continuous auditing and monitoring technology - the next

Technology for Business Assurance

Copyright © 2009 ACL Services Ltd.

Continuous Auditing and Monitoring

technology - the next generation

19th World Continuous Auditing Symposium

Rutgers Business SchoolNovember, 2009

John Verver CA, CISA, CMC

Vice President Services & Product Strategy

ACL Services Ltd

Copyright © 2009 ACL Services Ltd. 2ACL Services Ltd.

ACL - 22 Years of Data Analysis in Audit

Fortune 100 95%

External Audit : Big 4 Audit firms 100%

Global 500 70%

Fortune 500 85%

Clients include 222,000+ licensed users, 14,000 organizations in 150 countries

Commercial

Public Sector

Public Accounting / Business Services

200+ departments in 37 national governments

500+ regional, state and local governments

Wells Fargo Foothill


ACL Evolution of Continuous Auditing and Monitoring

2000 – 2002

ACL delivers first customized

continuous auditing and monitoring

applications for specific business

process areas

2004-2007

ACL implements CCM products for 6

core business process areas at wide

range of clients

2008

ACL implements Enterprise CCM for

Purchase to Pay at Siemens AG

globally

------------------------------------------------

Release of ACL AuditExchange: a

managed analytics platform and

continuous auditing solution

1987-1999

Auditors increasingly automate

use of ACL for data analysis and

implement regularly repeated

applications

2003

ACL launches 1st Continuous

Controls Monitoring (CCM) product

suite


September 2009:

an integrated solution for

Continuous Auditing & Continuous Monitoring


IIA Software Survey: Continuous Auditing

Other: Excel, IDEA, Inhouse,

Oracle, PeopleSoft, Proprietary,

Showcase Query

IT Audit Benchmark

Study 2009


What did we learn from years of practical experience of

continuous auditing and monitoring?

Wide range of approaches

The continuum of analytics

CM is increasingly driven from CA into the business – by audit


ad hoc repetitive

24 7 365

continuous

Continuum of Audit Analytics

One-off analysis and

testing

Automated analyses and

tests

Managed and deployed

from a central

environment

Continual execution of

automated audit and

monitoring tests to test

compliance and identify

errors, fraud and waste on

a timely basis


Technology Analysts

Continuous controls monitoring for transactions (CCM-T) is an

emerging governance, risk and compliance technology that monitors

ERP and financial application transaction controls to improve financial

governance and automate audit processes.

CCM-T ensures that business rules and policies are effective, reduce

compliance and audit costs, and support risk management.

Continuous Controls Monitoring for Transactions: The Next Frontier for GRC Automation

Paul Proctor & French Caldwell

Gartner


Moving Towards Continuous


CA and CM …Practical Technology Requirements

Flexible Query & Analysis

AdvancedFlexible Analytic

Configuration

Defined Analytics for Key

Processes

Enterprise Data Access &

Management

Scheduling & Automation

Integration with Audit Process and Content Manegement

Exception Management &

WorkflowReporting

Enterprise-ready Performance & Reliability


ACL

Enterprise

Data

Auditors & Audit LeadershipACL Specialist

SQL

ERP

Business Stakeholders

Centralized Audit Management• Engagement & Content Management

• Automation

• Analytic Processing

Manage All Types of Audit Content

ProjectsAnalytics

Data

ExcelWord

Crystal

Reports

PDF

Audio

PowerPoint

Results

Continuous Auditing

http://images.google.ca/imgres?imgurl=http://www.informationmakers.nl/uploads/images/Logo/logo-ibm-db2.gif&imgrefurl=http://www.informationmakers.nl/index.php?page=our-mission&usg=__1XbuL8NVPhxpNQtN2O3PEkyCpw4=&h=52&w=200&sz=2&hl=en&start=2&tbnid=rERIW_3mStpSIM:&tbnh=27&tbnw=104&prev=/images?q=ibm+db2+logo&gbv=2&hl=en&sa=X

http://images.google.ca/imgres?imgurl=http://pubpages.unh.edu/~rem28/excel_icon.png&imgrefurl=http://pubpages.unh.edu/~rem28/&usg=__i8l4sk8z0_4cnuQSFaZAjBH4p6E=&h=126&w=128&sz=14&hl=en&start=2&tbnid=TSQwRqMPgKxfwM:&tbnh=90&tbnw=91&prev=/images?q=excel+icon&gbv=2&ndsp=18&hl=en&sa=X

http://images.google.ca/imgres?imgurl=http://terrydube.com/images/wordicon.gif&imgrefurl=http://terrydube.com/emp/employers.html&usg=__Sz_616QUniAFVuIC1IZNq-1iN_s=&h=261&w=264&sz=28&hl=en&start=53&tbnid=JwAPsA1VEw036M:&tbnh=111&tbnw=112&prev=/images?q=word+icon&gbv=2&ndsp=18&hl=en&safe=active&sa=N&start=36

http://images.google.ca/imgres?imgurl=http://www.sfu.ca/cscd/outreach/aboriginal_ced/images/pdf_icon_002.gif&imgrefurl=http://www.sfu.ca/cscd/outreach/aboriginal_ced/index.html&usg=__GiuAA-NqffkYA5oD-qUS5DOhQfk=&h=150&w=150&sz=9&hl=en&start=2&tbnid=7yWDXvwqx9xWjM:&tbnh=96&tbnw=96&prev=/images?q=pdf+icon&gbv=2&hl=en&safe=active

http://images.google.ca/imgres?imgurl=http://www.uruploadz.com/audio/1210238705@volume_icon.jpg&imgrefurl=http://www.uruploadz.com/audio/&usg=__-JjE8lWumxqQuWuJNt3lo841254=&h=110&w=110&sz=11&hl=en&start=31&tbnid=18jqTyTTMzArZM:&tbnh=85&tbnw=85&prev=/images?q=volume+icon&gbv=2&ndsp=18&hl=en&sa=N&start=18

http://images.google.ca/imgres?imgurl=http://www.javierleung.com/sub/_img/Microsoft Office - PowerPoint.png&imgrefurl=http://www.javierleung.com/sub/projects.htm&usg=__1xuVfvycKElDzUxheEin2H_Wops=&h=256&w=256&sz=26&hl=en&start=3&tbnid=2xOfpu1e5fpNEM:&tbnh=111&tbnw=111&prev=/images?q=powerpoint+icon&gbv=2&hl=en&safe=active


ACL

Enterprise

Data

SQL

ERP

Business StakeholdersAnalytics

DataResults

Continuous Monitoring

• Automation

• Analytic Processing

•• Business Process Areas

•• Analytic Authoring

Continuous Monitoring

•• Controls Monitoring Management

•• Web-based Interface•• Publish Exceptions

•• Workflow Management



powered by

SQL

Access

Flat files

Delimited

dBase ODBC

sources

IMS for z/OS VSAM

for z/OS

IDMS

for z/OSADABAS

Enterprise One

& World

CRM

BW, ERPCRM

Private files

Report files

SWIFT

HIPAAHL7

AFPEDI-X12EDI-FACT

Provides access to

multiple data sources

Schedule large data

extracts on a recurring basis

Mask sensitive

informationAX Core

http://images.google.ca/imgres?imgurl=http://www.msaccessresource.com/files/Office_Access_2007_Icon.png&imgrefurl=http://www.msaccessresource.com/?q=node/8&usg=__OzBSVy0a7TWXqrlkAUHScsBaSVw=&h=96&w=96&sz=7&hl=en&start=4&tbnid=SSfAF6UuUpZ_iM:&tbnh=81&tbnw=81&prev=/images?q=microsoft+access+icon&gbv=2&ndsp=18&hl=en

http://images.google.ca/imgres?imgurl=http://www.tgiltd.com/Informix_Logo.gif&imgrefurl=http://www.tgiltd.com/technology_affliliations.html&usg=__6JqxTLAbFopPx0WzxUTzV2pHaKw=&h=56&w=215&sz=2&hl=en&start=2&tbnid=CFPGiCuvJDXAQM:&tbnh=28&tbnw=106&prev=/images?q=informix+logo&gbv=2&hl=en

http://images.google.ca/imgres?imgurl=http://www.designboom.com/contemporary/computer_icons/computericons01.jpg&imgrefurl=http://www.designboom.com/contemporary/computer_icons.html&usg=__JqPBKZOpk1JIkNwSAVEhEGh-EWY=&h=358&w=450&sz=15&hl=en&start=24&tbnid=Jg3ISWjGy01MzM:&tbnh=101&tbnw=127&prev=/images?q=document+icon&gbv=2&ndsp=18&hl=en&sa=N&start=18



http://images.google.ca/imgres?imgurl=http://www.oecd.org/oecd/images/portal/cit_731/2/14/33727382SAS.jpg&imgrefurl=http://deriz.wordpress.com/tag/business/&usg=__4xZyT6d26E40AMOOQR-wSX8bGPk=&h=278&w=696&sz=29&hl=en&start=2&tbnid=a_Bmo7WjqEIRsM:&tbnh=56&tbnw=139&prev=/images?q=SAS+database+logo&gbv=2&hl=en

http://images.google.ca/imgres?imgurl=http://www.findaccountingsoftware.com/images/logo-jd-edwards.gif&imgrefurl=http://www.findaccountingsoftware.com/guides/product/jdedwards/&usg=__DYLp3WbHhqROvA6u4YfrhPaDK0Y=&h=75&w=257&sz=8&hl=en&start=2&tbnid=tKU_7FzbTKWaNM:&tbnh=33&tbnw=112&prev=/images?q=JD+Edwards+logo&gbv=2&hl=en

http://images.google.ca/imgres?imgurl=http://www.eebo.ch/upload/se_logo_copy.gif&imgrefurl=http://www.eebo.ch/oracle_practice.php5&usg=__GnIqLyMQENeWLP2bibJrz9BTCa4=&h=160&w=473&sz=20&hl=en&start=10&tbnid=8OISCSNsQdWBUM:&tbnh=44&tbnw=129&prev=/images?q=oracle+e-business+logo&gbv=2&hl=en

http://www.hyperion.de/

http://images.google.ca/imgres?imgurl=http://broadcast.oreilly.com/2008/10/15/Xbrl-logo.png&imgrefurl=http://broadcast.oreilly.com/2009/02/xbrl-becomes-mandatory---this.html&usg=__3zNTE8xbXo7vFuL3JgmcJgJUB54=&h=94&w=188&sz=23&hl=en&start=4&tbnid=hs9i-GXYa0frqM:&tbnh=51&tbnw=102&prev=/images?q=xbrl+logo&gbv=2&hl=en


http://images.google.ca/imgres?imgurl=http://download.oracle.com/docs/cd/E05445_01/psft/images/PeopleSoft_Ent_logo.gif&imgrefurl=http://download.oracle.com/docs/cd/E05445_01/psft/html/home.html&usg=__nlOL_On4bhr5MxcesDeiFY6IgdA=&h=78&w=225&sz=4&hl=en&start=15&tbnid=UVsLJDPqMhpajM:&tbnh=37&tbnw=108&prev=/images?q=peoplesoft+enterprise+logo&gbv=2&hl=en



Business Stakeholders

Accounts

Payable

Purchasing

Accounts

Receivable

Payroll

Accounting

Distribution of

exceptions

Workflow management

for exception resolution

Web-based

interface

“Audit Interested”

AX Core

Exceptions


Palomar Pomerado Health

Audit Exchange 2.0, with the AX Exception component, has

improved our controls monitoring across the business.

of the results for appropriate follow up. It now runs seamlessly

and we have an audit trail that confirms exceptions are

reviewed and dealt with. This is a much better alternative to

sending audit reports with attachments, to people who may or

may not answer, and then manually cutting and pasting auditee

feedback back into audit reports.

We have automated both audit testing and distribution

Tom Boyle, District Audit Officer


“AuditExchange 2.0 will fundamentally transform how we

manage spending and evaluate compliance. Reporting

that was previously non-existent will now provide senior

leadership with a clear picture of our control environment.”

Dun & Bradstreet

Continuous monitoring for enhanced controls & regulatory compliance

Significant cost recoveries and ROI

Timely exception reporting and communication to stakeholders

Higher quality audits with full data coverage

Hal Laughlin, IT Audit Manager

Dun & Bradstreet

Activity: Technology

Employees: 4,900

Size: 100 locations


Siemens Financial Services, Inc.

AX Exception is going to

We are already getting questions and suggestions about

additional analytics based on the first few reports we

provided to them. And it’s much easier now for the managers

to track and follow-up on issues. We previously sent out

spreadsheets, which had become largely unmanageable due

to their size and complexity.

improve how we work with internal business units.

Jason A. Gross, Vice President, Controls Management


Changing the Game

an integrated solution for

Continuous Auditing & Continuous Monitoring

continuous auditing and monitoring technology - the next

Documents