04/21/2011 Meeting - Auditing with Data Analytics

1Copyright © 2010 Deloitte Development LLC. All rights reserved.

ACFE

April 21, 2011

Taking Your Audits to the Next Level with Data Analytics


Speakers

Dale LivezeySenior Manager

NorPac Regional Technology Leader

Deloitte & Touche LLP

Audit and Enterprise Risk Services

San Francisco, CA 415-783-4208

[email protected]


• Benefits of Analyzing Data

• Audit Planning with Data Analytics Integrating Data Analysis into the Audit

plan

Planning Considerations

Best Practices for Sustainability

• Case StudyExample Deliverables

• Business Cycle ExamplesDetailed Data Analytics by area

• Data Analysis Execution Phases

Agenda


Benefits of Analyzing Data


More efficient and effective manual testing

Assist in root cause analysis

Test Validity and accuracy of reports

Target and assess specific risk areas

Identify control weakness / effectiveness gaps

Data Analytics can help in many aspects of business process testing

Overall more effective

control testing

services for our clients

Data analysis improves the quality, effectiveness and efficiency of audits

• Performs 100% recalculations and verification of transactions in a timely and repeatable fashion

• Compares data from multiple / disparate systems

• Provides business insights and identifies process improvement opportunities

• Presents quantifiable results from analysis based on complete population



Why Use Data Analytics?

Enhanced Risk Identification

• Early identification of risks and trends

• Enhanced capabilities for identifying fraud and management override of controls

Deeper Insights

• Fact-based insights that are difficult to glean from interviews

Enhanced Efficiency and Coverage

• Greater focus on high risk areas than is possible with sampling

• Greater coverage of the entire population than is possible with sampling

Fact-Based, Quantifiable Findings

• Ability to quantify control weaknesses

• Ability to provide detailed examples of exceptions at the transaction level



Approach BenefitProfiling and trending • Focus on specific areas of risk or interest

• Provide insights into transactional history and behavior

• Test internal controls effectiveness

• Identify hidden relationships between people, organizations and events

Customized transactional analysis

• Geared towards a clients specific business process

• Reduction in manual testing procedures

• Perform proactive instead of reactive audits

• Identify potentially improper or fraudulent transactions

Statistical Sample selection and evaluation

• More efficient and accurate selection procedures

• Reduces time spent on selections of little or no interest

• Analyze the full population of transactions instead of a traditional sampling approach

• Focus on risk!

Report re-performance and metric recalculation

• Validate operational reporting systems and assist in the documentation of current reporting process

• Reduce manual testing procedures


Integrating Data Analytics

into the Audit Plan



1) Data analysis needs assessment

A Data Analysis needs assessment should cover each major business process area.

Identify audit areas to benefit most from the use of automated data analytics

Select a pilot area and a prioritized list of all areas for future audit automation

2)Plan, design and implement data analytics for a Pilot area

Design, Develop and Implement the data analysis methodology, deliverables and tools for a pilot area.

Assess the success of the pilot area; Identify lessons learned; and modify the approach, as needed, for the extension of the project to other areas.

3) Develop and implement data analytics to other areas

Extend the approach used to the pilot phase to the other key business process areas


Planning

2. Pilot Business Process

Scripts Design & Implementation

3. Other Business Processes

Same phases as the pilot

business process, adding

lessons learned during the

pilot project assessment

1. Data Analysis Needs Assessment

Test

Select desired analytics

Data Needs Assessment

Identify relevant business areas

Identify relevant computer systems

Review prior findings and audit summaries

Risk rank business areas

Develop

Implement

Document

Design

Assessment of hardware/software requirements



In many cases, obtaining the data will be the most time-consuming part of the data analysis. If you have your IT group provide the data:

Communicate the following in writing:

• Dataset(s) to be received (Field and Table names)

• File format (character set, structure, etc.)

• Delivery media

• Control totals

• Documentary evidence

• Delivery date

Obtain an idea of the size of the file(s) that will be provided

Obtain a sample file before the complete data file



Your technology platform may lend itself to auditor self-service. If you obtain the data for yourself:

Be cognizant of complex data models

Take advantage of ODBC, if possible

• Open Database Connectivity

MS Access

ACL

IDEA

SAS

Be aware of the performance impact onproduction or warehoused data

Perform Data Integrity tests upon receipt of data (i.e. Reconcile to Control Totals, etc)




1) Use Data Analytics to assist Planning each Audit

Each Business Process area has varying challenges and risks; which may change over time:

Data Analytics profiles activity in each area, to help focus the scope of the audit

Early identification of potential risk areas allows more time during the audit to analyze the root cause of issues identified during the planning phase

Examining 100% of an account balance allows more comfort over the application of automated controls

Treat anomalies found during data analysis in planning phase as selections

2)Ownership over Data Analytics

Establish a Data Analytics Champion to support the integration of tools, and repeatable analytics throughout the audit process

Formalize policies and procedures around how data will be acquired, used, and maintained by the internal audit department

Support Recurring use of Analytics as a part of each audit; incorporating time to design new procedures, as appropriate, each time the audit is performed



3) Consider applying Continuous Control Monitoring

Data Analytics embedded into regular reporting can reduce required audit procedures

4) Routinely Redesign Analytics

Data analytic procedures will often become routine, and lose their focus if the approach and scope are not regularly challenged and modified as variables change

Source Data Changes

Operational Risks change over time

Reward innovation

Some organizations provide incentives for auditors who identify new techniques and routines


Case Study


Data Analytics in Procurement Audit

Travel expenses have always been a concern at ABC Company since it is an area where controls are weak.

• When traveling, employees have a maximum per diem rate and are required to submit receipts coinciding with their actual expenses.

• Established maximums for meals are:

Breakfast = $10

Lunch = $20

Dinner = $20

Analytics were performed to identify meal expenses that were in multiples of $10.00

Transactions meeting the criteria were compared to receipts to ensure that the amounts expensed were appropriate

The results…

Many employees were charging the maximum rates for meals even though their receipts did not justify the amounts


Data Analytics in Procurement Audit

Identify additional insights to questions such as:

• Is your company paying invoices on time?

– Are payments consistently too late, leading to missed vendor discounts and/or resulting in potential late fees or finance charges?

– Are payments consistently too early, leading to potential cash flow issues?

– Are payment patterns in line with your company‟s guidelines?

• Are there vendors who currently owe money to your company?

– Are these balances associated with vendors with whom you no longer do business?

– Are these balances such that they should be recorded as receivables?

• Have payments been made to unauthorized or restricted vendors?

– Is the vendor master being maintained in a timely manner?

– Is there a break in the controls surrounding vendor master maintenance?

– Is there a pattern in users posting such payments?

• Are you paying invoices to vendors with potential relationships to your personnel?

– Are these payments related to a legitimate business purpose or is there a potential for fraudulent activity?

– Who is posting these payments?


Percentages of invoices paid late or early are easily ascertained, as well as the corresponding invoice amount.

Sample Analytic: Payment Date vs. Due Date

• Uncover potential lost discounts or cash management issues

• AP tests with further ad-hoc analyses can yield additional insights such as:• Do payments relate to a single vendor?

• Do late/early payments relate to only certain individuals within the AP department?

• What was the available discounts vs. discount lost?

• How much interest was paid due to missed due dates?


Sample Analytic: Disbursements to Invalid Vendors

Identify potential circumvention of or issues with system controls, and the corresponding financial impact.

•Drill into detail transactions to understand the vendors

•Determine whether there is an issue with timely maintenance of the vendor master file

•Are there noticeable patterns in the users posting these transactions?


Sample Analytic: Duplicate Disbursements

Identify potential duplicate payments based on multiple sets of criteria, as well as potential financial impact.

•Detailed transaction information can provide insights into:

•Are duplicate payments consistently related to the same system user? Are they the result of potential duplicate invoices?

•Are these erroneous payments or an indication of fraudulent activity?

•Further ad-hoc analyses can help refine the set of criteria to zero in on the payments that present a greater risk of being “true” duplicates.


Tests by Business Cycle Area


Business Cycle Testing Areas

• Revenue

• Expense

• Fixed Assets

• Payroll / Personnel

• Inventory

• Financial Reporting


Tests by Business Area: Revenue

Process Area Potential TestsMaintaining Customer Master File

• Assess customer master file for duplicates / integrity

Managing & Processing Orders

• Analyze sales data by customer, product, region, etc.

• Identify customer purchases over approved credit limit

• Calculate order fulfillment time from customer order to shipping

Ship / deliver Orders • Identify gaps or duplicate in shipping document numbers

Invoicing, Sales, Returns & Adjustments

• Identify duplicate invoices

• Analyze lag between shipping and invoicing

• Compare cost with profit margins to identify trends and opportunities to improve pricing

• Generate profitability reports by sales person, product, customer

• Generate invoice summaries by customer, invoice, amounts, etc.

• Report and automatically age total receivables

• Identify top customers for past due accounts, outstanding balances, etc.

• Identify duplicate credits

• Analyze customer returns and identify outliers

Process Receipts • Identify duplicate cash receipts

• Profile customer payment history / average customer collection time.

• Average collection time by salesperson / location

Manage Collections • Determine carrying costs by comparing days in collection by customer

• Determine the percentage of receivables written off as bad debt. Perform trend analysis to determine significant changes over time.


Tests by Business Area: Fixed Assets

Process Area Potential TestsAsset Maintenance and Classification

• Keywords wearch: „Fix‟, „Maint‟, „Break‟, „replace‟, etc to confirm whether items should be capitalized or expensed

• Identify cost and net book value less than or equal to zero

• Identify fixed assets with no associated useful life

• Identify duplicate fixed assets.

• Identify active plants with no fixed assets at closed locations

Depreciate Assets • Recalculate depreciation for any or all assets

Asset Transfer, Reclassification and Retirements / Disposal

• Identify asset additions, disposals, and transfers throughout the year

• Identify disposals before end of useful life


Tests by Business Area: Expenses

Process Area Potential TestsPurchasing • Identify duplicate purchase orders

• Stratify POs by purchase approval limits

• Analyze purchasing card activity

• Analyze employee entertainment & travel expenses

Receiving • Identify duplicate receipts and receipts with out purchase orders

• Analyze receiving adjustments (i.e. returns, short / over shipments, damaged goods)

Processing A/P and disbursement

• Extract invoice pricing and receipt quantity variances by vender and PO

• Extract invoices posted with duplicate PO numbers / receipts

• Identify all invoices that were not subjected to three way match

• Identify duplicate payments for single invoices

• Identify missing, duplicate, void or out of sequence check numbers

• Identify payments to unapproved venders / brokers

• Identify low-dollar payments to the same vendor for potential consolidation of payments

• Analyze payment cycles and processing time. Payments made before / after invoice due date to identify discounts lost to early payment.

• Identify vendors with net debit balances

• Generate cash requirements by bank, period, product, vendor, etc.

Manage Supplier Master File • Identify vendors of interest such as duplicate vendors, vendors who are employees, vendors with addresses at Mail Boxes Etc.


Tests by Business Area: Payroll / Personnel

Process Area Potential TestsHR / Employee Master File Maintenance

• Check employee master file for invalid social security numbers, potential duplicate employees, invalid / incomplete address information

• Profile salary ranges to identify outliers

• Identify pay rate higher than the corresponding pay grade rates.

Payroll Disbursement • Identify employees in payroll that are not in the employee master file

• Compare time-card rates and pay to payroll and indicate variances.

• Identify employees making over a certain amount in annual salary that do not have any benefits deducted from their payroll.

• Compare and summarize costs for special pay, overtime, premium, etc.

• Provide statistics related to Equal Employment Opportunity Commission (EEOC) requirements

• Analyze payroll disbursement to identify outliers (e.g. trends in bi-weekly payments, excessive hours worked, etc.).

• Identify employees who received overtime pay but did not have the full required hours in a time period.

• Extract all payroll checks where the gross dollar amount exceeds set amount.

•Identify duplicate or missing payroll checks


Tests by Business Area: Financial Reporting

Process Area Potential TestsPerform Financial Analysis • Analyze account balances including significant changes and

reclassifications.

• Calculate financial ratios (and changes) for sales/assets, debt/equity, etc.

• Track year-to-date activity for large operating accounts (rent, taxes, etc.).

Analyze and Validate Journal Entries

• Analyze journal entries to identify significant transactions, as well as, groups of transactions.

• Identify and analyze reversal entries, recurring entries, late adjusting entries.

• Perform a dollar stratification

• Analyze revenue entries on volume, amount and timing (large credits to revenue just before period close, etc).

•Search for invalid entries (i.e. blank User ID, blank GL account number(s), entries that do not net to 0, invalid GL Effective Date, negative debit or credit amount, blank posted date, blank description)

• Search for key words of interest in journal entry descriptions

• Analyze entries with round dollar amount or recurring ending digits

•Perform trending analysis to identify unusual trends in Journal Entry amount by income statement / balance sheet.

• Perform analysis of entries that might indicate a management override of controls.

•Print custom balance sheets, P&L statements, cash flow analyses, etc.


Tests by Business Area: Inventory

Process Area Potential TestsMaintain Inventory Master File

• Assess inventory master file for integrity

• Identify items with zero or negative unit costs or negative quantity

• Test for duplicate item numbers, prices or descriptions

Store and ship inventory • Analyze where product is made/stored and where it is shipped to identify possible freight expense savings.

• Analyze inventory receiving and shipping lead time.

Conduct inventory counts • Apply statistical counting techniques

• Analyze significant inventory adjustments

Inventory valuation • Summarize and stratify turnover by stock item to identify slow-moving or obsolete items

• Recalculate inventory based on valuation method (LCOM, FIFO, LIFO)


Data Analysis Execution Phases


Step 1: Define Objectives

Step 2: Request Data

Step 3: Address Technical Issues

Step 4: Perform Tests

Step 5: Present Results

Data Analysis Phases


Step 1: Define Objectives

• Create your test plans

Identify potential efficiencies

May need to determine other factors, like sampling method

Establish time period

Include or exclude certain information

Determine if the data is available or retained

• Define your deliverables

Know what your final result is going to look like, for example, a report or a presentation, etc.

• Assess the costs

Include potential considerations:

- Is this a compliance objective?

- How often will this test plan be used?

- How complex are the files?

Planning for a Data Analysis Project


Step 2: Request Data

• Identify the necessary data fields

What fields are required?

Which reports contain the information audited manually in the past?

• Meet with IT, IS, and/or MIS

List the required fields and identify additional fields

Know the scope of data (e.g., all divisions)

Cleansing or manipulation of the data may be needed (e.g., unit cost may need to be calculated by taking the extended cost divided by quantity)

Identify potential cutoff date and time issues

Determine how you will access and acquire the data

• Submit and document a written data request

Retain data requests for workpapers



Step 3: Address Technical Issues

• Considerations for your “data request”

Which applications are the source of the data and are they compatible?

How is the data stored?

What skills are needed to access the data in its natural format?

What data analysis tool should be used and what platform or environment?



Step 4: Perform Tests

• Execute the plan in place

• Remember: based on what you find out, things may need to be modified

• Always remember what your objective is! And will your test plan meet your objective?



Step 5: Present Results

• As you complete your testing procedures, you will want to think about how to present your results:

Who is your audience?

Present summary versus detail results?

What format should be used to present the results?

How could pictorial representation help?



Questions?

04/21/2011 Meeting - Auditing with Data Analytics

Technology

address technical

integrating

data analysis

payroll personnel

provide insights

data analysis

financial

data analytics