Death of the IT Auditor:

Size: px

Start display at page:

Download "Death of the IT Auditor:"

Ada Brooks
5 years ago
Views:

1 ISACA ATLANTA Death of the IT Auditor: Analytics is for Everyone Friday, May 22 nd, :05 am 1:55 pm Damien Berahzer, CISA Manager of Compliance, Hubzu Damien Berahzer - Southeast Intergovernmental Forum, Nashville

2 . Damien Berahzer - ISACA Atlanta

3 1 st the Non Apology Apology Audit Firms ITGC Kool Aid Drinkers All Indirect Control Testing Damien Berahzer - ISACA Atlanta

4 Audit Firm Wise Grandma Charge a premium Hire intelligent but not so skilled resources Highly Successful Company Money to Blow Only Care about passing an external audit Wimp There s a time and place for everything Damien Berahzer - ISACA Atlanta

5 Firms see the value Deloitte Data Analytics has significant potential to be exploited in the internal audit and risk management space PWC Internal Audit Departments have a unique opportunity to leverage data analytics to identify risks and provide insight to the business KPMG Audit Data and Analytics: Adding value to audit and confidence in assurance EY Harnessing the power of data: How Internal Audit can embed data analytics and drive more value Damien Berahzer - ISACA Atlanta

6 Accenture Firms see the value Applying analytics to transform internal audit for high performance Rutgers Accounting Internal Audit Should Embrace Data Analytics Damien Berahzer - ISACA Atlanta

7 Let s Talk Random Sampling Damien Berahzer - ISACA Atlanta

8 0 out of 25 Statistics Gives a 99 % Confidence of reasonable assurance 1 out of 40 Gives a 95% Confidence of reasonable assurance Lies, Damn lies and Statistics Damien Berahzer - ISACA Atlanta

9 Statistics: Lie For Every 100 American There are 88 Guns What % of households have guns Damien Berahzer - ISACA Atlanta

10 CA, the beginning Damien Berahzer - ISACA Atlanta

11 Dollar, Dollar Bills Ya ll Damien Berahzer - ISACA Atlanta years 11

12 Dollar, Dollar Bills Ya ll Donna Renee Gamble Fraud using procurement credit cards to make personal purchases totaling more than $316,000 Over a 5 year period Purchases Included: Vacations, jet skis, AC units for mobile homes 12

13 Management is right there with us CONTINUOUS ASSURANCE Continuous CONTROLS Assessment Continuous RISK Assessment Continuous Monitoring AUDITORS CONTINUOUS AUDITING Management s Process Damien Berahzer - ISACA Atlanta

14 Examples on Analytics in Audit 14

15 Audit Duplicate Payments eg. Pattern 3: Vendor Names are similar. Pattern 1: Invoice 1: Invoice Numbers repeat (they are identical) Numbers repeat (they are identical) Pattern 2: Invoice Amounts repeat (they are identical) VENDOR NAME INVOICE ID INVOICE NUMBER INVOICE AMOUNT AMOUNT PAID INVOICE DATE PAY STATUS THIS USA LLC I00PP SEP-10 Y THIS USA, INC I00PP SEP-10 Y COURTNEY, COY BD1PP AUG-10 Y COY, COURTNEY BD1PP AUG-10 Y $165,000 and Emerging Risks Damien Berahzer - ISACA Atlanta

16 Audit SOD: Conflict Arrays 1 st Function Name 1 st User Function Name 2 nd Function Name 2 nd User Function Name 1 PN_APXVDMVD Enter Suppliers AP_APXIIFIX Open Interface Invoices 2 PN_APXVDMVD Enter Suppliers AP_APXTSBNK Bank Transmission Setup Info 3 PO_POXPCATN Exceed Price Tolerances RCV_RCVRCERC Receipts Damien Berahzer - ISACA Atlanta

17 Audit Inactive Vendors: what it revealed We identified 2,383 vendors with no invoice activity for the past 365 vendor type field blank for 63% of the records pulled Multiple duplicate entries for vendors Basic Duplicate vendors test yielded over 370 records Up to 8 entries Damien Berahzer - ISACA Atlanta

18 Audit Inactive Vendors: what it revealed We identified 2,383 vendors with no invoice activity for the past 365 vendor type field blank for 63% of the records pulled Multiple duplicate entries for vendors Basic Duplicate vendors test yielded over 370 records Up to 8 entries Damien Berahzer - Southeast Intergovernmental Forum, Nashville

19 Let s make things Better Damien Berahzer - ISACA Atlanta

20 Compliance Monitoring: FHA Testing Audit Methodology 100 per month Random Sample Continuous Monitoring 100% of all listings Reviewed every week Let s Talk Internal Audit Damien Berahzer - ISACA Atlanta

21 Compliance Monitoring: Post Implementation Review State Requirement Advertising Format Missing Requirements Risk Area Identified 100% of all listings reviewed Let s Talk Internal Audit Damien Berahzer - ISACA Atlanta

22 Management Monitoring: Predictive behavior Complex Algorithm Predicts likelihood of default Near Real Time Analysis 100% of all Bids Let s Talk Internal Audit Damien Berahzer - ISACA Atlanta

23 Management Monitoring: RCA/Do we need controls Incident Analysis Someone notices a particular issue RCA Review all files for portfolio Establish Trend Re-evaluate understanding Implement controls accordingly Let s Talk Internal Audit Damien Berahzer - ISACA Atlanta

24 IT Auditor: ITGC Freak Outshined by other business unit Not Adding Value Operating in the paper age Guessing Damien Berahzer - ISACA Atlanta

25 THANK YOU Damien Berahzer

The Overview. Our Idea

The Overview. Our Idea MARKETING PROPOSAL The Overview This purpose of the overview is to show your client that you understand the opportunity at- hand, the market conditions they are facing, and how you and/or your company