Live from Rutgers WCARS - Friends and Family meeting

Most of you reading this blog post have an awareness and even a keen interest in data analysis and/or continuous auditing, whatever we agree that means. You may not know how long this topic has been being discussed and debated.

I'm writing this from the 23rd (!) World Continuous Auditing Symposium at Rutgers Business School in Newark NJ. It's been a semi-annual meeting, so the group began gathering in 1999. All of the Big 4 firms are here, as are the AICPA, software vendors like ACL, Caseware, Oversight, and even CA. For more information on the agenda, see: http://raw.rutgers.edu/23WCARS .

Beginning tomorrow morning, I'll be blogging about the most interesting speakers, topics, and academic papers on the main agenda, so come back often for updates.

Today is the "Friends and Family" meeting, where some of the longer-standing supporters of the Rutgers program are discussing emerging issues. One topic on the agenda is the notion of Audit Data Standards, which would be a common data model for certain business processes like General Ledger and perhaps subledger like Supply Chain or Revenue.

The presenters advocate a cloud-based data store that public companies would use to load daily or at least monthly transactions, and that external auditors (and perhaps internal auditors) would access that data periodically to perform audit analytics. Glad I'm here - there's a lot of pro's and con's to consider with this standardization.

Remembering 9/11/2001

It was afternoon for me in Ireland, where I was working on a project with Bristol-Myers. On a conference call with our NYC offices in midtown east. "Joe we need to reschedule the call, a small single-engine plane has hit WTC. Everybody is turning to the news to see what's going on." I wish that was what had happened.

My wife was 8 months pregnant with our second child, who we named Juliana to honor the daughter and her mother, an Irish national that both lost their life on the plane that hit the towers. Juliana McCourt never saw her 5th birthday. Thankfully her uncle made it down 50+ stories of the WTC. Later that day he would learn of his sister's and niece's death.

I'll never forget the outpouring of support for NYC and the whole US from the city of Dublin and the whole country of Ireland. It took me nearly a week to return home, yet given the tragedy all around us in NY/NJ, we know we were still so very fortunate.

Where were you? What should we teach our children?

(written from 30000 feet, courtesy of Gogo. Eerie to be flying cross-country today. But very proud of our country's resilience and the feeling of safety as I travel.)

New GTAG on Data Analysis from IIA

The IIA has published a new Global Technology Audit Guide, the 16th in a series. It is available for free download (IIA Members only) or purchase (for non-Members) at the following link.

Noteworthy in this GTAG is the use of a Maturity Model that outlines the progression from Basic Analytics through to Continuous Monitoring. While the model is simpler and less prescriptive than ours published previously (download WG&L article featuring Arrowpoint Capital here), we believe it represents important guidance to assist audit teams in advancing from "zero to 60" in the use of data analytics.

What do you think of the new GTAG? We'll provide more thoughts on this guidance next week...

Emerging IT Issues for Audit & Compliance Leaders

In recent months, I've had the opportunity to re-kindle my professional relationship with Professor Scott Fargason. Scott and I had previously have worked together as co-instructors for a variety of training events, both while I was at Deloitte & Touche and more recently as volunteers and paid presenters for various IIA and other training conferences. We find our background and experiences dovetail quite well - his academic and legal training are top notch, and I bring a practical "here's what works" perspective from my time in both consulting and industry.

We've come together to build a customized one- or two-day CPE seminar titled "Emerging IT Issues for Audit and Compliance Leaders" that we believe offers something quite new, most notably a two-instructor format with total costs similar to courses with only a single instructor.

For more information, please download a two-page flyer on the course and contact either of us for questions about availability.

Continuous Auditing and Monitoring Bootcamp Scheduled in Houston

Visual Risk IQ will be leading a one-day workshop in Houston on Tuesday 9/27, hosted by the Texas Society of CPA's. The workshop is designed to help you get started on the path to delivering measurable results with continuous monitoring and auditing. This class builds on a highly-reviewed program in Atlanta delivered earlier this year.

We will discuss overall methodology, detailed design for constructing a CA program, talk about current technology, and demonstrate how to turn “CA” into “CM” to benefit your entire organization.

Outcomes from the class will include a Company-specific roadmap, customized for your business and stakeholders, to target the risks you identify and benefits you want to achieve.

Attendees will receive up to 7.5 hours of NASBA-compliant CPE and accomplish the following learning objectives.

1. Business challenges today, and how early detection mitigates greater risks
2. Working definitions of CCM, CM and CA and supporting technologies
3. How to determine where your organization is on the CA/CM maturity model
4. Hurdles to CM/CA implementation and how to overcome them
5. How to dive deeper to determine specific needs in developing the roadmap for CM/CA implementations
6. Proven methods for engaging other stakeholders

For more information, see the following Registration page to download a more detailed program description.

Continuous Auditing and Monitoring Bootcamp Scheduled in Atlanta

Visual Risk IQ will be leading a one-day workshop in Atlanta, hosted by the Georgia Society of CPA's. The workshop is designed to help you get started on the path to delivering measurable results with continuous monitoring and auditing.

We will discuss overall methodology, detailed design for constructing a CA program, talk about current technology, and demonstrate how to turn “CA” into “CM” to benefit your entire organization.

Outcomes from the class will include a Company-specific roadmap, customized for your business and stakeholders, to target the risks you identify and benefits you want to achieve.

Attendees will receive up to seven hours of NASBA-compliant CPE and accomplish the following learning objectives.

1. Business challenges today, and how early detection mitigates greater risks
2. Working definitions of CCM, CM and CA and supporting technologies
3. How to determine where your organization is on the CA/CM maturity model
4. Hurdles to CM/CA implementation and how to overcome them
5. How to dive deeper to determine specific needs in developing the roadmap for CM/CA implementations
6. Proven methods for engaging other stakeholders

For more information, see the following Registration page, or see our Events webpage to download a more detailed description.

An $8 Million Question: Why do auditors test changes to Vendor Master Files?

One of the early audit tests that I was responsible for was to review who had access to change our vendor master file, and to make sure that all those changes were logged, reviewed, and approved. Our audit objective were validity - making sure that all changes to the master file(s) were properly authorized. But even authorized changes to the master file create risk.

Case in point: Conde Nast's $8 million email scam, as reported in this Forbes Magazine blog posting from William Barrett and Janet Novack.

What seems to have happened in the Conde Nast case is that a fraudster sent in a change of address / change of banking information request on behalf of a legitimate vendor. But the bank information provided was not the actual vendor; rather it was an account set up by a fraudster with a similar name and address as the real vendor. So properly authorized payments totaling nearly $8 million were misdirected. The fraud was detected when the real vendor called to ask "where's our money?"

A variety of preventive and detective controls began to visualize in my head when I read this story. How are changes to address and/or bank information communicated from your suppliers? How are these changes corroborated?

How might data analysis be used to identify mis-matches between supplier names and addresses? Seems like a good time to ask at your organization, even if an AP audit is not on the current quarter's schedule.

Joe Oringel
Visual Risk IQ
Charlotte, NC USA