Green Energy / Sustainability and CCM-T?

This is my first blog post in February, and first in nearly a month. I find the more active I am with Twitter / micro-blogging, the less frequently I post here. Hmmm, there's got to be a better way....Maybe a Twitter digest? But I digress...

As we have much of last year, again today we're thinking about Green Energy and Sustainability. The sociological and public good components of Green Energy and Sustainability are clear, but the growing number of new business start-ups in this space is a sign that the financial rewards of doing good are may also be rewarding. Evidence includes the Wharton School's Sustainability Program and the high ROI payback that can be obtained from Energy Audit activities in both commercial and even residential space. In the last month, we've met with BreezePlay (a Charlotte-based Green Energy start-up focusing in the residential space) and Energy Reduction Solutions (a Florida-based Engineering start-up focusing in the commerical space). Each have sparked our interest.

At Visual Risk IQ, we talk about how CCM-T reduces the marginal cost of "one more question," and helps audit and financial professionals answer important questions about internal controls, fraud, and expense management. Who are the smart people asking questions about Green Energy and Sustainability?

We'd like to meet more of them, so please drop us a line!

Joe Oringel
Visual Risk IQ
Charlotte NC, USA

Speaking at Conferences in 2010

Continuous auditing and data analysis were hot topics as IIA and ISACA programs for 2008 and 2009, and each remain of interest here in the new year. In the last two weeks, we have booked Continuous Auditing and Data Analysis programs in Houston on February 1, and also for the North Carolina IIA District Conference in Charlotte on March 18.

In Charlotte, we will be co-presenting with Dr. George Aldhizer and David Payseur from Arrowpoint. Each of these programs will feature the Continuous Auditing Maturity Model that was published in the Sept / Oct 2009 issue of Internal Auditing. (Reprints available on request - just leave a comment on this post or send an email).

We are also scheduled to speak at the AICPA's National Advanced Accounting and Auditing Technical Symposium, specifically about a data-driven approach to Enterprise Risk Management. This ERM topic is one that we expect will be repeated at other conferences, as using data analytics for risk assessment, whether internal audit project selection or for broader enterprise risk assessment, can be a very powerful application.

Though registration information is not yet posted for this conference, we have also received word that Visual Risk IQ has been accepted as a speaker at the AICPA's Controller's Conference, where our topic will be Social Media and its application for Finance and Audit. So look for more Tweets, Blogs, and LinkedIn updates on that topic as the arrangements are finalized.

Wishing each of you the best for a healthy, happy, and prosperous 2010.

Regards,

Joe Oringel
Visual Risk IQ
Charlotte North Carolina, USA

NC State's ERM Roundtable Date set for Charlotte

Save the date for NC State's ERM Roundtable, to be held on Friday March 12, 2010, at the Westin Charlotte uptown. Instead of the usual two-hour forum, there will be two 90-minute panel discussions surrounding a networking break, and the event will run from 8:30 until noon EST.

This session allows the Charlotte business community access to NC State's renowned ERM Institute, without the nearly 3-hour drive to Raleigh, and is highly recommended to finance and compliance executives in all industries.

The first panel, titled "ERM: Lessons Learned", will feature the following Panelists:

Susie Wilson – Reynolds American Corporation
Dan Wall – RBC Centura
Marshall Croom – Lowe’s Corporation
Dave Landsittel – COSO Chairman

The second panel, titled "ERM: Directions for the Future", will feature the following Panelists:

Steve Dreyer – Standard & Poor’s
David Fox – KBR Inc.
Trent Gazzaway – Grant Thornton
Jim Traut – H.J. Heinz Corporation

For more information or to register, see NC State web site.

Why P-Card / T&E audits can be a good "first" data analysis project?

For those of you who don't follow me on Twitter, (i.e. - the whole world, less 91 people), you may have missed Cal State's recent audit released on December 3 that documented that more than $150,000 in "Improper and Wasteful Expenses" were paid to a very "senior official" in the California State University system. Subsequently it has been reported by Fox 40 that the official is David Ernst, who is currently CIO of the University of California System, according to this release from June 2008. At least, until the UC Union has their way.

Given the tremendous budget challenges throughout California, including the 32% tuition hike that has been national news for most of the last month, this is a most unfortunate time for the incident to come to light. Imagine explaining this hire to the press, given the current budget climate. Reputation risk, for both Cal State and the University of California Systems, far exceeds the amount of these "Improper and Wasteful Expenses".

But there are other, numerous reasons to begin a data analysis and anti-fraud program with P-Card / T&E. More obvious answers are that the data is consistent regardless of organization or industry, that the datasets are normally simple, and that policies are generally easy to interpret. Less obvious answers are that T&E controls provided by banks, such as Merchant Category Codes and Card Limits are useful, but incomplete without comparing to enterprise data like employee leave or termination dates that can be done with modern data analysis software.

My belief is that T&E are a great place to begin a data analysis program, because they may be red flags for other transactions that should be reviewed. I learned this on a project more than 10 years ago, when I was leading an investigation of T&E fraud for an IT Director at a Fortune 500 firm. Through data analysis, we had uncovered a scheme where that Director had stolen more than $50,000, through a pattern of submitting multiple charges for a business trip. One of the team members suggested that we should look at other transactions that the fraudster had approved, and that's when everything hit the fan.

It turns out that T&E fraud at this Company wasn't enough to support the Director's spending habits, so the individual had also established a fictitious vendor scheme that netted more than $1 million in fraudulent disbursements. The investigative team discovered the second, larger fraud by reviewing all other transactions that the fraudster had approved.

So whatever the reason, if you're not using data analysis to review the entire population of P-Card and T&E spend, we recommend you consider it. And if you are reviewing the entire population of transactions, we recommend you do it more frequently. Given that the above expenses were not identified until more than four years after the "Improper and Wasteful Spending" began, and more than 18 months after the official left CSU, this will be a much more expensive and messy incident to resolve.

Stay tuned. Given the current environment, this should be an interesting one.

Joe Oringel

Visual Risk IQ

Charlotte NC, USA

IIA Releases new Guidance, including GTAG #13 - Fraud Prevention and Detection in an Automated World

The IIA released its newest Guidance this morning. Both a Practice Guide titled Internal Auditing and Fraud and a Global Technology Audit Guide titled Fraud Prevention and Detection in an Automated World. Contributors include good friends Rich Lanza, Peter Millar (ACL), and Don Sparks (Audimation / IDEA).

I've downloaded both this evening, and look forward to reading each on my Chicago trip this week. We anticipate updating our proprietary QuickStart methodology for Data Analytics to consider the anti-fraud framework in the Guides.

More to follow in the coming week. Any early comments and observations on either document would be welcomed.

Conflict of Interest / External Databases, in the news again!

Last week's New York Times article about Research Conflicts of Interest within the University community included a link to the US Department of Health and Human Services Office of Inspector General (OIG) audit report. The audit report identifies that financial conflicts, including equity ownership in companies in which researchers' financial interests could significantly affect the grant research. Simply stated, the doctor who reports that compound XYZ could be a breakthrough drug for treatment of disease, may profit significantly from their own research. And that personal gain may not be known to their University, the general public, or the National Institute of Health (NIH) who is often the sponsor of that research.

Though grantee institutions often require researchers to disclose conflicts of interest in research publications, the same institutions rarely reduce or eliminate the financial conflicts. Ninety percent of grantee institutions rely solely on researcher discretion to determine which interests are required to be reported. Because equity interests (i.e. stock ownership) is rarely required to be reported, the specific financial interests of NIH-funded researchers are often unknown.

The OIG audit report recommends that National Institute of Health request grantee institutions to provide detailes to NIH regarding the nature of ALL reported financial conflicts of interest, and how the conflicts are managed, reduced, or eliminated. This change, if implemented, would be a major step-up in Oversight on how the University Research community is monitored.

Stay tuned - the compliance and record keeping impact of such changes could be quite widespread. Fortunately for some universities who have implemented Continuous Controls Monitoring (CCM-T) solutions that compare data from internal to external databases, these changes may be easier to implement. For more information, see: www.VisualRiskIQ.com/HigherEd

For related posts, see: October 2009 and July 2009 blog entries.

Reflections from the Rutgers World Continuous Auditing Symposium (WCAS)

I represented Visual Risk IQ as a panelist Friday 11/6 at the Rutgers WCAS event in New Jersey. Mike Cangemi, former president of FEI moderated our panel, which also included Eric Cohen from PwC / OCEG, and Dr. Virginia Cortijo from University of Huelva (Spain). Despite the presentation time on a Friday afternoon (4:00!), the panel generated nearly a dozen questions from the audience, and dialog continued into the dinner hour.

The event provided opportunity to reconnect with friends and colleagues from most of the CA / CCM software firms, from academia, and most importantly, with other early adopters of CA / CCM. Most attendees had already committed to some level of CA / CCM at their firms, each with varying levels of success. Some observations from the presentations:

• External auditors opine on a balance sheet as of one day each year. Not much continuous about that. Internal Auditing should be leading the charge for Continuous Auditing.
• Most CCM applications focus on a single application - P-Card, Procure to Pay, or Journal Entry review, likely because of simpler data models and availability of commercial software. Exceptions are IBM (Order to Cash) and HP (IT General Controls)
  
• Organizations that are the best candidates for CCM are those that have a zero tolerance for Compliance exceptions and also a relentless desire for Continuous Improvement.
• Internal audit can be the CA / CCM learning lab for the rest of Company. See Terry Hickman's presentation (Proctor & Gamble) for more information.
  
• Most savings realized by audit teams through Continuous Auditing are re-directed toward emerging risks and increasing coverage.
  
• Continuous auditing and data analytics jobs are out there, but the quantity and quality of applicants has been below expectations, according to several hiring managers.
  
• New software entrants such as SymSure for IDEA and ACL's Audit Exchange 2 (AX2) are sparking new projects in CA, as their price point is a marked improvement relative to more comprehensive CCM tools that have previously been available.
  

Our presentation emphasized some of the challenges of defining Continuous Auditing. At some organizations, the term means Continuous Risk Assessment. At others, it means Control Assessment of configurable controls or Control Assessment of Transactions. If people that are doing CA / CCM use the same words for different activities, it's hard for others to follow this leadership. For more information on the conference, see: Rutgers WCAS.

Did you attend? What were your key take-aways. All comments are welcomed!

Joe Oringel
Visual Risk IQ
Charlotte NC, USA