How data analytics can help with integrated audit

The Institute of Internal Auditors of ThailandIIA Thailand - Annual Conference 20117 September 2011

How data analytics can help with integrated audit?

© 2011 Deloitte Touche Tohmatsu Jaiyos

Agenda

1

• What is data analytics?

• Data analytics in the context of risk management

• Applying data analytics to risk management

IIA Thailand - Annual Conference 2011

Market Trends & Facts


Statistical sampling introduced in audits

1960 1970 1980 1990 2000 2010 2015

Mainframe computer-based tools supporting Audit sampling(Auditape/STRATA)

Timesharing and minicomputer based tools built and regression tools and model libraries introduced

Risk management and actuarial Analytics modeling tools introduced

Fraud, anti-money laundering and FCP support tools

1960s-1970s: First attempts at automating the data analysis using mainframe computing

1980s: Desktop analytics accelerates through the PC revolution

1990s: Analytics evolves with the development of enterprise resource planning (ERP) systems and data warehousing

Financial modeling tools built

Predictive modeling work begun in insurance industry

Major investments in data center infrastructure in U.S., Canada, and Australia

PC-based tools built

Operations research practice started

Predictive modeling introduced in pricing and supply chain work

Data Analytics: It’s not something new

3 IIA Thailand - Annual Conference 2011


Data is growing exponentially and there is pressure now for companies to make faster and better decisions

4

Data Trends External and Internal Drivers

External1. External competitive

pressure2. Increased regulatory

pressure3. Technology advancement

The Economist. Data, data everywhere. Feb 25th 2010

A recent report by the Economist highlights that data-assets continue to grow exponentially

A recent Kennedy Report indicates that a variety of internal and external industry drivers are pushing our clients to embrace analytics

Internal1. Data proliferation and

growth2. Increasing sophistication

of users3. Maturation of ERP

systems

Top internal and external industry factors contribu ting to adoption:



The data already shows that analytics differentiate s the top performers from average and lower performers

5

A recent study from MIT shows that on average the top performing companies use analytics almost three times as much as lower performing companies in everyday operations and decisioning

MIT Sloan Management Review and the IBM Institute for Business Value. Analytics: The New Path to Value How the Smartest Organizations Are Embedding Analytics to Transform Insights Into Action. 2010



Kennedy predicts growing competitor investments in Analytics

6

Industry Sector Trends

Kennedy predicts that demand for Analytics particularly will be led by:1. Financial services2. Healthcare3. Retail

Information Management & Analytics Consulting Marketplace 2010-2013: Kennedy Consulting Research & Advisory. 2011


What is Data Analytics?


What is data analytics

8

“A practical definition, however, would be that analytics is the process of obtaining an optimal or realistic decision based on existing data .”

(Wikipedia)

“Data analytics is the science of examining raw data with the purpose of drawing conclusion about that information.”

(Whatis.com)

“Analytics leverage data in a particular functional process (or application) to enable context-specific insight that is actionable.”

(Gartner)



Analytics Defined

Deloitte Analytics refers to the skills, technologi es, applications, and practices for continuous iter ative exploration and investigation of past business perf ormance to gain insight and drive business strategy

Business analytics is the practice of using data to manage information and performance—and make more effective decisions. It can apply to almost any “sticky” business issue.

Analytics is using data to generate predictive insi ghts to make smarter decisions that drive strategy and improve performance

9 IIA Thailand - Annual Conference 2011

Data analytics in the context of risk management


Opportunity for using data analytics in managing ri sks

11

• Explosive data growth means more raw materials

• Innovation in data generation and capture

• Data supports fact-based decision making

• Already used extensively in many areas of business

• Data analytics focusing on risks are primarily used in the areas of credit risk, anti-money laundering and fraud

Data analytics has significant potential to be expl oited in the internal audit and risk management space



What will the future hold

12

• Will Board and Management be asking us to back up our gut feel on risk with hard data?

• Will the C-Suite want to understand the key risk factors and their relative importance in real numbers?

• Will Management have even greater responsibility to foresee future risks long before they manifest themselves?

• Will data analytics be a core competency for all risk professionals?

Data analytics is a business tool that will be perv asive in our organizations



What types of questions can analytics answer

13

Historical Perspective

Current Perspective

Future Perspective

What Happened?

How many, how often,

where?

Where is the problem?

Why is this happening?

What actions are needed?

continue?

What if these trends

continue?

What’s the best that can

happen?

What will happen next?



How can data analytics be applied to risk managemen t

14

� Error detection and quantification – Targeted analytic applications to detect errors (e.g. business unit reviews or internal audits)

� Risk Dashboard/ Monitoring – How are we currently doing? What if our current risk profile?

� Key Risk Indicators (KRIs)� “What-if” – How will this decision affect our

risk?

Historical perspective

Current perspective

Future perspective


Applying data analytics to risk management


Deloitte Analytics: Domain Overview

16

Deloitte Analytics Business Domains

Analytics create value across the enterprise through improvement of applicable business value drivers.

Five Deloitte Analytics Business Domains span the areas identified in the Enterprise Value Map and lend themselves to improvements generated by Deloitte Analytics:

Value Drivers =Business Domains

Supply Chain

Supply Chain Analytics is the use of analytics to

provide insights across the organizational value chain

Workforce

Workforce Analytics is the use of analytics to enhance

and optimize workforce processes and intelligence

Risk

Risk Analytics is the use of analytics to measure, monitor and mitigate enterprise risk

Finance

Finance Analytics is the use of analytics to measure,

control, and optimize financial management

processes

Customer

Customer Analytics is the use of analytics to enhance the customer lifecycle, sales and pricing processes, and overall customer experience



Deloitte Analytics: Risk Management Domain

17

1. Continuous Monitoring (CM)

2. Continuous Auditing (CA)




18

Continuous Monitoring (CM) is an automated, ongoing process that enables management to:

• Assess the effectiveness of controls and detect associated risk issues

• Improve business processes and activities while adhering to ethic & compliance standards

• Execute more timely quantitative and qualitative risk-related decisions

• Increase the cost-effectiveness of controls and monitoring through IT solutions.

The value of CM is that it gives management greater visibility into, and more timely information on, business processes designed to

achieve strategic and operational goals.




19

Continuous Auditing (CA) is an automated, ongoing process that enables internal audit to:

• Collect from processes, transactions and accounts data that supports internal and external auditing activities

• Achieve more timely, less costly compliance with policies, procedures and regulations

• Shift from cyclical or episodic reviews with limited focus to continuous, broader, more proactive reviews

• Evolve from a traditional, static annual audit plan to a more dynamic plan based on CA results

• Reduce audit costs while increasing effectiveness through IT Solutions

The value of CA is that it enables internal audit t o move from sampling accounts and transactions to coverage of 1 00 percent of

accounts and transactions.



Barriers to CM & CA Adoption

20

• Perceived impact on the enterprise – impacts on costs, headcount, audit plans, workload, quality of audits & stakeholder satisfaction

• Priority of implementation – factors to be considered, such as risk rankings, importance of audit evidence, return on investment and ease of implementation

• Internal audit’s readiness to develop and adopt CA – depend on business cycle, audit focus & use of automation

• IT & software considerations

• Realistic expectations – benefits are not achieved overnight



CM/CA Roadmap

21

1. Develop the business case

2. Develop a strategy for adoption

3. Plan the design & implementation

4. Build & implement the CM or CA system

5. Monitor performance & progress



CM/CA Roadmap

22

1. Develop the Business Case

• Connect the initiative to the drivers of value, and the risks, in the business

• Identify benefits and costs, and quantifying them when possible

• Place CM or CA in the context of the overall GRC effort and clarifying their roles



CM/CA Roadmap

23

2. Develop the Business Case

• Target efforts based upon risk exposure, appetite, and tolerances, enterprise-wide and locally

• Identify which areas are appropriate to pursue based on projected benefits, costs and ROI

• Identify how to set thresholds and monitor risks, as well as useful intervals and notification mechanisms

• Consider required resources and how current resources and priorities may help or hinder adoption



CM/CA Roadmap

24

3. Plan the Design & Implementation

• Determine the scope of the objectives

• Establish roles and responsibilities

• Design the CM or CA process & mechanisms

• Allocate resources and creating a timeline and project plan

• Set reasonable expectations for performance

• Align people, processes and IT resources



CM/CA Roadmap

25

4. Build & Implement the CM or CA System

• Begin with relatively straightforward, low-cost, high-return projects

• Involve IT, business units, and other key stake-holders early on

• Create a sense of shared ownership of the project and results

• Test the CM or CA system, particularly for its impacts on the IT system, before actual launch and adoption

• Follow the plan, but make course corrections as needed

• Establish workable practical CM or CA Procedures



CM/CA Roadmap

26

5. Monitor Performance & Process, and refined as ne eded

• Report the results of the effort to management and all other stakeholders

• Demonstrate the valued added – in momentary terms when possible

• Verify by manual means that the early reading and results are accurate

• Adjust monitoring or notification mechanisms as needed, given their performance and the quality of the human interface



Closing thoughts

27

• Data analytics requires innovative thinking about sourcing data and identify sensors

• Data analytics is as much about asking the right questions as it is about the mathematical contortions going on behind the scenes

• Data analytics can be applied to more aspects of risk management than just credit risk, AML and Fraud


Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/th/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms.

Deloitte provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries. With a globally connected network of member firms in more than 150 countries, Deloitte brings world-class capabilities and deep local expertise to help clients succeed wherever they operate. Deloitte's approximately 170,000 professionals are committed to becoming the standard of excellence.

This publication contains general information only, and none of Deloitte Touche Tohmatsu Limited, its member firms, or their related entities (collectively, the “Deloitte Network”) is, by means of this publication, rendering professional advice or services. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. No entity in the Deloitte Network shall be responsible for any loss whatsoever sustained by any person who relies on this publication
