Robotic Process Auditing

Robotic Powered Auditing (“RPA”)
Rich Lanza | Managing Director
Audit Innovation
© Grant Thornton LLP. All rights reserved.
About Jim Kaplan, CIA, CFE
 President and Founder of AuditNet®,
the global resource for auditors
(available on iOS, Android and
Windows devices)
 Auditor, Web Site Guru,
 Internet for Auditors Pioneer
 IIA Bradford Cadmus Memorial Award
Recipient
 Local Government Auditor’s Lifetime
Award
 Author of “The Auditor’s Guide to
Internet Resources” 2nd Edition
2
1
2

About AuditNet® LLC
• AuditNet®, the global resource for auditors, serves the global audit
community as the primary resource for Web-based auditing content. As the first online
audit portal, AuditNet® has been at the forefront of websites dedicated to promoting the
use of audit technology.
• Available on the Web, iPad, iPhone, Windows and Android devices and
features:
• Over 3,100 Reusable Templates, Audit Programs, Questionnaires, and
Control Matrices
• Webinars focusing on fraud, data analytics, IT audit, and internal audit
with free CPE for subscribers and site license users.
• Audit guides, manuals, and books on audit basics and using audit
technology
• LinkedIn Networking Groups
• Monthly Newsletters with Expert Guest Columnists
• Surveys on timely topics for internal auditors
Introductions
3
HOUSEKEEPING
This webinar and its material are the property of AuditNet® and its Webinar partners. Unauthorized usage or
recording of this webinar or any of its material is strictly forbidden.
• If you logged in with another individual’s confirmation email you will not receive CPE as the confirmation login is
linked to a specific individual
• This Webinar is not eligible for viewing in a group setting. You must be logged in with your unique join link.
• We are recording the webinar and you will be provided access to that recording after the webinar. Downloading
or otherwise duplicating the webinar recording is expressly prohibited.
• If you said you would like CPE you must attend the entire Webinar to receive CPE (no partial CPE will be
awarded).
• If you meet the criteria for earning CPE you will receive a link via email to download your certificate. The official
email for CPE will be issued via NoReply@gensend.io and it is important to white list this address. It is from this
email that your CPE credit will be sent. There is a processing fee to have your CPE credit regenerated post event.
• Submit questions via the chat box on your screen and we will answer them either during or at the conclusion.
• You must answer the survey questions after the Webinar or before downloading your certificate.
4
3
4

IMPORTANT INFORMATION
REGARDING CPE!
• ATTENDEES - If you attend the entire Webinar you will receive an email with the link to download
your CPE certificate. The official email for CPE will be issued via NoReply@gensend.io and it is
important to white list this address. It is from this email that your CPE credit will be sent. There is a
processing fee to have your CPE credit regenerated post event.
• We cannot manually generate a CPE certificate as these are handled by our 3rd party provider. We
highly recommend that you work with your IT department to identify and correct any email delivery
issues prior to attending the Webinar. Issues would include blocks or spam filters in your email
system or a firewall that will redirect or not allow delivery of this email from Gensend.io
• We are not responsible for any connection, audio or other computer related issues. You must have
pop-ups enabled on you computer otherwise you will not be able to answer the polling questions
which occur approximately every 20 minutes. We suggest that if you have any pressing issues to see
to that you do so immediately after a polling question.
• CPE for this event will be non-NASBA.
The views expressed by the presenters do not necessarily represent the views, positions, or opinions
of AuditNet® LLC. These materials, and the oral presentation accompanying them, are for educational
purposes only and do not constitute accounting or legal advice or create an accountant-client
relationship.
While AuditNet® makes every effort to ensure information is accurate and complete, AuditNet®
makes no representations, guarantees, or warranties as to the accuracy or completeness of the
information provided via this presentation. AuditNet® specifically disclaims all liability for any claims
or damages that may result from the information contained in this presentation, including any
websites maintained by third parties and linked to the AuditNet® website.
Any mention of commercial products is for information only; it does not imply recommendation or
endorsement by AuditNet® LLC
Disclaimer
5
6

Additional Disclaimer
This Grant Thornton LLP presentation is not a comprehensive analysis of the subject matters
covered and may include proposed guidance that is subject to change before it is issued in final
form. All relevant facts and circumstances, including the pertinent authoritative literature, need
to be considered to arrive at conclusions that comply with matters addressed in this
presentation. The views and interpretations expressed in the presentation are those of the
presenters and the presentation is not intended to provide accounting or other advice or
guidance with respect to the matters covered
For additional information on matters covered in this presentation, contact your Grant Thornton
LLP adviser
AuditNet® and cRisk Academy
• If you would like forever access to
this webinar recording
• If you are watching the recording,
and would like to obtain CPE
credit for this webinar
• Previous AuditNet® webinars are
also available on-demand for CPE
credit
http://criskacademy.com
http://ondemand.criskacademy.com
Use coupon code: 50OFF for a
discount on this webinar for one week
8
7
8

Richard B. Lanza, CPA, CFE, CGMA
• Managing Director in Innovation for Grant Thornton, LLP
• Over 25 years of ACL, Excel and other software usage
• Received the outstanding achievement in business award by the Association of
Certified Fraud Examiners for developing the publication Proactively Detecting
Fraud Using Computer Audit Reports as a research project for the IIA
• Recently was a contributing author of:
• Detecting Corruption with Analytics: A Roadmap – The International
Institute for Analytics
• Global Technology Audit Guide (GTAG #13) Fraud In An Automated
World – Institute Of Internal Auditors.
• Cost Recovery – Turning Your Accounts Payable Department Into A
Profit Center – Wiley And Sons.
• Data Analytics: A Roadmap for Expanding Capabilities (published 2018
in partnership with the IIA's Internal Audit Foundation)
• In 2015, discovered a new textual analytic technique using letters called the
Lanza Approach to Letter Analytics (LALA)TM
The views expressed by the
presenters do not necessarily
represent the views, positions, or
opinions of Grant Thornton, LLP.
These materials, and the oral
presentation accompanying
them, are for educational
purposes only and do not
constitute accounting or legal
advice or create an accountant-
client relationship.
rich.lanza@us.gt.com Richard B. Lanza, CPA, CFE, CGMA
9
1 Identify the top opportunities for robotic process automation in audit processes.
2 See where you can become a “citizen programmer”, building the bots in your business processes.
3 Walk through case studies of applied audit-focused RPA
Learning objectives
10
4 Consider the limitations and benefits of RPA into a total cost of ownership exercise.
9
10

Mankind's Fascination with Robots
Since the 1920's people have been fascinated by the idea of "robots"
• A quick scan of popular culture shows us just how interesting robots
and AI have been for the past century as subject matter.
11
Distrust of Technology
Audit report issued by Marwick, Mitchell & Co. based on their audit of Northern
Shoe Company, Duluth, Minnesota - February 5, 1908
The adding machine in its riper place is an excellent institution but when it is
resorted to on every occasion for the simple addition of two and two it becomes not
only useless but dangerous…….Apart altogether from the time wasted in this way,
the use of the machine which at first may be due to laziness on the part of the
employee becomes at length a necessity for it is a well-known fact that the constant
use of any mechanical calculator leads inevitably to trophy of the calculating faculty.
A man who cannot calculate nimbly and accurately is of very little use as a
bookkeeper. We would strongly advise that the adding machine be removed from
the office or its use very much restricted.
https://caats.ca/
12
11
12

Specific Tech Driving Modern Robotics
13
Machine
Learning
Algorithms
Facial
Recognition
Software
Predictive
Analytics
Natural
Language
Processing
3D Printing
Geotagging/GPS
location
The Internet of
Things
Optical
Character
Recognition
Ideal Attributes For Using Robotics
• Simple and Tedious (Process complexity is low)
• Repetitive (The process will be run numerous times in a given period)
• Relatively Static (The process does not change much over time)
• Beneficial to run on a schedule (continuously monitoring a control provides
additional benefits
• Costly to Perform Manually
14
13
14

"Robots" In The Context of Audit
• In the audit automation world, a "robot" is a digital
"worker" that performs a repetitive task
• These digital "bots" have been in use for years in other
industries (if you've ever interacted with a chat bot, or
Siri you've seen robotics tech in action).
• Some technologies that physical robots and AI rely on
can be useful (predictive models, machine learning
algorithms).
• Robots in audit can be automated controls, scripts than
run on a scheduler or combine either of these two items
with AI to do work more efficiently.
15
Value proposition
16
Why?
How?
People
Process
Technology
Insights
Efficiency
Analytics
Automation
A.I.
15
16

(Automated)
Audit Data Analytics
Analytics programs
18
IRP
Issuer risk profiling
• Predictive analytics
• Financial reporting fraud
• Restatement
• Material weakness
• Bankruptcy
• Governance concerns
• Litigation
FSP
Forensic support program
• Forensic & analytics expertise
applied to selected audits
• Fraud brainstorming
• Incremental / tailored
management inquiry
• Journal entry testing
• Tailored analytics
ADA
Audit data analytics
• Whole ledger analytics
• Transactional scoring
• Account combinations
• Numerical / digital
• Text / letter
• Semantic
17
18

Analyze
Report
Transform
Validate
System Specific Scripts
Ensures complete
& accurate client data
Extract
End-to-End automation
Whole Ledger Analytics
19
Auto Map and Tag
Calculated fields, entry types
Pre-Set Quality Tests
DR = CR, G/L
completeness testing
Scripted Analytics
100+ analytics organized
into four areas
Pre-Formatted Workpapers
Excel spreadsheets, Power BI,
mobile apps
Audit Team Interaction
Data + auditor expertise =
quality and insights
Assess and Enhance
190+ benchmarks for
insights and efficiency
Augment
Benchmark
Overcoming Data Challenges
• Normalizing data is 80% of the time (in the beginning)
• “By most accounts, 80 percent of the development effort in a big data project goes
into data integration and only 20 percent goes toward data analysis.” —Intel
Corporation
• Data is in every process
• It may not be ERP / It may be in your “Big Data”
• 90% of data is text
• Audit (Internal & External) is the best partner to get the data
• They are independent / Not proving the data is a scope limitation
• Tend to establish the most secure data warehouses
20
19
20

Automated Data Normalization
• Store procedures for data cleanup once
• Create a normalized set of data fields named by YOU
• Ensure data quality tests are run prior to analysis
• Automate these routine tasks to increase analyst’s time
• Enrich the data by organizing it by type codes
21
Automating Data E.T.L.
• All of the Company's data is captured in an SAP G/L
• Audit team had to budget almost 100 hours just on importing and combining
various report extracts
• Data analytics and innovation were introduced in the current year audit
• Data import process was reduced from 25 hours /quarter to only 2
hours/quarter
22
21
22

404: Training Data Not Found
• Robots are not perfect; and will fail, behave unexpectedly and trip
over their own feet (just like me from time to time).
• Robots will never replace auditors; but instead will make their jobs
easier and allow them more free time to innovate.
23
Image from the DARPA
Robotics Challenge
Whole ledger analytics:
transactional scoring
24
Top entries SCORE_RATIO INC_STMT_IMPACT BAL_SHEET_IMPACT Description Posting Date
1 0.338 (216,678.08) 216,678.08 To balance to subledger 12/31/2016
Abs.Income
StatementImpact
Risk Score Ratio
23
24

Other Analytics Solutions
25
ACCOUNTS PAYABLE
Performs control
analysis, proactive fraud
testing through vendor
risk ranking and cost
recovery detection for
the procure to pay
process.
75 SCRIPTS
REVENUE
Identifies revenue
transactions that
indicate a higher risk of
material misstatement
as well as control
analysis.
50 SCRIPTS
P-CARD
Identify risky P-Card
transactions and usage
behaviors.
30 SCRIPTS
TRAVEL & EXPENSE
Analyze travel and
expense data to identify
inappropriate or
suspicious employee
expenses, and manage
T&E efforts.
20 SCRIPTS
FCPA Third Party
Vendor
Risk-rank vendors by
elements of risk that
may result in a FCPA
violation, individual
vendor analysis and
predictive analytics to
predict transactions
costs by vendor.
25 SCRIPTS
Whole Ledger Analytics Dashboard
WB58
25
26

WB58 after this slide, insert trending by month and benchmarking toolkit slide from WLA summit training?
Wolohan, Brian, 5/13/2019

Audit evidence from external data
27
Sales Correlates with:
Client Website Traffic + App Usage
Account Openings Correlate with:
Web Search for Client Name + App Downloads
Benchmarking WLA for machine learning
• Journal Statistic Examples
• Average lines per journal
• % of journals posted by day
• Average income effect per journal
• User Statistic Examples
• Average entries per user per day
• % of manual to automated entries
• WLA Result Examples
• Entries and line items by WLA report (e.g., round dollar journals)
• Risk score average, median and standard deviation
28
27
28

Robotic Process
Automation
Process Characteristics for RPA
30
29
30

Example Target Functions and Process Areas
Revenue
Cycle
Information
Technology
Procure
to Pay
Order
to Cash
Record to
Report
Supply
Chain
Insurance
Authorization
Datacenter
Customer
Master
Gen. Acct. /
Close
Vendor
Master
CRM &
Customer
Service
Network
Operations
Sourcing /
Contract
Management
Reporting
Credit /
Contract
Demand
Management
Charge
Posting
Security
Admin.
PO Process
Order
Process
External
Reporting
Materials
Management
Training &
Development
Service Desk
Goods
Receipt
Treasury
Logistics /
Delivery
Capacity
Flow
Management
Write-offs
Desktop
Support
Invoice
Process
Billing / Disp.
Res.
Tax
Transport &
Logistics
Performance
Metrics
Database
Admin.
Collections
Payment
Process
FP & A
Carrier
Management
Cash PostingApplications
Cash
Application
Controllership T & E
Returns
Management
Functions (L1)
High level aggregations of
company functionality
Process Areas (L2)
Bundles of processes that belong
to the same area of responsibility
Industry-
Specific Ops
In addition to the cross-industry
functions listed at right, we find RPA
opportunities in industry-specific
processes such as loan servicing
(Banks), claims processing (Insurance),
rebates and tracings (Manufacturing),
etc.
Denials
Management
31
User Access Review Controls
Grant Thornton automated user access control testing for the following attributes:
• Whether access was approved by appropriate personnel
• Whether the approval occurred within the required time frame
• If the access is set to be revoked then the account is flagged for immediate attention and an alert is sent to the
control owner.
Human Resources Roles Validation
The clients control stated that HR personnel with access to modify payroll information must also have a role assigned
that prevents modification of their own payroll information. Grant Thornton automated this test to verify that all HR
personnel are restricted from modifying their own payroll fields.
SQL Database Backup Jobs
Grant Thornton automated a test to verify that SQL jobs are in place to backup SQL databases on a regularly
scheduled basis. This automated test also included tests for the following attributes:
• The backup jobs are configured to backup the full database per the backup requirements
• The backup alerts are set to notify personnel when a backup fails or is completed successfully
• The alerts are configured to notify appropriate personnel
Removal of Inactive SAP account access
Grant Thornton automated a test for inactive SAP account access that is greater than the Company's specified
threshold. Any account that has not accessed the system within this threshold is flagged for immediate attention and
an alert is sent to the control owner for access to be removed.
Control Automation Examples
32
31
32

33
Use Case Example
User access review approval testing
Business Benefits:
 Reduction in control testing time
 Increased assurance through test of control samples (can include 100%
population testing)
 Auditor capacity shifted to handle more complex tasks & exceptions
ICA
Business Issue:
 Control testing that is time consuming (hours) and
low value for management
Import the testing
population data Execute the test in R
Clean the data in either
MLS or R
The data gets
exported from MLS
into a SQL database
The data is
visualized in a
PowerBI report
API
Minimal human interaction
Changing the Nature of Risk Mgmt
Before Adjustments to Microsoft Control (user
access control):
• User access for SAP sampled at 25 users per
quarter, catching potential access issues every
three months
• Excessive time spent testing – 2 hours per
control per year
Automated control monitoring
using advance analytics –
efficient value protection
Sample based control testing -
basic risk management
Partial Assurance
Before
2 hours per control
Value Protection
After
<5 minutes per control
Manual Compliance Assessment Automated Compliance Monitoring
After Adjustments to Microsoft Control (user
access control):
• SAP user access tested at 100%, in real time
• Testing performed in seconds or minutes
• Microsoft responds to user access
problems in real time – as opposed to
quarterly
Pass / Fail
Control 1 Pass
Control 2 Pass
Control 3 Pass
Control 4 Fail
Control 5 Pass
Time savings of 95%+ per control
– from risk mitigation to value protection
Efficiency
Value Protection
Before
After
34
33
34

Robotic Powered
Auditing
Workflow automations
36
Example:
property, plant
and equipment
Performs audit procedures:
• Prepares fixed asset rollforward
• Reconciles to general ledger
• Recalculates depreciation expense
• Identifies most efficient selection approach
• Generates selection for test of details
Scans for notable activity:
• Disposals in ending sub ledger
• Additions disposed of in the same year
• Assets whose standard life deviates from the norm
35
36

Employee Benefit Plan Loans Analyser
Automating procedures over participant loans
Data Receipt and Ingestion
 Receive the loans detail report
from the Record Keeper
 Complete the "EBP Loans Tool
- Data Request Form"
 Analytics Team cleanses the
loan detail report and imports
into ACL.
Step one Step two
Fill Out the Dialog Box
 Data fields are input in
software dialog boxes
 Client specific variables are
input into dialogs (ie. each
participant in the Plan can
only have 2 loans).
Step three
Run the Script / Export Results
 Software script is run
 Non-compliant participant
loans are identified
 Dashboard in Excel acts as
the engagement team
workpaper.
Step four
Evaluate the Results
 Dashboard with notable items
 Investigation is performed and
results are documented.
37
Continuous automation
38
Example:
confirming
customer activity
and balances
Generated hundreds of confirmations in under 3 minutes
• Extracted each customer's transaction and balance detail
• Prepared and distributed e-mail confirmations
• Provided customers with one-click confirmation option
Processed responses automatically
• Electronically logged replies to confirmations
• Created automated workpapers
Bespoke automation
solution was designed,
developed, and deployed
in less than one week
37
38

People, Process and
Technology
Auditor of the future skillset
• Ability to reimagine the audit
• Data analytics mindset
 Asking the right questions
 Extracting, transforming and loading relevant data
 Applying appropriate data analytics techniques
 Interpreting and sharing the results with stakeholders
• Critical thinking (questioning mind, weighing evidence)
• Communication:
• Interaction with a team and with the client (asking the right question and listening)
• Writing – communication of facts and articulation of persuasive argument
• Ability to collaborate with people of different geographies and varying skill sets
• Selling new innovation / change management
40
39
40

Desired analytic-enabled auditor skills
• Analytics mindset
• Analytic technical skills
• Data management and acquisition
• Database modeling
• Tool development and programming
• Predictive modeling and statistics
• Other Skills
• IT project management
41
Robotic Process Automation Limitations
RPA cannot read any data that is non-electronic with unstructured inputs
• An example would be input such as paper invoices. In this case, RPA will only work with
a collection of other implemented technologies (such as OCR) required to make it digital
and structured.
RPA requires some form of static consistency
• For example, invoices may be received in different formats, with fields placed in different
areas. For a ‘Bot’ to be able to read an invoice, all supplier invoices must be received in
the same format with the same fields.
• Although robots can be trained by exception to read different fields, they cannot read
multiple different formats – unless these are all digital and configured separately.
42
41
42

Robotic Process Automation Limitations
RPA is not a cognitive computing solution
• It cannot learn from experience and therefore has a ‘shelf life’.
• As processes evolve – for example, through the introduction and use of other technologies
— they may become redundant and require changes.
• It is therefore wise for a company to examine the process prior to building a ‘Bot’. Applied
to a process that is inefficient and/or on the way out, that shelf life may be reduced to just a
year.
Applying RPA to an inefficient process will not fix it – "paving cowpaths"
• RPA is not a Business Process Management solution and does not bring an end-to-end
process view
• The same goes for out of date infrastructure – RPA will only mask the underlying issues.
• Clients should focus first on addressing the root causes of their process or technology
inefficiencies and then apply RPA to maximize the benefits.
43
Start with what you have
Your data can be a rich source
of insights and business
intelligence. Inexpensive tools
can be used to get started in
analyzing this data.
Ask for help.
There is no need to go it alone;
we love solving problems and
helping clients to
innovate. Having innovative
clients helps us to innovate and
create even more value. It’s a
virtuous cycle.
Lessons Learned
44
Demonstrate value
early and often.
Smaller wins can fund bigger
wins and help foster
institutional momentum.
43
44

Questions
45
AuditNet® and cRisk Academy
46
• If you would like forever access to
this webinar recording
• If you are watching the recording,
and would like to obtain CPE
credit for this webinar
• Previous AuditNet® webinars are
also available on-demand for CPE
credit
http://criskacademy.com
http://ondemand.criskacademy.com
Use coupon code: 50OFF for a
discount on this webinar for one week
45
46

Thank You!
47
Jim Kaplan
AuditNet® LLC
1-800-385-1625
Email: webinars@auditnet.org
www.auditnet.org
Richard B. Lanza, CPA, CFE, CGMA
Contact Information
D: +1 732 516 5527
M: +1 732 331 3494
Email: rich.lanza@us.gt.com
47

Robotic Process Auditing

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Robotic Process Auditing

Similar to Robotic Process Auditing (20)

More from Jim Kaplan CIA CFE

More from Jim Kaplan CIA CFE (20)

Recently uploaded

Recently uploaded (20)

Robotic Process Auditing