Presentation during the Analytics Summit in Las Vegas - November 2018

1. CONTINUOUS AUDITING
Manuel Coello
Senior Director Data Analytics
Aetna

2. OUR
JOURNEY

3. AGENDA
1. Continuous Auditing Overview
 Why Continuous Auditing?
 Benchmarking analysis
 Guidance
 Aetna’s approach
 Audit areas to scope
2. Continuous Auditing Methodology
 Step-by-step
 Small practices = big impact
 Risk-monitoring platform
 Risk and prediction scoring

4. CONTINUOUS AUDITING-
AN OVERVIEW

5. 20 REASONS FOR CONTINUOUS AUDITING
1. Historic audit results help predict the
likelihood of a transaction being an exception
2. Uses risk scoring techniques to be more
effective identifying audit exceptions
3. Scope is Enterprise-wide & end-to-end
4. Audits covers 100% of the transactions
5. Strategic scope by creating partnerships with
business & compliance teams
6. Uses unsupervised and deep learning
modeling to identify emerging risks
7. Value-added findings that can be quantified
8. Diagnostic analytics uncover insightful root-
causes
9. Elevates the Audit brand
10.Promotes Auditor expertise
11. It could be a self-funded initiative
12. Other audit groups such as SOX,
compliance teams, external audit can
leverage some of the testing
13. Culture of controllership
14. Platform for Fraud detection
15.Uses robotics to minimize manual work
QUALITY COST
16. Up to 5x faster than traditional audits
17. Early detection of audit issues
18. Continuous Assurance
19. Painless audits to the business
20. Phased out approach
SPEED

6. STATE OF CONTINUOUS AUDITING IN OUR PROFESSION
- “Adopting” phase
- “Medium” Impact on audit effectiveness
- “Medium” level of commitment

7. IIA GUIDANCE
- Ongoing risk and control assessments
- Technology- enabled reviews
- Ongoing evaluations based on a large
proportion of transactions
- Evidence, timing, procedures, effort are different
from traditional audits
- Requires leadership, change management, and
a phased approach
- Provides results to management (reports,
analytics, visualizations)

9. TECHNOLOGY BASED AUDITS

10. CHANGE MANAGEMENT

11. AETNA STRATEGY
- All audits approved by the Audit Committee
- Comprised of: Risk Control Assessments and Transaction
Testing
- Executed by a centralized Continuous Auditing Team
- Technology enabled audits
- Minimizes physical work – near full automation
- Audit activities ongoing throughout the year
- Issue an audit report
- Share analytic support, visualizations and technology with
management

12. POTENTIAL CONTINUOUS AUDITING AREAS
- Cash Areas: T&E, Procure-to-Pay, Payroll
- Risky/Strategic Areas: G/L, Revenue, Fixed Assets
- Compliance Areas: FCPA, Third-Party Vendors, Variable
Compensation
- Organic Growth: Convert a completed traditional audit that
uses analytics into a Continuous Audit Program

13. CONTINUOUS ANALYTICS
METHODOLOGY

14. METHODOLOGY OVERVIEW
Planning
2-4 weeks
Risk Monitoring
1-2 weeks
Transaction Testing
2-4 weeks
Reporting
1-4 weeks

15. PLANNING –
KICK-OFF MEETING
 Email executive prior to
meeting about the help
requested
 Introduce team &
capabilities
 Explain Continuous
Auditing approach
 Discuss upcoming audit
 Set expectations &
requirements

16. PLANNING –
DATA REQUEST
 Start with the Audit
Universe
 Sent by the Analytics
Leader to the Business
Liaison
 Executive is copied
 Subject states “Audit
Request”
 Request specifies all key
details (system, period,
fields, field descriptions,
etc)

17. PLANNING –
PROCESS OVERVIEW
 1 HOUR MEETING WITH
THE BUSINESS OWNER
 HIGH LEVEL

18. PLANNING –
ANALYTICS
FRAMEWORK
 Multiple sessions with
Analytics team, IAD
Team, Business,
Compliance, CAE, etc.
 Select “phase 1” analytics
based on testing area,
complexity and risk level.
 Document and Socialize
 Post in Analytics Library

19. ANALYTICS FRAMEWORK
FraudCompliance Spending PatternAbuse / Waste / Errors Controls
Travel
Expenses
 Use of Suspicious MCC
 False Mileage Claims
Submission
 Travel Exp. Near or Beyond
Termination Date
 Suspicious Airfare
 False Meal Submission
 Excessive Transactions
below receipt limit
 Unapproved Govt. official
Expenses
 Spending without Attendee
Details
 Unauthorized use of gift
card providers
 Use of non-approved Travel
Agencies
 Gas without Rental Car/Gas
& Mileage
 Excessive Spending as per
peer group
 Round dollar amounts
 All business expense in
cash
Excessive daily Meals over
daily threshold
 Duplicate Expense Claims
 Excessive meals in
hometown
 Split Transactions
 Excessive Spending with
same Attendee
Excessive frequency of
same employee recognition
Approved by Supervisor
Procure-to-
Pay
 Payments made to
employee through accounts
payable system
 Screening Process
Invoice date created after
the PO date
 Vendor Master Data Quality
 Adequacy of Approval
Amount
 Incomplete Vendor Master
data
 Lack of PO
 Unfavorable Payment terms
 Aged Open Purchase
orders
 Duplicate Invoicing
 Unapproved freight or other
charges
PO Approval process
Aged Open Invoices
Overpaid purchase orders
General
Ledger
 Dormant Accounts
 Suspense Accounts
 Reserve Manipulation
 Capitalization of expenses
and non-std revenue entries
 Support of MJE
Timeliness account
reconciliation
 Rounded Amount
 Vague MJEs Descriptions
 Non-Finance Employees
Booking Entries
 Trending of Accounts
 Non-Standard reversals
 Vague MJEs
Aging of reconciling items
MJE Keyword Analysis
Top level entries
 MJE Approval
 Approval of account
reconciliation

20. SCOPING MEETING

21. PLANNING – OTHER
KEY ACTIVITIES
 Coaching session with the
Executive
 Access to the front-end
system
 Project Plan
 Agile approach

22. RISK MONITORING
• Kick-off ALL new audits with
executives (first month of
audit cycle)
• “Universe” Audit Data
Request
• High level process overview
• Executive coaching session/
vision
• Analytics framework
• Access to front-end system
• Analytics scoping
• Project plan
Planning
2-4 weeks
Risk Monitoring
1-2 weeks
Transaction Testing
2-4 weeks
Reporting
1-4 weeks

23. RISK MONITORING PLATFORM

24. RISK MONITORING PLATFORM – RISK ASSESSMENT

25. RISK MONITORING PLATFORM – RISK ASSESSMENT

26. RISK MONITORING PLATFORM – RISK SCORING

27. RISK MONITORING PLATFORM – RISK SCORING
Z-score
Amount Avg Amount Std Deviation Amount Weightage
1,000 800 720 0.28
450 500 452 (0.11)
58 250 240 (0.80)
37 40 50 (0.06)
200 150 50 1.00
Quantitative Calculation
Quantitative Risk Weightage
Employee Pass/Fail Test Weight (1-10) Pass/Fail Test Weight (1-10) Pass/Fail Test Weight (1-10) Score
1 Yes 9 Yes 3 Yes 6 18
2 No 0 Yes 3 Yes 6 9
3 Yes 9 No 0 Yes 6 15
4 Yes 9 Yes 3 No 0 12
5 No 0 No 0 Yes 6 6
Test 1 Test 3 Test 3
Qualitative Calculation
Org Level Score Category Name Score Business Activity Score Qualitative Risk Weightage
GOV Leadership 6 Dinner 9 Agency/Broker Activity 8 23
NA National Accts Ops 7 Entertainment 9 Sales/Prospect 8 24
TER Territories Admin 4 Projects 7 External Meeting 7 18
SPC Specialty Businesses 8 Lunch 7 Internal Meeting 5 20
FIN Internal Audit 5 Travel Transaction Fee 5 Travel-Training/Education 5 15
FORMULA:
Risk Score % = ((Quantitative Risk Weightage * ((Amount – Avg Category Amt) / Std dev Category Amt) + Qualitative Risk Weighted) / Max Score
RiskScore Calculation
Employee
Quantitative Risk
Weightage
Amount
Weightage
Qualitative Risk
Weightage Risk Max RiskScore Final Risk
1 18 0.28 23 28 250 11%
2 9 (0.11) 24 23 250 9%
3 15 (0.80) 18 6 250 2%
4 12 (0.06) 20 19 250 8%
5 6 1.00 15 21 250 8%

28. RISK MONITORING PLATFORM – PREDICTION

29. RISK MONITORING PLATFORM – PREDICTION
Case
Management
Audit
Exceptions
Predictive
Variables
Results
(Risk Score)
Logistic
Regression
Historical
Exceptions
Accuracy Check
Model

30. RISK MONITORING PLATFORM – CONTROL ASSESSMENT

31. RISK MONITORING –
EARLY WARNING

32. KEY METHODOLOGY ACTIVITIES / DELIVERABLES
• Kick-off ALL new audits with
executives (first month of
audit cycle)
• “Universe” Audit Data
Request
• High level process overview
• Executive coaching session /
vision
• Analytics Framework
• Access to front-end system
• Analytics scoping
• Project plan
Planning
2-4 weeks
• Build risk monitoring
platform
• Audit risk monitoring session
• Business risk monitoring
experience
• Log risk scenarios in the
Case Management Tool
• Early Warning System
• Technical document
Risk Monitoring
1-2 weeks
Transaction Testing
2-4 weeks
Reporting
1-4 weeks

33. ROBOTIC
PROCESS
AUTOMATION

34. KEY METHODOLOGY ACTIVITIES / DELIVERABLES
• Kick-off ALL new audits with
executives (first month of
audit cycle)
• “Universe” Audit Data
Request
• High level process overview
• Executive coaching session /
vision
• Analytics Framework
• Access to front-end system
• Analytics scoping
• Project plan
Planning
2-4 weeks
• Build risk monitoring
platform
• Audit risk monitoring session
• Business risk monitoring
experience
• Log risk scenarios in the
Case Management Tool
• Early Warning System
• Technical document
Risk Monitoring
1-2 weeks
• Transaction Selection
• Investigation
Transaction Testing
2-4 weeks
Reporting
1-4 weeks

35. KEY METHODOLOGY ACTIVITIES / DELIVERABLES
• Kick-off ALL new audits with
executives (first month of
audit cycle)
• “Universe” Audit Data
Request
• High level process overview
• Executive coaching session /
vision
• Analytics Framework
• Access to front-end system
• Analytics scoping
• Project plan
Planning
2-4 weeks
• Build risk monitoring
platform
• Audit risk monitoring session
• Business risk monitoring
experience
• Log risk scenarios in the
Case Management Tool
• Early Warning System
• Technical document
Risk Monitoring
1-2 weeks
• Transaction Selection
• Investigation
Transaction Testing
2-4 weeks
• Discussion Log
• Audit Report
• Support of analytics
Reporting
1-4 weeks

36. FINAL THOUGHTS
1. Plan your journey in 3-year increments
2. Be an Analytics & Technology advocate
3. Become a Marketing Master
4. Keep tabs on the wins
5. Disrupt the Status Quo with Innovation

37. THANK YOU