Continuous Auditing - Making it Real

How to optimize classroom (or office space) in response to COVID-19 social distancing requirements?

noreply@blogger.com (Joe Oringel) — Fri, 31 Jul 2020 16:51:00 +0000

How to optimize classroom (or office space) in response to COVID-19 social distancing requirements?

Do you remember the days when classrooms and offices were designed to create spaces that fostered creativity, productivity, and teamwork? It seems quaint doesn’t it? Due to COVID-19 universities and other organizations are all trying figure out how to safely utilize their spaces by the maximum number of people.

It is an enormous and important undertaking. Right now, facilities teams across the world are hiring engineering and architectural consultants to assist with these challenges. These groups often come in with specialized CAD software and design static solutions that do a good job but don’t always address the right questions that are being asked of the Facilities teams.

Here’s a University example. Does this sound familiar?

What happens if the social distancing requirements change from 6 feet to 5? Or 5 to 4?

How many students will fit in the Science Building?
How many students can safely fit in each classroom?
How many can safely use the lab at once?

How would changes to those guidelines affect in-person capacity in the Spring?
How much do guidelines have to relax before we can return to 50% of our normal on-campus present? How much until we reach 60% or 75%?

At Visual Risk IQ, we believe a combination of data analytics and Tableau’s data visualization create a powerful solution to answering these questions.

We recently developed a dashboard that does just that and we’ve shared it on Tableau Public for you to try out and see how it works. This is just one classroom on campus, but imagine being able to aggregate this data for every classroom, every laboratory and every building. Imagine being able to report campus-wide on how social distancing requirements are impacting capacity and comparing that information to course registration for every hour of the day.

If you’d like information on how you can tailor this solution to your specific needs, contact us at info@VisualRiskIQ.com

About us: Visual Risk IQ has been a Tableau partner since 2013 and has completed nearly 100 data-focused consulting projects for Research Universities across the country.

How to (Re-)Energize an Internal Audit Analytics Program

noreply@blogger.com (Joe Oringel) — Wed, 05 Feb 2020 18:33:00 +0000

The newly hired Chief Audit Executive (CAE) was presented with a challenge. During her first month, the CFO had shared an article on use of analytics by internal audit and wanted to see her plans for becoming more data-driven. As she had learned during her interviews for the job, the prior CAE had invested in data analytics software and training but had very little to show for it.

Despite that investment, the use of data analytics by the audit team was still in its infancy. Many of the internal audit team were new to the company. Team members were split between using the audit software purchased by the prior CAE, Microsoft Excel, or perhaps Tableau, which had recently been purchased by the IT organization as part of a customer analytics initiative. The prospect of using Tableau was appealing, but she was concerned that learning a new tool might have similar results as the old one.

She had heard good things about Visual Risk IQ from an IIA chapter colleague, and after some thoughtful Q&A regarding how we had helped others, we were hired to help her advance their data analytics initiative through a mix of on-the-job training and some planning exercises.

One of her goals was to develop a strategic plan for the use of data analytics that she could share with the CFO and her audit committee. She believed in the maxim that a goal without a plan was just a wish, and she wanted to chart a course and describe how her team would advance on that journey. Using Visual Risk IQ’s maturity model template, we helped her define what success would look like. For the first year, she set three main objectives:

1) Develop internal procedures for running the data analytics effort. This included tracking and managing workload, reviewing procedures, and reporting and managing the data itself.

2) Identify two continuous monitoring opportunities and implement those solutions by year-end.

3) Make data analytics part of every audit project. Incorporate data analysis into planning, fieldwork, and reporting.

For objective one, her team developed internal policies and procedures themselves.

For objective two, after some time evaluating the skills of the analytics champion they’d hired, we helped the team identify two opportunities for continuous monitoring. We recommended projects that would help that person develop their skills while also contributing toward the audit plan. Because of the ease of accessing data and the relatively high error rate, travel expenses were first on the list. We assisted the champion on how to define a project using a design blueprint that connected business questions to source data. We provided coaching on which tests would likely yield the greatest value, and then showed how visual reporting with Tableau would display results clearly and shorten the time it would take for follow-up. Their analytics champion was able to handle most of work effort, but when he got stuck, Visual Risk IQ was there to help. Next up was AP Discount Analysis – more on that next week with our next Blog post.

For the third objective, Visual Risk IQ has helped their data analytics (DA) champion get involved in the planning for each audit project. Following the example from the T&E audit, they hold a brainstorming meeting for each audit to identify opportunities for data analytics and visual reporting. Some ideas have been implemented and while others are tabled, but that consistent conversation has started to change the way the entire audit team thinks about data throughout the audit.

Fast forward to the end of the year. With a little help from Visual Risk IQ, the audit team has been able to meet their objectives and their champion has become more efficient and effective at using data analytics throughout the audit process. Two other team members have enrolled in data analytics certificate programs. Data is contagious!

The team is becoming increasingly competent and independent, and we see that as the true success story. Unlike many firms whose sole goal is to deliver analytics, Visual Risk IQ aims to raise data skills across the internal audit profession.

Let us know if you’d like a free copy of our maturity model template or if you’re interested in accelerating your climb up the data analytics maturity curve. reach out to us @ Joe.Oringel@visualriskiq.com or David.Poisson@visualriskiq.com.

Better P-Card monitoring through Merchant Category Codes

noreply@blogger.com (Joe Oringel) — Wed, 14 Aug 2019 13:23:00 +0000

by: David Poisson, Senior Consultant Visual Risk IQ

Better P-Card monitoring through Merchant Category Codes

What is an MCC?

A merchant category code (MCC) is a four-digit number assigned to a business that describes the type of goods or services the business provides. The codes are defined by the International Organization for Standardization and periodically amended. Credit card processors manage the assignment of the codes to individual businesses.

How do MCCs benefit audit and compliance analytics?

Merchant category codes offer powerful information that can be used by audit and compliance professionals to identify risky transactions.

Certain categories of transactions are typically associated with personal use and are unlikely to be valid business expenses. For instance, purchases to MCC 4411 – Cruise Lines or 5933 – Pawn Shops probably deserve extra attention.
Other categories may highlight non-compliant purchases specific to your organization. For instance, many government agencies are banned from purchases of alcohol with state or federal funds. To those agencies, purchases from MCC 5813 – Bars, Cocktail Lounges, Discotheques, Nightclubs, and Taverns-Drinking Places (Alcoholic Beverages) would indicate a high-risk and potentially inappropriate transaction.
MCCs may highlight risks facing organization that deserve more attention. For instance, some payments to Charitable Organizations (i.e. MCC 8398) – Charitable and Social Service Organizations. This may represent valid spending but require certain disclosure or routing within an organization (e.g. Corporate Foundations) to take advantage of US Tax Laws.
Additionally, certain codes have been found to be associated with higher levels of disputed charges such as 4121 – Taxis and limousines. While using such vendors may be used as part of normal business, it is useful to raise the profile of this spending. This way when other anomalies occur, focus is quickly drawn to transactions that are likely to represent higher risk.

Finally, monitoring spend by MCC across an organization may provide useful insights into spending behavior and unusual differences between similar groups. Highlighting and investigating these differences can be a powerful step towards controlling waste and identifying and sharing efficiencies across the organization.

Controlling spend based on MCC

Merchant Category Codes are only one piece of the puzzle. While most P-Card programs will allow specific MCC codes to be banned from use, this is not always practical. While an MCC code may be riskier, that does not mean it is never valid. Furniture sore purchases by a facilities employee may make sense, while the same spending by someone else may not. Human judgment is often required to determine if spending associated with a risky MCC appears reasonable or not. That’s why Visual Risk IQ believes in maximizing the visibility of an organization’s risks is so important, to inform human judgment, to focus on risk, and to shorten the time to a decision.

Appendix - High Risk MCC Codes:

Monitor for Non-Compliant Purchases (including personal use):

4411 – Cruise Lines
4814 – Telecom Services & Cable, Satellite, and
4899 – Other Pay Television and Radio Services
5933 – Pawn Shops
5712 – Furniture Stores

5813 – Bars, Cocktail Lounges, Discotheques, Nightclubs, and Taverns-Drinking Places (Alcoholic Beverages)
5968 – Direct marketing, subscription, continuity / subscription merchants
7299 – Misc Personal Services – not elsewhere Classified
7997 – Membership clubs, health clubs, country clubs, sports clubs, private golf courses, boating clubs, swimming clubs

MCCs that may highlight other risks to the organization including reputational, compliance and corruption:

4829 – Money transfer, wire transfers
8398 - Organizations, Charitable and Social Service
6XXX – Merchant codes beginning with 6 are associated with financial institutions. Related transactions may include investments, money orders, etc.
9222, 9223, and 9399 – Fines, Bail and bond Payments, and Government Services-Not Elsewhere Classified

Note: The list above is not intended to be a complete listing of the MCCs that should be monitored as part of a travel or P-Card analytic program. Risks are unique to each organization. Visual Risk IQ recommends maintaining a listing of high-risk MCCs tailored for your organization.

For company-specific guidance, please contact David Poisson or Joe Oringel via email at: David dot Poisson @VisualRiskIQ dot com or Joe dot Oringel@VisualRiskIQ dot com.

Data Analytics and Compliance, from Tom Fox's Compliance and Ethics Blog

noreply@blogger.com (Joe Oringel) — Tue, 16 Feb 2016 00:10:00 +0000

From Tom Fox's Compliance and Ethics Blog, where we were interviewed for a special 5-part piece on data analytics and compliance. See original link for Part 1 at: http://fcpacompliancereport.com/2016/01/9264/ . More to follow.

This week I will begin a five-series exploring data analysis and how it can be used by the Chief Compliance Officer (CCO) or compliance practitioner to support a best practices compliance program under the Foreign Corrupt Practices Act (FCPA), UK Bribery Act or other anti-corruption compliance regime. My partner in this exploration is Joe Oringel, a co-founder and Managing Director at Visual Risk IQ, a data analytics services firm, who I interviewed for this series.

Today, we will focus the basics of data analysis and how it differs from other forms of data testing such as sampling and inspection of documents. Next I will consider how to think through the use of data analysis and the COSO Framework. Then I will explore some of the ways Oringel and his team have used data analytics to assist companies in ways that are analogous to FCPA based compliance programs. Additionally Oringel and I recorded a three-podcast series where we explored these issues in an interactive format. If you check out the podcasts you will be eligible to receive an additional White Paper, at no cost, on the complete series and topic.

Being a recovering trial lawyer, I began with the basics, which is: what are data analytics and data analysis? Oringel kept it simple, saying that it’s merely using data to answer questions. He noted that such analysis predates computers since Sherlock Holmes became well known for using deductive reasoning to make determinations from data based evidence. In the 21st century business world, the best evidence that we have as to whether something took place or not is most often digital evidence. Oringel pointed to a variety of authoritative digital data sources, which intone that modern data analysis is a process of inspecting, cleansing, transforming, and modeling data with the goals of highlighting useful information and supporting our decision-making, so data analysis is answering a question with data.

Oringel next pointed to another set of definitions for data analysis, which derived from Thomas Davenport, who is a well-known academic and author who teaches at Babson College. Davenport incorporates the notion of time to categorize data analytics as answering certain questions about either the past, the present or even the future. Incorporating time into analytics focuses these efforts so you can build repeatable patterns into the questions that should be asked and answered.

Oringel, who has both academic and professional training as an internal auditor, said that external financial auditors, like the Big Four, usually focus on answering the question, “What has happened?” This is really a focus on historical transactions, looking backwards and looking at the reporting of transactions, for example what was recorded in the books and records of the company? How was the transaction recorded? Why was the transaction recorded a certain way?

I next turn to the difference between data analysis and traditional internal auditing or sampling. Oringel believes this is the most significant change in technology in the last 25 to 30 years due to the advent of the personal computer and the associated spreadsheets and database softwares that allow auditors to make their conclusions with data, and to have those conclusions not be based on a sample of data, but, rather, on analyzing the population of data. He said “In the late 1980’s, early 1990’s, the predominant technique that internal auditors used was sampling. If an audit was designed to vouch fixed assets, auditors would pick a sample of 25 or more fixed assets; re-compute, or test, the acquisition date, and the disposition date; and finally re-compute depreciation by hand. If the fixed assets in our sample were properly recorded, then we looked up on a statistical chart or table and concluded that we were sufficiently confident that all of the fixed assets at the company were properly stated.”

He further said “with today’s digital accounting software, every fixed asset can be downloaded and the depreciation re-computed based on the acquisition date and the disposition date and the various depreciation rules for each asset class. If there are any differences in the valuation of any asset, the differences can be found through data analysis. Data analysis allows a company’s auditor, whether internal or external, to re-compute or model the financial recording of transactions, as they ought to be recorded and, therefore, have even greater confidence than if they had tested using sampling. By analyzing every asset and related transaction, a company is able to test the entire population and be much more confident in the results. This has obvious implications for any FCPA audit as there is no materiality standard under the FCPA.”

Data analytics can transition from a review of historical transaction to a review of current transactions simply by asking similar questions of similar data, but with a change in focus. This focus change is to answer the question “what is happening now and what should we do about it” instead of merely “what has happened.” When your bank or credit card company puts a freeze on your charge card because of suspicious transactions, they are using data analysis as an alerting function. More sophisticated companies use this sort of data analytics tools and processes as part of their Compliance program for areas like monitoring for improper payments or to identify vendors who may be a match with entities on a Denied Parties list.

This use of monitoring as an alerting task is a logical next step for compliance teams, but most are not yet for any number of reasons. The transition from data analytics as historical analysis to alerting through continual or continuous monitoring can be a challenge, and it is still an emerging best practice. Continual or continuous monitoring establishes these alerts and suggests us to take action based on something that happened just a quick moment ago.

I asked Oringel if he could provide an example along the lines of the Department of Justice (DOJ) and Securities and Exchange Commission (SEC), jointly released FCPA Guidance, which says that the goal of a best practices compliance program should be toPrevent Detect Remedy matters before they become FCPA violations. He translated the FCPA Guidance into “Stop, find and fix”. He believes that it is about asking the time period that you are pulling the data from, so if you are looking at transactions that happened 6 or 9 months ago, then your analytics are serving as a reporting function. He gave an example where a business development person entertained a government official, yet did not seek preapproval to do so. Unfortunately, the amount spent was more than was allowed under the company’s Gifts and Entertainment Policy for entertaining a foreign official. Now the compliance function needs to fix that policy violation and make sure that it does not happen again.

The next frontier for data analytics is a move from alerting to predictive analytics, which is using data analysis to predict what will likely happen in the future. This allows us to move from answering questions about what has happened in the past or present to what will likely happen in the future. While predictive analytics is common in many industries and processes, like Commercial Lending or Insurance, it is not at all common in compliance. Yet.

The “find” capability goes from the past to the present and to the future and may be where the most advanced audit and compliance teams go next. This actually moves to an almost a proscriptive action, where, because you were able to predict, or have an insight, going forward you are able to deliver a risk management solution to that potential situation.

Oringel concluded by saying that it is this future orientation, with data analysis as a predictor, that he believes is the next step in the compliance function using data. A company can score high risk employees in their unit by identifying the salespeople that tend to not respect the organization’s T&E policies; who spend too much on lavish meals or engage in other activities which contradict company policies, such as neglecting mandatory compliance training or simply being routinely late with expense report submissions.

============================================================================================================================================================================

Joe Oringel is a Managing Director at Visual Risk IQ, a risk advisory firm established in 2006 to help audit and compliance professionals see and understand their data. The firm has completed more than 100 successful data analytics and transaction monitoring engagements for clients across many industries, including Energy, Higher Education, Healthcare, and Financial Services, most often with a focus on compliance.

Joe has more than twenty-five years of experience in internal auditing, fraud detection, and forensics, including ten years of Big Four assurance and risk advisory services. His corporate roles included information security, compliance and internal auditing responsibilities in highly-regulated industries such as energy, pharmaceuticals, and financial services. He has a BS in Accounting from Louisiana State University, and an MBA from the Wharton School at the University of Pennsylvania.

Joe Oringel can be reached at joe.oringel@visualriskiq.com.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2016

Five tips...#5 - Supplement Necessary Skills with Internal or External Resources

noreply@blogger.com (Joe Oringel) — Fri, 09 Jan 2015 11:52:00 +0000

This week we have been blogging about how to succeed with data analytics in areas such as internal audit and compliance. Monday we introduced the following Body of Knowledge and indicated that each of the skills below are often needed for a data analytics project.

Project Management
Data Acquisition and Manipulation
Statistical techniques
Visual Reporting techniques
Communication
Audit and Compliance Domain expertise
Change Management and Strategic Thinking

Does this mean that audit teams need a statistician or visual reporting whiz in the department? Not at all. Just as audit teams co-source with supplemental resources, they can also co-source for data analytics. Better still, co-sourcing with internal company resources, in the form of a secondment or guest auditor is often possible. Reach into IT's Business Intelligence or data warehouse group, and internal audit can find talent with excellent company and data manipulation expertise. Reach into HR or Finance for someone with domain expertise around incentive compensation and team on that important Sales commission audit project.

Will these resources have advanced audit or compliance domain expertise? Probably not, but Tom Brady doesn't play running back or wide receiver yet he makes those players better by fitting the pieces together. Audit and compliance leaders know what questions we want to answer. It's the "how" where we sometimes need help. At Visual Risk IQ, I have the very good fortune to work with an incredibly talented team that is deep in database design, data manipulation, programming, and visualization skills. We work together to make sure that our queries are answering the right business questions, and in turn that those answers are being communicated in a way that is precise and easy to understand.

When we have first worked in domains where our experience had been limited (e.g. Health claims in 2008, FCPA / anti-corruption in 2010, or HR in 2013), we relied heavily on domain expertise from our clients' General Counsel's office or on consultants to our firm, so we could bring the full expertise needed for a project, given the body of knowledge framework above. This technique has worked consistently for us, and it works for audit and compliance too.

Good luck in 2015 with your data analytics projects! Please write or call if you'd like to compare ideas on how to excel in data analytics for audit or compliance. We'd be happy to assist in your success!

Joe Oringel

Managing Director

Visual Risk IQ

Five tips...#4. Consider metric, outlier, and exception queries

noreply@blogger.com (Joe Oringel) — Thu, 08 Jan 2015 12:34:00 +0000

For readers seeing this post as their first of the series, today is actually the fourth of a five-part blog that has been developed in response to Internal Auditor magazine's lead article titled "The Year Ahead: 2015". Because so many people make resolutions for the new year, we wanted to help audit and compliance professionals succeed with their resolutions. Especially because we believe there are more than a few whose resolutions include becoming more data-driven in their work through regular use with data analytics.

Yesterday we defined metric, outlier, and exception queries, and provided examples in the context of related potential audit projects around expenses such as Accounts Payable, Travel and Entertainment, or Payroll. To review, metric queries are simply lists of transactions that measure values against various dimensions or strata, such as rank or time series. Top 10 largest or simply transactions by day of week are examples of metric queries. These metric queries are powerful, and can become even more powerful when combined as part of outlier and exception analysis.

One recent Travel and Expense example from our client work was seeing a number of executive assistants in the "Top 10 Travel Spend reports." Even before we looked at any exception report it became clear that some of the organization's executives had their assistants complete and submit their personal expense reports, and then approved those reports themselves.

Outlier queries are those that compare value to other values like a mean or standard deviation. As an example, saying that today is twenty degrees colder than average or the coldest day of winter is more informative than saying that it will be sixteen degrees tomorrow than yesterday. Better still, listing the 10 coldest days together in relation to average and standard deviation is even more informative.

We recommend diving into exception queries only after metric and outlier queries have been prepared, explored and analyzed. It's common for false positives to be averted through thoughtful review of metric and outlier queries.

How does this compare to your experiences?

Five tips... #3 - Understanding and Exploring Your Data

noreply@blogger.com (Joe Oringel) — Wed, 07 Jan 2015 15:53:00 +0000

This week's 3rd tip for advancing with audit and compliance analytics is to "Understand Your Data, and Explore it Fully Before Developing Exception Queries." One common mistake that we see audit and compliance professionals make with data analytics is that they sometimes dive right into searching for transaction exceptions before exploring their data fully. This limits the effectiveness of their analysis, because they are searching for something specific and can overlook other conditions or anomalies in their data. If you've not seen the selective attention (aka Gorilla and Basketball) videos from Daniel Simons, here's a fun link.

Selective attention on exception queries seems to happen due to the strengths of traditional analytics tools like Microsoft Excel and general purpose tools like CaseWare IDEA or ACL. It is less common with Visual Reporting tools like Tableau and Qlikview, in part because these tools are designed to specifically support data exploration and interaction with click and drill-through capabilities. Visual Reporting capabilities are very effective for data exploration, and some rudimentary visual capabilities can be found in Excel, IDEA, and ACL.

During data analytics brainstorming, we categorize analytics queries as Metric Queries, Outlier Queries, and Exception Queries. When prioritizing queries to be built for client assignments, we make sure that there some of each type of query, so that sufficient data exploration takes place before we jump into exception queries or begin researching exceptions.

Metric queries are those analytics such as "Top 10 Vendors by Vendor Spend" or "Top 10 Vendors by Number of Transactions", or "Top 10 Dates of the Year for Requisitions (or Purchase Orders)." Simply summarizing number and value of transactions by different dimensions (day of week, week of quarter, or by UserID) can identify anomalies that should be questioned further. On a recent Payroll Wage and Hour project, we found unusual patterns of when people punched in and out much more frequently on some minutes (e.g. 7 or 23 minutes past the hour, vs. 8 or 22 minutes past the hour). This condition called for further inquiry and analysis about whether time rounding was fair and equitable for certain types of workers. This condition is in fact a major compliance risk and should be considered for any employers with a significant number of hourly worker. See Corporate Counsel article for more information.

Outlier queries are comparative analytics like "Largest Invoice to Average Invoice, by Vendor," "Most Expensive Airfare by Distance," or "Most Expensive Travel / Entertainment Event per Person vs. Average Event per Person." These outlier queries are also essential, in that they help identify patterns or relationships that should be investigated further. Digital analysis such as Benford's Law is a well-known audit example of an Outlier query, but there are many more techniques that can yield insight beyond only Benford's Law.

Example of exception queries are more traditional Analytics queries such as these listed below:

List if two (or more) invoices have been paid for the same amount to the same vendor
List any purchase orders created after their corresponding invoice
List any Vendors who share a Tax ID Number, Address, or Phone Number with an Employee
List any Vendors who have had transactions posted after being Terminated or made Inactive

In short, we recommend spending at least an hour and as much as a day or more exploring and analyzing your data, before beginning any Exception Queries. A data exploration checklist follows - any additions or other suggestions to this list are welcome.

Sort transactions from oldest to newest and from newest to oldest. Any unusual dates or times? Any gaps in date or time stamps? Why?
Sort transactions from largest to smallest and smallest to largest. Any unusual negative values?
Stratify by various status codes, reason codes, or transaction types. Are all values consistently completed. Any unusual relationships? What do each of the codes and values represent?
Stratify by dollar value ranges. Do 20% of the transactions make up 80% of the value? Should they? The Pareto Principle says yes, but your business may vary.
Compute Relative Size Factor (largest to average and largest to second largest), and sort again. Do any of these RSF values cause you to want to drill into specifics? Consider whole numbers and large numbers. Why or why not?

What has been your most significant "aha" moment when exploring your data? Comments and feedback are welcomed below.

Joe Oringel
Managing Director
Visual Risk IQ
Charlotte NC

Five tips for Advancing with Audit Analytics. Tip #2 - Brainstorming

noreply@blogger.com (Joe Oringel) — Tue, 06 Jan 2015 16:03:00 +0000

Yesterday we started a multi-part post on the importance of building audit data analytics capabilities, together with some "how-to" tips. Our first tip was how this is actually as much of a people challenge as a technical undertaking. One particular "secret" is that a combination of skills are needed to accomplish these analytics projects, and we see many departments make the mistake of assigning a single individual to carry out a project, without sufficient assistance or at least oversight from colleagues that have complementary skills.

In our data analytics consulting practice, we use a Body of Knowledge framework to identify needed skills for a particular project, and then match at least one "expert" with an "apprentice" that is looking to add to these same skills. Together our teams bring excellent qualifications in each of these domains, but it's rare that they all arrive in the form of a single consultant. That framework was published here yesterday.

Today's tip is to "Begin with the business objectives in mind, and map from these objectives to available digital data." Too often, we see compliance and audit teams request data and begin to interrogate it before understanding the data fully or taking steps to validate control totals and/or data completeness. A related mistake is to exhaustively test a single data file without considering supplemental data sources that may yield greater insight or answer related business questions.

A recent example of why to begin with business questions was a Payroll project that we completed for a retail client. Our team was tasked with searching for "off-the-clock" work. If we had focused only on available data files, we could have answered questions about meal breaks, rest breaks, and overtime but perhaps missed other hours worked but not paid. By focusing on the business question first, we identified badge data and cash register data to identify if employees were in the store and ringing sales, yet were off the clock at the time of badge swipes or point-of-sale,

As such, the first step in any data analytics project is brainstorming. You can think of it as part of project planning. During this step, teams should identify the business questions that they want to answer with their analytics efforts, and cross-reference these business questions against available reports and digital data. If existing report(s) fully answer a business question, then a new query may not needed**. But if a report does not currently exist, then analytics should be considered and understanding data sources becomes a key next step. During brainstorming, it is very important to understand the number and complexity and number of data sources that will be needed, and to focus only on a small enough number of business objectives so that the number of data sources does not get overwhelming. It is better to have a series of "small win" analytics efforts, than a larger, less successful project

Tune in tomorrow for tips on how to understand your data better, and how to explore it before building exception queries. In the meanwhile, comments and suggestions are welcome.

Joe Oringel
Managing Director
Visual Risk IQ
Charlotte NC

** Note that some audit and compliance teams may choose to build queries that replicate existing reports, to test the report validity. For important reports, this re-performance can provide comfort or assurance that the original report is working.

Five Tips for Advancing with Audit Analytics

noreply@blogger.com (Joe Oringel) — Mon, 05 Jan 2015 15:27:00 +0000

For many people today, Monday January 5, is the first work day of 2015. We compliance and audit professionals are like our many co-workers and friends in that we have new goals and ideas that we expect should set this year apart. We want to grow and develop personally and professionally and have even greater career success. Inside and even outside of our current roles. But how?

Even more than in previous years, 2015 is shaping up as the year that Analytics will be adopted by the audit and compliance profession, at least according to Internal Auditor, the global professional journal for internal auditors. See article titled "The Year Ahead:2015."

This article quotes several high profile Chief Audit Executives (CAE's) on the subject of Analytics. Raytheon's Larry Harrington, a frequent keynote speaker for the IIA says that "you will see greater use of data analytics to increase audit coverage without increasing costs" and that "internal audit will leverage analytics from other lines of defense," such as compliance and risk management. Increased use of Analytics will lead to greater value from audit and compliance, as measured by management. But if this was easy, wouldn't we all be doing it already? How should we overcome obstacles such as finding the right people, training, and budgets (as cited by the CAE's in this article)

Visual Risk IQ has been helping audit and compliance professionals see and understand their data since 2006. We work with all leading audit-specific tools (e.g. CaseWare IDEA, ACL, and newcomer Analyzer, from Arbutus Software), and also with general purpose analytics and visual reporting tools like SQL, Tableau, Oversight, and more. Importantly, we have completed hundreds of engagements for clients across a wide variety of industries.

These five tips are:

1) Consider skills and experience of the team, not individuals, when planning a data analytics project.
2) Begin with the business objectives in mind, and map from these objectives to available data
3) Understand your data, and explore it fully before developing exception queries
4) Consider outlier, metric, and exception queries
5) Supplement necessary skills with internal or external resources

We'll be expanding on each of these five tips in blog posts later this week, but here is some information on the first and perhaps most important one. Your people.

1) Consider skills and experience of the Team, not individuals, when planning a data analytics project.

As part of our consulting projects, and for our inward assessment of our own team members, we use an analytics-focused Body of Knowledge framework that has the following seven key components.

Project Management
Data Acquisition and Manipulation
Statistical techniques
Visual Reporting techniques
Communication
Audit and Compliance Domain expertise
Change Management and Strategic Thinking

In our experience, data analytics projects succeed because of project expectations and corresponding competencies of team members in these seven areas. It's especially important to note that these body of knowledge components are rarely (if ever?) found at a high level within a single individual, and therefore a team approach is needed to accomplish successful an analytics projects.

People that have greater skills at project management or communication of issues may not have the requisite technical experience when it comes to data acquisition and manipulation, or statistical techniques. Similarly, it is common for stronger data specialists to be weaker on audit or compliance domain expertise.

So when planning an audit analytics project, be sure that you've built a team that has each of these key elements in their skill set, and that they have the incentives and team structure to work together and learn from each other's expertise.

Tune in tomorrow for more on how to begin with the business objectives when planning an audit analytics project. In the meanwhile, comments and suggestions are welcome.

Joe Oringel
Managing Director
Visual Risk IQ
Charlotte NC

Rutgers WCAS 26 - January 2013, part 1

noreply@blogger.com (Joe Oringel) — Wed, 16 Jan 2013 14:20:00 +0000

Back again at Rutgers for the 26th World Continuous Auditing and Reporting Symposium (WCARS), which was delayed from November 2012 due to Hurricane Sandy. Yes, it's been a while since we've updated this blog, but we've become much more active in using Twitter ( @VisualRiskIQ ) to highlight what's new in the world of continuous auditing, continuous controls monitoring, compliance monitoring, and anti-fraud analytics. And though we'll be tweeting from #WCARS26 also, we feel that the Rutgers symposium is too important to cover in only 140 characters.

Presenters and sponsors at the 26th WCARS event include the AICPA and ISACA, all of the Big 4, and software providers such as ACL, CaseWare, CA, CCH, Greenlight, Oversight, and Trintech. Throughout the conference, we expect to see a wonderful mix of software and process case studies, standards reports, and academic papers, all on the subject of Continuous Auditing. The Rutgers definition of CA includes continuous data monitoring (i.e. embedded audit routines), continuous controls monitoring, and also continuous risk assessment, and presenters will cover all these topics. An important addition has been newly minted PhD Kevin Moffitt, who adds deep expertise in unstructured data analytics and text mining to Rutgers long history of data analytics of structured data.

Corporate attendees and presenters include advanced users of CA including Siemens, Verizon, Proctor & Gamble, HP, and more. More on the agenda, including selected slides, is available at: http://raw.rutgers.edu/26wcars .

The conference has begun with a nice introduction from Miklos on the status of numerous research and practical CA applications at Rutgers, and is transitioning to Eric Cohen, PwC's XBRL expert. More to come...

Joe Oringel
Harrison, NJ
January 16, 2013

Remembering 9/11/2001

noreply@blogger.com (Joe Oringel) — Tue, 11 Sep 2012 11:06:00 +0000

It was afternoon for me in Ireland, where I was working on a project with Bristol-Myers. On a conference call with our NYC offices in midtown east. "Joe we need to reschedule the call, a small single-engine plane has hit WTC. Everybody is turning to the news to see what's going on." I wish that was what had happened. My wife was 8 months pregnant with our second child, who we named Juliana to honor the daughter and her mother, an Irish national that both lost their life on the plane that hit the towers. Juliana McCourt never saw her 5th birthday. Thankfully her uncle made it down 50+ stories of the WTC. Later that day he would learn of his sister's and niece's death. I'll never forget the outpouring of support for NYC and the whole US from the city of Dublin and the whole country of Ireland. It took me nearly a week to return home, yet given the tragedy all around us in NY/NJ, we know we were still so very fortunate. Where were you? What should we teach our children? Originally posted on 9/11/11, but an appropriate re-post.

IIA General Audit Management - highlights / action plans

noreply@blogger.com (Joe Oringel) — Tue, 27 Mar 2012 20:19:00 +0000

Along with more than 1,200 other audit and compliance professionals, I had the pleasure of attending IIA's General Audit Management (GAM) conference last week in Orlando. The GAM Conference is the marquis training and networking event for Internal Audit executives, and as such provides excellent opportunities to interact with industry colleagues and understand the issues that are on the top of their lists for action.

Personally, I look for themes and even short sound bites from conferences such as this. Sequentially, the first memorable sound bite was Sunday evening, when IIA CEO Richard Chambers reported the results of the IIA's "Pulse of the Profession Survey." Richard reported that the two most sought after skills among Fortune 500 internal auditors are: (1) critical/analytic thinking, and (2) data mining and analytics. Being a firm that focuses on audit data analytics, that fits our sweet spot very, very well. Importantly too, his point was not only about the sought-after technical skill. Yes, knowing "how do I answer the question" is important, but also knowing "what is the right question" is critical. Asking the right question is the responsibility of audit and executive management, and is not purely a technical skill.

The second sound bite was from the same session Sunday, when Richard reported that 89% of audit executives are "definitely not getting the most from existing audit technology investments." Scary, but perhaps not surprising. Yes internal audit software vendors bring knowledge of how their tools work, but how well do they understand internal auditing? Have you been satisfied with the amount of industry knowledge and/or business acumen that your software vendor's implementation team has brought to your most recent project? Why or why not?

Finally, my favorite sound bite came from Audit Committee Chair Jim Brady during a panel on Tuesday morning on the relationship between Audit Executives and the Audit Committee. When asked "what keeps him up at night," Brady replied unequivocally that it was "Cybersecurity and Emerging IT Risks". This resonated with me because like audit data analytics, understanding Cybersecurity and Emerging IT Risks are not an "IT Audit job," but rather everyone's job.

What were your personal highlights from IIA's GAM Conference? Any sound bites more memorable than these. Plus please stay tuned for future posts on the importance of understanding Cloud Computing, Mobile Computing, and other Emerging IT Risks that we believe all internal audit professionals need to be more aware of.

Regards,

Joe Oringel
Visual Risk IQ
Charlotte NC, USA

Another Saturday Morning in Newark NJ

noreply@blogger.com (Joe Oringel) — Sat, 05 Nov 2011 14:49:00 +0000

Very energizing sessions this morning, as we heard from a Who's Who of large, multinational firms who have implemented CA and CM solutions. Siemens Financial Services led things off with their "Road to Continuous Assurance," as Jason Gross leads a mature CM function that was born in Internal Audit and has migrated to the CFO's office. His deck is downloadable at: http://raw.rutgers.edu/23WCARS

Brad Ames from HP followed with another strong presentation on using CA / CCM for assessing both IT controls and Financial Controls. @43Chase and @debreceny observed that strong IT controls help enable strong financial controls. I was focused on their use of dashboards at HP, and have asked for examples. Stay tuned.

Dave Levin of Proctor & Gamble followed with a strong session on the use of data-driven risk assessments. They compare results of Control Self Assessment and actual audit results, using outliers and differences between management's assessment (i.e. CSA) internal audit's evaluation as input into Internal Audit's risk assessment. Dave's session is available for download at this link.

Leveraging Information to Align Risk and Performance - CM, per KPMG

noreply@blogger.com (Joe Oringel) — Fri, 04 Nov 2011 14:41:00 +0000

Jim Littley from KPMG is talking about Continuous Monitoring (CM) / Governance Risk & Compliance (GRC) / Business Intelligence (BI) etc., and all of the alphabet soup of technology tools that can be used improve controls and risk monitoring. He observes that most large organizations have multiple initiatives related to acquiring and implementing tools and technologies for point solutions that assist in this area, but these are siloed and rarely linked together. He sees Internal Audit as a potential value-creator in this area.

Good points. We see Procurement teams with supply chain analytics, Finance with BI and macro-level analytics, and Internal audit with audit data analytics, ERM or Risk with survey tools for subjective risk assessment, sometimes all in the same firm. Ideally, macro-level analytics tools like BI should work together with the exception analytic tools in the CM world to provide a single, integrated review of risk.

Jim suggests we think of Continuous Monitoring as the first line of defense, and Continuous Auditing as the second or third line of defense. Using common data sources (i.e. a single source of truth) can lower the cost of acquiring data for each initiative, and improve overall quality.

Slides aren't posted (yet?), but I'll update this post with a link if they are made available.

Opening Rutgers WCARS session - Continuous External Auditing

noreply@blogger.com (Joe Oringel) — Fri, 04 Nov 2011 13:37:00 +0000

The opening panel was led by Greg Shields of the Canadian Institute of Chartered Accountants (CICA) and included Deloitte's National Office Partner Tom Criste, Retired Deloitte Partner Trevor Stewart, and PhD Student Paul Byrnes. A little disappointing that more signing partners from more accounting firms were not on the panel. Perhaps that would help unlock the code on the very slow adoption of use of technology to execute external audits.

Much emphasis was on the degree of change that would be needed for the firms to seriously re-engineer their processes. My favorite quote from the session was from Tom Criste, who observes that the great increases in technology have affected how audits are documented, but not how audits are performed. The work programs for Inventory, A/R, Cash, etc., are relatively unchanged even from when he entered the profession decades ago. And because many procedures (e.g. Inventory Observation, Confirmations of A/R balances) are required by professional standards, it would be difficult to re-engineer the audit.

Mr. Criste envisions an audit where statisticians and economists could review data and help form the External Auditor's opinion. He suggests that a test audit could be performed in parallel with a traditional external audit, and that the firm could compare results and findings with each other and the client. But he says, who would want to invest that time and energy, even if the second audit was free?

If that's truly the barrier, I'd suggest to start with the users of financial statements. Would MF Global's investors and creditors like to have had any assurance provided on quarterly financial results? Probably so.

I'd advocate beginning with the end in mind, and determine the desired frequency of external audit assurance. More than annual is probably good. Daily is probably way too frequent. (What CEO wants to explain slow mid-month sales to Wall Street Analysts).

If quarterly assurance was desired, how should external audit procedures be changed? Comments welcome!

Live from Rutgers WCARS - Friends and Family meeting

noreply@blogger.com (Joe Oringel) — Thu, 03 Nov 2011 18:26:00 +0000

Most of you reading this blog post have an awareness and even a keen interest in data analysis and/or continuous auditing, whatever we agree that means. You may not know how long this topic has been being discussed and debated.

I'm writing this from the 23rd (!) World Continuous Auditing Symposium at Rutgers Business School in Newark NJ. It's been a semi-annual meeting, so the group began gathering in 1999. All of the Big 4 firms are here, as are the AICPA, software vendors like ACL, Caseware, Oversight, and even CA. For more information on the agenda, see: http://raw.rutgers.edu/23WCARS .

Beginning tomorrow morning, I'll be blogging about the most interesting speakers, topics, and academic papers on the main agenda, so come back often for updates.

Today is the "Friends and Family" meeting, where some of the longer-standing supporters of the Rutgers program are discussing emerging issues. One topic on the agenda is the notion of Audit Data Standards, which would be a common data model for certain business processes like General Ledger and perhaps subledger like Supply Chain or Revenue.

The presenters advocate a cloud-based data store that public companies would use to load daily or at least monthly transactions, and that external auditors (and perhaps internal auditors) would access that data periodically to perform audit analytics. Glad I'm here - there's a lot of pro's and con's to consider with this standardization.

Remembering 9/11/2001

noreply@blogger.com (Joe Oringel) — Sun, 11 Sep 2011 14:12:00 +0000

My wife was 8 months pregnant with our second child, who we named Juliana to honor the daughter and her mother, an Irish national that both lost their life on the plane that hit the towers. Juliana McCourt never saw her 5th birthday. Thankfully her uncle made it down 50+ stories of the WTC. Later that day he would learn of his sister's and niece's death.

I'll never forget the outpouring of support for NYC and the whole US from the city of Dublin and the whole country of Ireland. It took me nearly a week to return home, yet given the tragedy all around us in NY/NJ, we know we were still so very fortunate.

Where were you? What should we teach our children?

(written from 30000 feet, courtesy of Gogo. Eerie to be flying cross-country today. But very proud of our country's resilience and the feeling of safety as I travel.)

New GTAG on Data Analysis from IIA

noreply@blogger.com (Joe Oringel) — Fri, 19 Aug 2011 13:04:00 +0000

The IIA has published a new Global Technology Audit Guide, the 16th in a series. It is available for free download (IIA Members only) or purchase (for non-Members) at the following link.

Noteworthy in this GTAG is the use of a Maturity Model that outlines the progression from Basic Analytics through to Continuous Monitoring. While the model is simpler and less prescriptive than ours published previously (download WG&L article featuring Arrowpoint Capital here), we believe it represents important guidance to assist audit teams in advancing from "zero to 60" in the use of data analytics.

What do you think of the new GTAG? We'll provide more thoughts on this guidance next week...

Emerging IT Issues for Audit & Compliance Leaders

noreply@blogger.com (Joe Oringel) — Thu, 18 Aug 2011 22:15:00 +0000

In recent months, I've had the opportunity to re-kindle my professional relationship with Professor Scott Fargason. Scott and I had previously have worked together as co-instructors for a variety of training events, both while I was at Deloitte & Touche and more recently as volunteers and paid presenters for various IIA and other training conferences. We find our background and experiences dovetail quite well - his academic and legal training are top notch, and I bring a practical "here's what works" perspective from my time in both consulting and industry.

We've come together to build a customized one- or two-day CPE seminar titled "Emerging IT Issues for Audit and Compliance Leaders" that we believe offers something quite new, most notably a two-instructor format with total costs similar to courses with only a single instructor.

For more information, please download a two-page flyer on the course and contact either of us for questions about availability.

Continuous Auditing and Monitoring Bootcamp Scheduled in Houston

noreply@blogger.com (Joe Oringel) — Thu, 11 Aug 2011 12:39:00 +0000

Visual Risk IQ will be leading a one-day workshop in Houston on Tuesday 9/27, hosted by the Texas Society of CPA's. The workshop is designed to help you get started on the path to delivering measurable results with continuous monitoring and auditing. This class builds on a highly-reviewed program in Atlanta delivered earlier this year.

We will discuss overall methodology, detailed design for constructing a CA program, talk about current technology, and demonstrate how to turn “CA” into “CM” to benefit your entire organization.

Outcomes from the class will include a Company-specific roadmap, customized for your business and stakeholders, to target the risks you identify and benefits you want to achieve.

Attendees will receive up to 7.5 hours of NASBA-compliant CPE and accomplish the following learning objectives.

1. Business challenges today, and how early detection mitigates greater risks
2. Working definitions of CCM, CM and CA and supporting technologies
3. How to determine where your organization is on the CA/CM maturity model
4. Hurdles to CM/CA implementation and how to overcome them
5. How to dive deeper to determine specific needs in developing the roadmap for CM/CA implementations
6. Proven methods for engaging other stakeholders

For more information, see the following Registration page to download a more detailed program description.

Continuous Auditing and Monitoring Bootcamp Scheduled in Atlanta

noreply@blogger.com (Joe Oringel) — Wed, 15 Jun 2011 17:58:00 +0000

Visual Risk IQ will be leading a one-day workshop in Atlanta, hosted by the Georgia Society of CPA's. The workshop is designed to help you get started on the path to delivering measurable results with continuous monitoring and auditing.

We will discuss overall methodology, detailed design for constructing a CA program, talk about current technology, and demonstrate how to turn “CA” into “CM” to benefit your entire organization.

Outcomes from the class will include a Company-specific roadmap, customized for your business and stakeholders, to target the risks you identify and benefits you want to achieve.

Attendees will receive up to seven hours of NASBA-compliant CPE and accomplish the following learning objectives.

1. Business challenges today, and how early detection mitigates greater risks
2. Working definitions of CCM, CM and CA and supporting technologies
3. How to determine where your organization is on the CA/CM maturity model
4. Hurdles to CM/CA implementation and how to overcome them
5. How to dive deeper to determine specific needs in developing the roadmap for CM/CA implementations
6. Proven methods for engaging other stakeholders

For more information, see the following Registration page, or see our Events webpage to download a more detailed description.

An $8 Million Question: Why do auditors test changes to Vendor Master Files?

noreply@blogger.com (Joe Oringel) — Mon, 04 Apr 2011 16:11:00 +0000

One of the early audit tests that I was responsible for was to review who had access to change our vendor master file, and to make sure that all those changes were logged, reviewed, and approved. Our audit objective were validity - making sure that all changes to the master file(s) were properly authorized. But even authorized changes to the master file create risk.

Case in point: Conde Nast's $8 million email scam, as reported in this Forbes Magazine blog posting from William Barrett and Janet Novack.

What seems to have happened in the Conde Nast case is that a fraudster sent in a change of address / change of banking information request on behalf of a legitimate vendor. But the bank information provided was not the actual vendor; rather it was an account set up by a fraudster with a similar name and address as the real vendor. So properly authorized payments totaling nearly $8 million were misdirected. The fraud was detected when the real vendor called to ask "where's our money?"

A variety of preventive and detective controls began to visualize in my head when I read this story. How are changes to address and/or bank information communicated from your suppliers? How are these changes corroborated?

How might data analysis be used to identify mis-matches between supplier names and addresses? Seems like a good time to ask at your organization, even if an AP audit is not on the current quarter's schedule.

Joe Oringel
Visual Risk IQ
Charlotte, NC USA

Book review - a Great Read for Data Analysis Folks

noreply@blogger.com (Joe Oringel) — Mon, 21 Feb 2011 15:50:00 +0000

Just finished Malcolm Gladwell's "What the Dog Saw" on a long plane ride this weekend. Like his other books (Tipping Point, Blink, and Outliers), there are great stories and examples for those of us involved in data analysis, including internal auditing and especially continuous auditing.

Gladwell's current book is actually a collection of essays from New Yorker magazine, but they piece together nicely so the essays can be read in sequence or by selecting chapters of interest. If you have time to only read one chapter, I'd point you toward the chapter "Open Secrets. Enron, Intelligence, and the Perils of Too Much Information."

The book points out that Enron's Special Purpose Entities (SPE's) were entirely transparent. To a fault. Because each of the more than 3000 SPE's involved paperwork of an average of 1000 pages of filings. Even an executive summary of an SPE contained 40 single-spaced pages. So the challenge in understanding the financial risks of their SPE's was to understand how to filter an insanely large volume of data into a form that was manageable, comprehensible, and actionable.

As you progress on the Continuous Auditing and Continuous Monitoring Maturity Curve, you'll find that your teams are amassing a similarly overwhelming (though hopefully not as large!) set of source data and anomalies to review. How do you see the source data? How do you see the exceptions? How do you decide which ones to act on?

Most data analysis efforts that we have worked have a goal of identifying individual exceptions, or rows, in database speak. So a AP vendor shares an address or tax ID number with an employee. Or a sales invoice had a discount in excess of a contract maximum. To act, we send an email to someone, maybe with a spreadsheet attached, to research and resolve the exception row.

But let's learn from Enron's SPE's. If we send 3000 emails, how will we manage the follow-up. Can we use color and graphs to measure the magnitude of the exceptions in total? How should we identify transactions that are acceptable one-by-one (example: a $9,500 requisition from a manager with a $10,000 signing authority), but unacceptable as a larger series (say ten, $9,500 requsitions from that same manager, all within the same week)?

How to update the IIA GTAG for what's new in Continuous Auditing?

noreply@blogger.com (Joe Oringel) — Mon, 31 Jan 2011 23:19:00 +0000

Today's blog seeks to assimilate some of the things we heard at the IIA International conference last summer in Atlanta, in advance of this week's IIA Working Group discussions regarding the Global Technology Audit Guide (GTAG) on Continuous Auditing #3. The purpose of the Working Group discussions are to identify areas of the GTAG that require updating, so we are pleased to be able to participate with such an esteemed group of colleagues.

I wrote last summer about the IIA International conference, and how Data Analysis and Continuous Auditing were discussed at that three of the more interesting presentations at that conference. Those presenters Dan Kneer, Steve Biskie (ACL Services) and Robert Mainardi, and each presenter spoke on some combination of Data Analysis, Continuous Auditing, and Continuous Monitoring. Though they used many of the same words and terms, their perspective often seemed quite different.

Is Continuous Auditing about audit project selection and Risk Assessment. Yes. So techniques such as regression analysis, ratio analysis, and other analysis of aggregate data should be considered in any GTAG update. But Continuous Auditing is also about more frequent updates of subjective data, like control self-assessment, surveys, and call program activities. Similarly Continuous Auditing can and should include data analysis of transaction details. And greater frequency of data analysis, to include Visual Reporting also aid greatly in Risk and Control Assessment activity. Perhaps text analytics and analysis of unstructured data too.

Looking forward to this week's Working Group, so we can find some distinctive words to distinguish the various types of Continuous Auditing activities for inclusion in any updates to the GTAG.

Since Continuous Auditing can

Joe Oringel
Visual Risk IQ
Charlotte, NC USA

Highlights of Day 2 Rutgers WCAS

noreply@blogger.com (Joe Oringel) — Sat, 06 Nov 2010 15:56:00 +0000

More case studies on Saturday than Friday - presenters have included Hewlett-Packard, Proctor & Gamble, IBM, and Siemens Financial, among others. Highlights from these presentations include:

HP presented their use of monthly data extraction and a variety of CAAT-based and ERP query tools to interrogate transactions and logs. They evaluate a mix of configurable controls and transaction analysis to deliver a risk-based heat map that aids the audit team in project selection decisions. They've made excellent progress from prior years, and continue to be a leader in CA / CM, especially among SAP shops.
P&G presented about their measurement around the business case for their CA / CM investments, which have focused primarily around order to cash (O2C). Their program's strengths are its workflow, in that audit uses "automated delivery of high quality controls tests results to the business." It's the evolution of having MANAGEMENT evaluate the test results (vs. internal audit) that was most noteworthy.
IBM presented about their system that they call Enhanced Auditing with Technology, which is also focuses on O2C. They monitor more than 400 query test attributes (contrast w/ Siemens Financial, who monitors only 45!).
Jason Gross of Siemens Financial presented their CCM program with considerable energy and enthusiasm. Jason and I had previously met at an IIA event during 2007, when he had been in Internal Audit. Interesting is that he has left audit and is now a direct report to the CFO at Siemens Financial. This option should be on the career path of most data-focused, audit professionals as it allows Jason and his team to have more responsibility for research and follow-up on CCM exceptions.

As additional slide decks are posted, I expect to update this and other blog posts from the weekend. - UPDATED w/ HP deck.

Best wishes,

Joe Oringel
Visual Risk IQ
Newark NJ