HARNESSING THE POWER OF DATA ANALYTICS AND

HARNESSINGTHE POWER OFDATA ANALYTICSAND CONTINUOUSMONITORINGSEPTEMBER 26, 2017Shana McGee, CIA Manager, Risk Advisory ServicesKirstie Tiernan, CFE, OCA Managing Director, Forensic Technology Services

CPE AND SUPPORTCPE Participation Requirements To receive CPE credit for this webcast: You’ll need to actively participate throughout the program. Be responsive to at least 75% of the participation pop-ups. Please refer the CPE & Support Handout in the Handouts section for more informationabout group participation and CPE certificates.Q&A Submit all questions using the Q&A feature on the lower right corner of thescreen. Presenter(s) will review and answer questions submitted as time allows.*Please note that questions and answers submitted/provided via the Q&A feature are visible to allparticipants as well as the presenters.Technical Support If you should have technical issues, please contact LearnLive:Click on the Live Chat icon under the Support tab, OR call: 1-888-228-4088Audio Audio will be streamed through your computer speakers. If you experienceaudio issues during today’s presentation, please dial into the teleconference:1-855-233-5756, and use teleconference code: 226 838 6759 #2

SHANA MCGEE, CIAMANAGER RISK ADVISORY SERVICESShana McGee is a Manager in BDO Advisory’s Houston office with morethan 10 years of audit and consulting experience, with four of those yearsworking for a Big 4 firm. Shana is a Certified Internal Auditor with a focusin internal audit, Sarbanes-Oxley compliance, ITGC reviews, and contractcompliance.PROFESSIONAL AFFILIATIONSInstitute of Internal Auditors, Houston ChapterISACA, Houston ChapterEDUCATIONB.B.A., Business Administration, LeTourneauUniversity3Shana uses her data mining skills and software to analyze client systemdata and identify compliance issues, process inefficiencies and costrecoveries. Her clients span a variety of industries where she utilizes aseries of computer-assisted auditing tests that examines client’s vendormaster, accounts payable, payroll, general ledger, etc. for the potential offraud, noncompliance of company policies, inefficient business processes,and excessive company costs. She has assisted clients in determiningcontinuous monitoring solutions which best fits their needs.

KIRSTIE TIERNAN, CFE, OCAMANAGING DIRECTOR FORENSIC TECHNOLOGY SERVICESKirstie Tiernan is a Director in BDO Consulting’s Chicago office with morethan 14 years of experience providing data analytics, technologyconsulting, and risk management services. A Certified Fraud Examiner andan Oracle Certified Associate, Kirstie assists clients with utilizing dataacross the organization from multiple sources, locations, systems,languages, and functions.PROFESSIONAL AFFILIATIONSAssociation of Certified Fraud ExaminersEDUCATIONM.B.A, Fraud Management and EconomicCrime, Utica CollegeB.S., Computer Information Systems, IndianaUniversity4Kirstie is experienced in managing big data analytics projects requiring thecollection of entire ERP systems with experience in many accountingsystems, including PeopleSoft, SAP and Oracle. Managing a team ofdatabase and data analytics experts, she provides clients with thenecessary dashboards, statistical models, and predictive analytics to turndata into information upon which key business decisions are made.Applying her expertise in artificial intelligence and machine learning,Kirstie regularly works with clients to prevent and detect organizationalfraud.Kirstie approaches projects with a focus on process efficiency, regularlyimplementing technological advancements within systems and databases inorder to improve and accelerate time-consuming client processes. She alsoincorporates strategic data analytics initiatives to assist litigants,claimants, investigators and auditors with creating decisive and definitereports and conclusions.

TODAY’S LEARNING OBJECTIVESAt the conclusion of this course, participants will be able to: 5Describe the process of continuous monitoring and use ofdata analytics;Discuss the steps to identify and plan continuousmonitoring projects; andDescribe the benefits of data analytics and continuousmonitoring.

TODAY WE WILL EXPLORE 6Data Analytics and What It Can Do for Your CompanyHow Data Analytics and Internal Audit ConnectChallenges and RoadblocksHow to Create Value through Data Analytics andUnderstand Where Your Company IsSample Analytics and Use Cases for Internal Audit ProcessesHow You Can Get Started Implementing Data Analytics intoYour Internal Audit Department

DATA ANALYTICSAND ITS USES7

REAL LIFE ANALYTICS8

WHAT IS DATA ANALYTICS? 9The process of inspecting, cleaning, transforming, andmodeling data with the goal of highlighting usefulinformation, suggesting conclusions, and supporting decisionmaking.Computer-assisted audit techniques (CAATs) which includesgeneralized audit software programs and specializedprograms that test the processing logic and controls of othersoftware and systems.

WHAT IS CONTINUOUS MONITORING? 10Continuous Monitoring is the process and technology used todetect and monitor compliance and risk issues associatedwith an organization's financial and operationalenvironment.Management is able to use summary information to monitordaily transaction volume or activity, and identify anyexceptions or anomalies in a timely manner.The financial and operational environment consists ofpeople, processes, and systems working together to supportefficient and effective operations.

INTERNAL AUDIT AND DATA ANALYTICS 11Using data analytics to strengthen risk assessments and theaudit planLeverage data analytics to strengthen individual auditengagementsData visualization to communicate audit resultsContinuous monitoring to identify problem areas in a timelymanner

CHALLENGES AND ROADBLOCKS 12CostKnowledge and ResourcesSupport and commitmentData availability and qualityCompleteness and accuracyKnowing/understandingexceptions, ‘false positives’Measuring and reporting onsuccess

CREATING VALUE THROUGH ANALYTICS 13Drive and gainefficienciesDrive internalaudit coverageand focusIdentify and testhigher risktransactions

CREATING VALUE CONT’D.14

IDENTIFYING AND PLANNING15

WHERE ARE YOU?Stage 1 TraditionalAuditingManual AuditProceduresNo use ofanalyticalbased toolsStage 2 Use ofanalyticaltools such asspreadsheetsand desktopsoftwareFragmentedand Ad Hocuse ofanalyticsReliance onone teammember orgroupStage 3 16Dedicatedanalytical tool(ACL, IDEA,SQL)Management& drepeatablepractices &proceduresValue basedrecognitionStage 4 Knowledgemanagementand increasedproficiencyand use ofanalytictool(s)Integratedinformationacross theorganizationContinuousAuditing andMonitoringStage 5 Strategic toengagementsContinuousimprovementUsed in riskassessmentOutside datasources usedin integrationUse andintegrationof artificialintelligenceand machinelearning

SAMPLE ANALYTICSVendorGLOne time vendorsBlocked/deleted/do not use vendorsVendors without an addressVendors with similar names or addressesVendors with non-standard payment termsInactive vendors with activity in last yearKeywords analysis of vendor nameDuplicate vendor IDsAccount flow matrixAccount balance trend analysisTransaction reversals within 6 weeksUser activity summaryMost and least utilized accountsDuplicate journal entriesDisbursementPayments created on weekends, holidays, orin off hoursRound dollar paymentsDuplicate payments (same amount, payee, date)Keyword analysis on payment descriptionBenford’s Law on payment amountsPayments just below approval limitSummary of payments by usersPayments to vendors not in vendor masterEmployeeVendor/employee similar name,address, phone or tax IDPayroll trend analysis by functionDuplicate employeesEmployees without payroll deductionsEmployees with a PO box addressInvoiceInvoices created on weekends, holidays, or in off hoursRound dollar invoicesKeyword analysis on descriptionZero amount invoicesSystem created invoicesInvoices from vendors not in vendor masterInvoices with no description17

INTERNAL AUDIT SCENARIO #1PAYROLL AUDIT 18As part of the annual payroll audit for a healthcareorganization, internal audit reviewed payroll reports toensure compliance with overtime policies and procedures;however, payroll reports were limited by department orgroup.Each department head reviewed their own payroll reportsto ensure overtime hours were in line with company policyand sign off was obtained.

INTERNAL AUDIT SCENARIO #1, CONT’D.Traditional AuditAudit Using Data Analytics/Continuous MonitoringPayroll reports reviewed bydepartment heads forovertime compliance; Internal audit reviewedreports for reasonablenessand verified reports weresigned off by dept head; Internal audit tied a sampleof employees from payrollreport back to timesheet. ResultsNo exceptions noted.19A download of payroll data obtained by IT departmentfor a period of one year; Payroll data was tied to general ledger and totals frompayroll reports reviewed by departments to ensurecompleteness and accuracy of data; Data imported into data analytic software and tested100% of hours for all hourly employees across alldepartments.Results Identified employees with excessive overtime per dayspread across multiple departments during the periodaudited. Set up continuing monitoring of process by creatingautomated scripts to identify these exceptions on atimely basis.

INTERNAL AUDIT SCENARIO #2PURCHASE TO PAYABLES AUDIT 20A manufacturing company is concerned that the company isnot leveraging their buying power with suppliers to get thebest price and utilizing volume discounts.The CFO has requested internal audit to review this processfor high volume materials purchased within the past yearduring the purchase to payables audit.

INTERNAL AUDIT SCENARIO #2, CONT’D.Traditional Audit Internal Audit interviewsprocess owners to understandthe procurement of materials,supplier selections andpayment process.A sample of payments for highvolume materials are reviewedto supporting documentation totest for approvals, three-waymatch, discounts taken, etc.ResultsInternal audit was able to test ifdiscounts were taken and suppliersused; however, unable todetermine if company is leveragingbuying power from sample.21Audit Using Data Analytics/Continuous Monitoring Internal Audit obtained a download of accounts payable,purchase order, and vendor master detail to perform thefollowing data analytics on 100% of population: Vendor spend by material for the period or bymonth; Comparison of pricing for same materials butdifferent suppliers; Vendor payments compared to vendor masterpayment termsResultsData analytic results assisted company in making informeddecisions to leverage their buying power. Continuousmonitoring was implemented by distributing daily/weeklysummary reports to management so they can monitor processin a timely manner.

TOOLS22

SAMPLING VS ANALYTICS23

SAMPLING VS ANALYTICS24

SAMPLING VS ANALYTICS: RANDOM SAMPLINGOut of 176 objects,we randomlyselected 10.We had to run 31instances of randomsampling to get #84to show up in ourpopulation.25

SAMPLING VS ANALYTICS: RULES BASED REVIEWExpected AttributesSelect all objects 1) with hats2) with scarves3) without eyes4) without a noseSimilar to:Round dollarWeekend paymentsKeywords26

SAMPLING VS ANALYTICS: 100% REVIEWOne targetedanalytic on whatwe know:Select allobjects without:eyes, a carrotnose, AND amouth27

INVESTIGATIONCFO Start Date286,000 Vendors Limited by: Location of interest Vendor spend over 50,000160 Vendors to ReviewCFO Termination Date

INVESTIGATIONLimited by: Specific user time of employment Round dollar amounts11 Vendors to ReviewCFO Start DateCFO Termination Date 350,000 fraud 2010 - 201529

INVESTIGATION30

VENDOR GEOGRAPHIC REVIEW31

VENDOR GEOGRAPHIC REVIEWQuality Health - 38kAutoMak Body Repair- 40k32St. Pete’s Hospital - 29kGen Chiropractor - 12k

RELATED PARTY DISTANCE ANALYSIS33

GIFT CARD ANALYSISWhy are so many gift cards soldat 8 am in 2010?Hour of Day34

BENFORD’S LAW35