Avoiding the material weakness: Case studies in developing effective controls.
Originally presented by Melanie Dunn and Mark Spong at the 2018 Valuation Actuary Symposium.
Businesses today are more dependent on technology than ever. And, more than ever, they're looking to IT for ways to improve employee productivity, customer service and innovation. The challenge is that in order to achieve results with technology, IT and the business have to work collaboratively.
IT needs to be able to develop the right relationships and communicate with different stakeholders from a business perspective - not a technical one. As a result, the transformation of the IT department has become a top-level priority for many leading organizations. At the same time, business leaders need to strengthen their business technology IQ and play a more significant role in the governance of IT.
Learning and development professional Michelle Moore fills you in on the skills and knowledge required to help IT and the business collaborate and perform in this new environment. She will also share industry best practices for making the transition.
Best Practices: Planning Data Analytic into Your AuditsFraudBusters
These slide accompany a video training presentation from AuditNet®. The video is available to view at http://bit.ly/1eBRLiZ (registration with AuditNet.tv required)
Learning Objectives:
Gain an appreciation, based on the attendee participants, of their successes and pitfalls when planning data analytics.
Understand some common approaches to overcoming obstacles to planning data analytics based on case studies from companies and survey attendees themselves.
Learn how planning analytics can be integrated into top audit areas.
Outline an effective data request process to ensure complete and accurate extractions of data every time.
See how analytics can maximize the annual audit plan and better ensure focus is placed on organizational risk.
Businesses today are more dependent on technology than ever. And, more than ever, they're looking to IT for ways to improve employee productivity, customer service and innovation. The challenge is that in order to achieve results with technology, IT and the business have to work collaboratively.
IT needs to be able to develop the right relationships and communicate with different stakeholders from a business perspective - not a technical one. As a result, the transformation of the IT department has become a top-level priority for many leading organizations. At the same time, business leaders need to strengthen their business technology IQ and play a more significant role in the governance of IT.
Learning and development professional Michelle Moore fills you in on the skills and knowledge required to help IT and the business collaborate and perform in this new environment. She will also share industry best practices for making the transition.
Best Practices: Planning Data Analytic into Your AuditsFraudBusters
These slide accompany a video training presentation from AuditNet®. The video is available to view at http://bit.ly/1eBRLiZ (registration with AuditNet.tv required)
Learning Objectives:
Gain an appreciation, based on the attendee participants, of their successes and pitfalls when planning data analytics.
Understand some common approaches to overcoming obstacles to planning data analytics based on case studies from companies and survey attendees themselves.
Learn how planning analytics can be integrated into top audit areas.
Outline an effective data request process to ensure complete and accurate extractions of data every time.
See how analytics can maximize the annual audit plan and better ensure focus is placed on organizational risk.
Identifying, understanding and evaluating an organization’s most significant risk areas will set the foundation for a robust enterprise risk management (ERM) program. This sample guide outlines an effective and proven approach to building ERM capabilities that will ultimately enhance corporate governance, align and integrate varying views of risk and risk management, and respond to the changing business environment.
Spend Analysis Identified as Key to CPO SuccessBill Kohnen
Spend Analysis is the most powerful process and tool available to Purchasing Leaders. However, only the highest performing organizational are taking full advantage of the proven and guaranteed cost, efficiency and organizational benefits.
Summarized version of Key Performance Indicators (KPIs) for Security Operatio...MaryamAlHumam
This is a summarized version of the original article by Dublin City University.
A way of measuring the success or failure of a business goal, function or objective.
Model Governance and Validation: Best Practices and Common PitfallsMarkSpong1
Modeling is the cornerstone of the actuarial profession. As insurance products grow in complexity, actuarial models too become increasingly complex and subsequently prone to errors. In this session, the presenter will go through common model governance frameworks in the life insurance industry, best practices and useful tools in model validation exercises, as well as common pitfalls of existing model risk management structures.
2018 ValAct - Session 22 - Material WeaknessMarkSpong1
Recent high profile material weakness disclosures have left some wondering: who’s next? The session will provide background on the causes and impacts of the material weakness and then focus on effective controls on financial reporting. We’ll spend most of the time discussing case study scenarios of common pitfalls when developing controls.
At the conclusion of the session, attendees will be able to:
• Identify the common causes of significant deficiency and material weakness audit opinions;
• Evaluate the impact of a material weakness assessment on audit fees and other financials; and
• Develop a plan to prevent or remediate a material weakness assessment.
Identifying, understanding and evaluating an organization’s most significant risk areas will set the foundation for a robust enterprise risk management (ERM) program. This sample guide outlines an effective and proven approach to building ERM capabilities that will ultimately enhance corporate governance, align and integrate varying views of risk and risk management, and respond to the changing business environment.
Spend Analysis Identified as Key to CPO SuccessBill Kohnen
Spend Analysis is the most powerful process and tool available to Purchasing Leaders. However, only the highest performing organizational are taking full advantage of the proven and guaranteed cost, efficiency and organizational benefits.
Summarized version of Key Performance Indicators (KPIs) for Security Operatio...MaryamAlHumam
This is a summarized version of the original article by Dublin City University.
A way of measuring the success or failure of a business goal, function or objective.
Model Governance and Validation: Best Practices and Common PitfallsMarkSpong1
Modeling is the cornerstone of the actuarial profession. As insurance products grow in complexity, actuarial models too become increasingly complex and subsequently prone to errors. In this session, the presenter will go through common model governance frameworks in the life insurance industry, best practices and useful tools in model validation exercises, as well as common pitfalls of existing model risk management structures.
2018 ValAct - Session 22 - Material WeaknessMarkSpong1
Recent high profile material weakness disclosures have left some wondering: who’s next? The session will provide background on the causes and impacts of the material weakness and then focus on effective controls on financial reporting. We’ll spend most of the time discussing case study scenarios of common pitfalls when developing controls.
At the conclusion of the session, attendees will be able to:
• Identify the common causes of significant deficiency and material weakness audit opinions;
• Evaluate the impact of a material weakness assessment on audit fees and other financials; and
• Develop a plan to prevent or remediate a material weakness assessment.
Building the Tax Team of the Future to Navigate the Storm of Regulatory Change Sovos
As tax moves from a back-office function to an integrated and strategic position, tax professionals must have a data-driven, business, and security mindset.
Watch onDemand by using this link: https://goo.gl/8trFsv
Internal Control Certification – It’s Not Just an Accounting Thing (Credit Un...NAFCU Services Corporation
In this recorded 2012 NAFCU Technology & Security Conference session, you will learn about the internal control certification process and how it impacts more than just the accounting department. Discover the importance of becoming internal control certified, gain insight on the impact of recent regulation change from SAS70 to SSAE 16, and get a walkthrough of the process and audit reports (Type I & Type II) as well as discuss the involvement from the “technology side of the house,” including documentation of systems controls, disaster recovery and more!
Presented by Jeff Ziliani, CPA, Director of Finance and Administration, Burns-Fazzi, Brock
Burns-Fazzi, Brock is the NAFCU Services Preferred Partner for Executive Benefits and Compensation Consulting and Long Term Care Insurance.
More information at http://www.nafcu.org/bfb
Software Quality Dashboard Benchmarking StudyJohn Carter
Software metrics best practices from a benchmarking assignment that indicates how software metrics are reported to management and used to drive behavior. We learned how leading companies used dashboards to report on quality progress and improvement results. We found the best organizations focused on the vital few metrics but also had automated systems with the ability to drill down on metrics at the divisional and team levels. In addition, the best normalized the metrics by number of customers or complexity. They systematically used root cause analysis to analyze bugs in the field. The SW Quality metrics often went beyond the strict definition of quality in that they also measured release predictability and feature expectations. Finally, the best companies used external benchmarks to set their quality targets.
Slideshare os you are not alone_0818_final_compressedMilestone Group
There is a renewed interest within both established and recent outsourcing initiatives in addressing the challenges around NAV Oversight and Backup NAV
Hanrick Curran Audit Training - Internal Controls - March 2013Matthew Green
Training delivered to assisting audit staff as part of their continuing professional development/education (CPE/CPD). Provided in a 60 minute session with substantial discussion and interaction.
Have you ever wondered how search works while visiting an e-commerce site, internal website, or searching through other types of online resources? Look no further than this informative session on the ways that taxonomies help end-users navigate the internet! Hear from taxonomists and other information professionals who have first-hand experience creating and working with taxonomies that aid in navigation, search, and discovery across a range of disciplines.
Acorn Recovery: Restore IT infra within minutesIP ServerOne
Introducing Acorn Recovery as a Service, a simple, fast, and secure managed disaster recovery (DRaaS) by IP ServerOne. A DR solution that helps restore your IT infra within minutes.
This presentation by Morris Kleiner (University of Minnesota), was made during the discussion “Competition and Regulation in Professions and Occupations” held at the Working Party No. 2 on Competition and Regulation on 10 June 2024. More papers and presentations on the topic can be found out at oe.cd/crps.
This presentation was uploaded with the author’s consent.
Sharpen existing tools or get a new toolbox? Contemporary cluster initiatives...Orkestra
UIIN Conference, Madrid, 27-29 May 2024
James Wilson, Orkestra and Deusto Business School
Emily Wise, Lund University
Madeline Smith, The Glasgow School of Art
0x01 - Newton's Third Law: Static vs. Dynamic AbusersOWASP Beja
f you offer a service on the web, odds are that someone will abuse it. Be it an API, a SaaS, a PaaS, or even a static website, someone somewhere will try to figure out a way to use it to their own needs. In this talk we'll compare measures that are effective against static attackers and how to battle a dynamic attacker who adapts to your counter-measures.
About the Speaker
===============
Diogo Sousa, Engineering Manager @ Canonical
An opinionated individual with an interest in cryptography and its intersection with secure software development.
This presentation, created by Syed Faiz ul Hassan, explores the profound influence of media on public perception and behavior. It delves into the evolution of media from oral traditions to modern digital and social media platforms. Key topics include the role of media in information propagation, socialization, crisis awareness, globalization, and education. The presentation also examines media influence through agenda setting, propaganda, and manipulative techniques used by advertisers and marketers. Furthermore, it highlights the impact of surveillance enabled by media technologies on personal behavior and preferences. Through this comprehensive overview, the presentation aims to shed light on how media shapes collective consciousness and public opinion.
Media as a Mind Controlling Strategy In Old and Modern Era
2018 Val Act: Session 22 - Material weakness
1. Session 22PD:
Avoiding the material weakness:
Case studies in developing effective
controls
MELANIE DUNN, FSA, MAAA
MARK SPONG, FSA, CERA, MAAA
August 27, 2018
2. What do we mean by deficiencies and weaknesses?
A material weakness is a deficiency, or a combination of deficiencies, in
internal control over financial reporting, such that there is a reasonable
possibility that a material misstatement of the company's annual or interim
financial statements will not be prevented or detected on a timely basis
A significant deficiency is a single weakness or a combination of
weaknesses in the internal controls associated with financial reporting, that is
less severe than a material control weakness and yet is sufficient to merit the
scrutiny of those responsible for administering an entity's financial reporting
*Source: Auditing Standard No. 5, Public Company Accounting Oversight Board
3. Material weaknesses may be more common than you think
Internet Retail Company Reports Material Weakness:
Second Control Deficiency in Three Years
Audit Analytics
Global Retailer finds
‘material weakness’ in
controls over
accounting leases
Reuters
Insurance Company
Announces GAAP
Restatement
Business Insider
Leading Life Insurer
Discloses Its Second
Material Weakness
This Year
Bloomberg
Large Insurer shares
fall 10% on ‘material
weakness’ warning
Financial Times
School Districts get
financial
accountability
grades
Business Insider
A Red Flag
on Auto
Company
New York Times
Aerospace company says
numbers are unreliable
due to control weakness
MarketWatch
Insurer
Stock
Tanking
Today After
Finding
‘Material
Weakness’
The Street
4. Annual assumption review
Historical examples of material weakness triggers
Discovery of a material financial misstatement
often indicates a weakness in underlying
controls on financial reporting.
Material misstatements
For example, in 2015, an insurer reported a
material restatement to 2013 financials due to
an error in the 2013 annual assumption review.
In March of 2018, another insurer disclosed a
material weakness after reserves on a VA block
were determined to be too high and released.
Releasing excess reserves
In 2015, a third insurer disclosed insufficient
controls on implementation of methodology and
assumption changes for LTC claim reserves.
Controls on methodology changes
5. Market Reputation Financial
Remediation
effort
Stock price
drop
Lack of trust Costs of
remediation
Strategic priorities
must be shifted
How would you, your team, and your department be affected by a
material weakness?
Consequences of a material weakness
Morale
Positive outlook
eroded
8. Spreadsheet SNAFU
“This isn’t a model, it just organizes the results. The
governance standards for models would be overkill!”
• The valuation model works flawlessly with top notch
controls
• Results are dumped into Excel, transformed into usable
form, and aggregated with other products via links and
macros
• But business day 8 comes along:
– A last minute update to the process is not flowing
through correctly
– New products are not captured
– Balances are transposed
During the normal course of quarter close, management is
not able to prevent misstatements on a timely basis.
1
WHAT • What are the control standards at your
company for End User Computing
applications, such as Excel?
2
• Models are usually defined as having input,
processing and output components. Why
does End User Computing tend to fall under
the radar?
WHY
3
• How can actuaries structure and design
controls to address the underlying issue?
HOW
End User Computing Hand-offsAssumptions
Model StakeholdersData Emergency Protocol
9. Assumption Malfunction
“We update lapse and mortality every year and have a clear
oversight process. Otherassumptionsstillseemappropriate.”
• The assumption inventory for a critical high risk model
appears to be complete and annually reviewed
• The model is complex and certain assumptions
associated with mean reversion are not well understood
by the assumption review committee
• As a result, there is a lower degree of scrutiny on those
assumptions plus lack of scrutiny on implicit
assumptions
• The result is economic simulations that are not reflective
of the prolonged low interest rate environment
The assumption review process was not designed to place
sufficient scrutiny on technical aspects of modeling design.
1
2
3
• Why might controls around assumption
management be challenging to keep up?
• How can actuaries structure and design
controls to address the underlying issue?
WHAT • What do the assumption review and update
process look like at your company?
WHY
HOW
End User Computing Hand-offsAssumptions
Model StakeholdersData Emergency Protocol
10. Hand-off Hardships
“We are the model owners and they are the model users”
• A domestic actuary is the “model owner” for a model and
operation is outsourced to a “model user” in another country
• Hand-offs of model updates and review occur over email, since
the model owner and model user don’t work the same hours
• While attributing impacts between quarters, the model owner
discovers an error from incorrectly mapping new issues during
routine updates in Q2
• The model user hadn’t been educated on model governance
requirements, and didn’t know what level of review was
required for the mapping updates
• The model owner didn’t know that the mapping updates had
been made, and didn’t review them in Q2
Hand-offs have increased risk, and effective controls execution
requires clear standards for communication when processes and
data get handed off.
1
WHAT • What does a hand-off look like during
quarter end at your company?
2
• Why is just emailing someone a model
with quarter close updates a problem?
WHY
3
• How can actuaries structure and design
controls to address the underlying
issue?
HOW
End User Computing Hand-offsAssumptions
Model StakeholdersData Emergency Protocol
11. Data Disaster
“Of course we do reasonability checks on the inforce data,
but we don’t have time to completely audit it”
• The admin system is dropping a small number of
policies each quarter in the inforce data feed
• Data controls are focused on quarter over quarter
changes of counts and face amounts, so nothing stands
out
• After 18-24 months reserve balances are significantly
off
The existing control was operating as designed but still did
not meet the objective and reserves are misstated.
1
WHAT • What data quality checks would you
realistically expect to routinely run on
inforce files?
2
• Big changes from period to period are
noticeable. Why might small changes like
this still constitute a significant deficiency?
WHY
3
• How can actuaries structure and design
controls to address the underlying issue?
HOW
End User Computing Hand-offsAssumptions
Model StakeholdersData Emergency Protocol
12. Modeling Mishap
“I’m just relying on what the pricing team provided”
• After pricing a new product, the pricing team hands off
the pricing model to valuation
• Valuation independently defines business requirements
for the inforce model and determines whether any
features not modeled for pricing need to be modeled
• Risk and modeling teams are not involved
• The risk team just checks the results at the end
• Since pricing decisions are made before valuation,
modeling, and risk become involved, those stakeholders
do not have input into the decisions
This may result in modeling and risk teams that do not have
the practical authority to design and perform effective
controls.
1
WHEN • How early do the risk, modeling, and
valuation teams get involved in the pricing
process at your company?
2
• Why might the pricing team have more
influence within the organization?
WHY
3
• How can actuaries coordinate between
teams to address the underlying issue?
HOW
End User Computing Hand-offsAssumptions
Model StakeholdersData Emergency Protocol
13. Error Emergency
“We continuously keep track of modeling issues and address
them as soon as possible”
• An analyst finds a potential coding error in a production
model on business day 3, two days before results are booked
• There is limited time to thoroughly investigate to confirm the
error or to assess its materiality
• Multiple team members work late and the root cause
appears to be identified and reasonable to address
• A fix is implemented just in time and the impact on financials
is attributed to a methodology enhancement
• After quarter close, it was discovered that the change had
unintended consequences for related products
No emergency protocol was in place to guide action when an
issue was found during quarter close.
1
WHAT • What is the emergency procedure at your
company if an issue is found during the
quarter close process? Is it a formalized or
informal procedure?
2
• Why is it a problem to rely on a judgment
call from management when an issue pops
up during quarter close?
WHY
3
• How can actuaries structure and design
controls to address the underlying issue?
HOW
End User Computing Hand-offsAssumptions
Model StakeholdersData Emergency Protocol
