions • Analyze entries with round dollar amount or recurring ending digits •Perform trending analysis to identify unusual trends in Journal Entry amount by income statement / balance sheet. • Perform analysis of entries that might indicate a management override of controls. •Print custom balance sheets, P&L statements, cash flow analyses, etc.
  • 28 Copyright © 2010 Deloitte Development LLC. All rights reserved. Tests by Business Area: Inventory Process Area Potential Tests Maintain Inventory Master File • Assess inventory master file for integrity • Identify items with zero or negative unit costs or negative quantity • Test for duplicate item numbers, prices or descriptions Store and ship inventory • Analyze where product is made/stored and where it is shipped to identify possible freight expense savings. • Analyze inventory receiving and shipping lead time. Conduct inventory counts • Apply statistical counting techniques • Analyze significant inventory adjustments Inventory valuation • Summarize and stratify turnover by stock item to identify slow- moving or obsolete items • Recalculate inventory based on valuation method (LCOM, FIFO, LIFO)
  • 29 Copyright © 2010 Deloitte Development LLC. All rights reserved. Data Analysis Execution Phases
  • 30 Copyright © 2010 Deloitte Development LLC. All rights reserved. Step 1: Define Objectives Step 2: Request Data Step 3: Address Technical Issues Step 4: Perform Tests Step 5: Present Results Data Analysis Phases
  • 31 Copyright © 2010 Deloitte Development LLC. All rights reserved. Step 1: Define Objectives • Create your test plans  Identify potential efficiencies  May need to determine other factors, like sampling method  Establish time period  Include or exclude certain information  Determine if the data is available or retained • Define your deliverables  Know what your final result is going to look like, for example, a report or a presentation, etc. • Assess the costs  Include potential considerations: - Is this a compliance objective? - How often will this test plan be used? - How complex are the files? Planning for a Data Analysis Project
  • 32 Copyright © 2010 Deloitte Development LLC. All rights reserved. Step 2: Request Data • Identify the necessary data fields  What fields are required?  Which reports contain the information audited manually in the past? • Meet with IT, IS, and/or MIS  List the required fields and identify additional fields  Know the scope of data (e.g., all divisions)  Cleansing or manipulation of the data may be needed (e.g., unit cost may need to be calculated by taking the extended cost divided by quantity)  Identify potential cutoff date and time issues  Determine how you will access and acquire the data • Submit and document a written data request  Retain data requests for workpapers Planning for a Data Analysis Project
  • 33 Copyright © 2010 Deloitte Development LLC. All rights reserved. Step 3: Address Technical Issues • Considerations for your “data request”  Which applications are the source of the data and are they compatible?  How is the data stored?  What skills are needed to access the data in its natural format?  What data analysis tool should be used and what platform or environment? Planning for a Data Analysis Project
  • 34 Copyright © 2010 Deloitte Development LLC. All rights reserved. Step 4: Perform Tests • Execute the plan in place • Remember: based on what you find out, things may need to be modified • Always remember what your objective is! And will your test plan meet your objective? Planning for a Data Analysis Project
  • 35 Copyright © 2010 Deloitte Development LLC. All rights reserved. Step 5: Present Results • As you complete your testing procedures, you will want to think about how to present your results:  Who is your audience?  Present summary versus detail results?  What format should be used to present the results?  How could pictorial representation help? Planning for a Data Analysis Project
  • 36 Copyright © 2010 Deloitte Development LLC. All rights reserved. Questions?