1. Predicting Controls Maturity
Based on Audit Results
Sohit Raina, Internal Auditor
Vikas Dutta, Principal Internal Auditor
Nov 7, 2014

2. 2 © 2014 CA. ALL RIGHTS RESERVED.
What are Controls Maturity Indicators?
Enable quick health check/current state of controls maturity;
Identify desired state of control maturity;
Develop a plan for improvement.
Indicators that allow management to measure a trend in
control maturity over a period of time
Why Controls Maturity Indicators?

3. 3 © 2014 CA. ALL RIGHTS RESERVED.
Analysing Controls Maturity Based on Audit Results
Factors such as number of findings, severity, and audit
cycle time can be indicators of controls maturity.
Number of Findings
Severity of Findings Controls Maturity
Audit cycle time

4. 4 © 2014 CA. ALL RIGHTS RESERVED.
Number of Findings v/s Number of Days
y = 10.529x + 81.502
0
50
100
150
200
250
0 1 2 3 4 5 6 7 8 9
Avg # of Days in Year 1
Number of Findings v/s Average Number of Days:
Evaluation of controls maturity, by tracking number of findings per audit and associated audit
cycle time.

5. 5 © 2014 CA. ALL RIGHTS RESERVED.
Number of Findings v/s Number of Days
y = 10.529x + 81.502
y = 10.329x + 54.473
0
50
100
150
200
250
0 1 2 3 4 5 6 7 8 9
Avg # of Days in Year 1
Avg # of Days in Year 2
Y = 75

6. 6 © 2014 CA. ALL RIGHTS RESERVED.
Weighted Score of Findings v/s Average Number of Days:
In order to incorporate the impact of findings (high, medium ,low) and overall report rating, a
weighted score was assigned to the findings and plotted against number of days.
Weighted score assigned:
High = 5
Medium = 3
Low = 1
For Example:
Analysis of Audit Results using weighted score
Fiscal
Year
Project Name High Medium Low Total # of Findings
Weighted Score (5H + 3M +
1L)
Total No.of
Days
Year 1 Audit A 1 2 1 4 12 92
Year 1 Audit B 0 0 3 3 3 60
Year 1 Audit C 1 2 0 3 11 74
Year 1 Audit D 1 2 1 4 12 121

7. 7 © 2014 CA. ALL RIGHTS RESERVED.
Analysis of Results Using Weighted Score
Weighted Score
Values
Weighted Score
Group
Number of
Audits in Year 1
Avg # of Days
in Year 1
Number of
Audits in Year 2
Avg # of Days
in Year 2
0 to 5 1 3 109.3 6 74
6 to 9 2 5 105.9 8 98
10 to 12 3 9 116.0 9 114
13 to 15 4 9 119.6 8 68.5
16 to 18 5 7 122.3 5 107.5
19 and above 6 7 151 4 123.7

8. 8 © 2014 CA. ALL RIGHTS RESERVED.
Severity & Number of Findings
y = 7.4699x + 94.513
y = 6.6143x + 74.467
0
20
40
60
80
100
120
140
160
0 1 2 3 4 5 6 7
Weighted Score of Findings v/s Avg No. of Days
Avg # of Days in Year 1
Avg # of Days in Year 2
Y = 75

9. 9 © 2014 CA. ALL RIGHTS RESERVED.
Lessons Learned
Decrease in cycle time and rise in controls maturity as a result of:
• Maturing business processes
• Readily available data (common ERP system across organization)
• Clearly defined and documented processes
• Implementation of automated/preventive controls
• Familiarity and established relationships with control owners
Other factors to be considered for future state:
• Experienced auditors
• Faster escalation process
• Shorter-less complex audits
• Improved report writing
• Timely response from management

10. 10 © 2014 CA. ALL RIGHTS RESERVED.
Thank you!
Sohit Raina
 sohit.raina@ca.com
Vikas Dutta
 vikas.dutta@ca.com