Internal Audit Risk Planning
|
|
|
- Camron Caldwell
- 8 years ago
- Views:
Transcription
1 Internal Audit Risk Assessment and Audit Planning May 6, 2011 Eric Miles, Partner, CPA, CIA, CFE Ric Jazaie, CPA, CIA MOSS ADAMS LLP 1
2 Today s Objectives Provide an overview of current internal audit planning and risk assessment practices Review internal audit planning and risk assessment benchmark data Compare current California community college internal audit planning and risk assessment practices Discuss common internal audit planning and risk assessment pitfalls MOSS ADAMS LLP 2
3 Detailed dagenda Background Risk Assessment and Audit Planning Process o Identify Risks Sketch Audit Universe Define Objectives Universe Develop Risk Universe Validate Audit Universe o Measure Risks Determine Factors Weight Risk Factors Score Risk Factors o Prioritize Risks and Select Audits Summary Q&A MOSS ADAMS LLP 3
4 Disclaimer i The material appearing in this presentation is for informational purposes only and is not legal l or accounting advice. Communication of this information is not intended to create, and receipt does not constitute, a legal relationship, including, but not limited to, an accountant client relationship. Although these materials may have been prepared by professionals, they should not be used as a substitute for professional services. If legal, accounting, or other professional advice is required, the services of a professional should be sought. MOSS ADAMS LLP 4
5 Source Material Assessing Risk (2 nd Edition), David McNamee, IIA Research Foundation 2004 Brink s Modern Internal Auditing (7th Edition), John Wiley & Sons, 2009 Sawyer s Internal Auditing (5 th Edition), IIA 2005 MOSS ADAMS LLP 5
6 Risk Assessment and Audit Planning Risk: The possibility of an event occurring that will have an impact on the achievement of objectives. Risk Assessment: the consideration of the probable bl material effects of uncertain events. It is the identification, measurement, and prioritization of risks and auditable areas. Further, it allows the auditor to design more specific and effective audit programs. MOSS ADAMS LLP 6
7 Do you use a formal risk assessment process for internal audit planning? 1. Yes 2. No MOSS ADAMS LLP 7
8 Use of frisk kassessment tin Internal laudit Source: IIA GAIN 2009 Benchmark Study MOSS ADAMS LLP 8
9 How often do you perform an Internal Audit Risk Assessment? 1. Bi annually + 2. Annually 3. Semi annually 4. Quarterly 5. Other/We don t MOSS ADAMS LLP 9
10 Frequency of Internal laudit Risk Assessments Source: IIA GAIN 2009 Benchmark Study MOSS ADAMS LLP 10
11 Why Risk Based Audit Planning? IPPF Performance Standard 2010.A1 The internal audit activity s plan of engagements must be based on a documented risk assessment, undertaken at least annually. The input of the senior management and the board must be considered din this process. More than a requirement o Makes the best use of limited resources o Improves ability to impact organization o Generates buy in from management o Creates value MOSS ADAMS LLP 11
12 What percentage of your audit recommendations are implemented by Management? 1. 75% 100% 2. 50% 75% 3. 25% 50% 4. 0% 25% MOSS ADAMS LLP 12
13 Percent of Recommendations Implemented Source: IIA GAIN 2009 Benchmark Study MOSS ADAMS LLP 13
14 What Makes Risk Based Audit Planning Difficult? Lack of understanding of risk concepts Lack of specialized knowledge (e.g. IT) No time to plan (the continuous do loop) Lack of senior management and Board support (i.e. strict compliance Perceived lack of impact on value perception (i.e. it wouldn t make a difference) Paralysis through h analysis MOSS ADAMS LLP 14
15 Risk Assessment Process Overview Identify Risks Measure Risks Prioritize Risks Select and Develop Audits MOSS ADAMS LLP 15
16 Identify Risks Sketch Audit Universe Develop Risk Universe Define Objectives Universe MOSS ADAMS LLP 16
17 Identify Risks Validate Audit Universe Develop Risk Universe Define Objectives Universe MOSS ADAMS LLP 17
18 Identify Risks Sketch Audit Universe MOSS ADAMS LLP 18
19 Identify Risks Sketch the Audit Universe o Audit Universe The sum of all auditable units. o Auditable Unit Parts of the organization that are exposed to sufficient risks that control, including audit, is appropriate. o The sketch frames risk identification (i.e. who IA talks to, what info is gathered and how risk is identified). o The initial audit universe need not be complete but should be verified and completed through the risk assessment process. Types of units: projects, IT systems, business functions, departments, business processes/sub processes, assets (physical, financial, human,intangible) MOSS ADAMS LLP 19
20 Identify Risks Sketch the Audit Universe (cont.) o Categories of Auditable Units: projects, IT systems, business functions, departments, business processes/subprocesses, assets (physical, financial, human, intangible) o Criteria for selecting Auditable Units: Contribute to the organizations goals. Are sufficiently large as to have a noticeable impact on the organization Are sufficiently important to justify the cost of control Minimize the categories of auditable units when possible. MOSS ADAMS LLP 20
21 Identify Risks Sketch the Audit Universe (cont.) Acme CC District Corp Gov Process College #1 College #2 Department A Department B Process B1 Process B2 Sub Process B2.1 Sub Process B2.2 MOSS ADAMS LLP 21
22 Do you have a formally documented Audit Universe? 1. Yes 2. No MOSS ADAMS LLP 22
23 Formally Documented Audit Universe Source: IIA GAIN 2009 Benchmark Study MOSS ADAMS LLP 23
24 Audit Universe Categorization ti Category Government Audit Staff: 1 to 5 Universe Departments 97% 89% 86% Processes 97% 89% 93% Service Line 58% 40% 55% Organization Units/Locations 81% 61% 78% Programs 75% 33% 51% ERM Risk Portfolio 28% 30% 34% Other 22% 14% 17% Source: IIA GAIN 2009 Benchmark Study MOSS ADAMS LLP 24
25 Identify Risks Sketch Audit Universe Define Objectives Universe MOSS ADAMS LLP 25
26 Identify Risks Define the Objectives Universe o Objectives Universe: I made this one up. Key objectives for each Auditable Unit o Risks only exists in the context of the achievement of an objective if if you don t know the objective you can t identify the risk. o Categories of objectives Reliability and integrity of financial and operational information Effectiveness and efficiency of operations. Safeguarding of assets. Compliance with laws, regulations, and contracts. MOSS ADAMS LLP 26
27 Identify Risks Sketch Audit Universe Develop Risk Universe Define Objectives Universe MOSS ADAMS LLP 27
28 Identify Risks Develop the Risk Universe o Arguably the most important step in the entire process. Everything else follows the identification of risk. If you don t identify it you can t measure, prioritize or manage. o Requirements for successful risk identification: Thorough understanding of operations of Auditable Units A process through which to generate a reasonable list of possible risks. Common methods include a combined use of: Risk framework (see below) Management questionnaires i Management interviews MOSS ADAMS LLP 28
29 Identify Risks Develop the Risk Universe (Cont.) Analogies to similar operations Prior audit results Industry surveys and benchmarking Other research o Use of a Risk Framework Exposure Analysis: Risk from the perspective of the primary assets of the organization, including all four types of assets (physical, financial, human, and intangible). Primarily areas with significant reliance on capital equipment. MOSS ADAMS LLP 29
30 Identify Risks Develop the Risk Universe (Cont.) Environmental lanalysis: Risk kfrom the perspective of changes to the external environments and their effects on management processes and controls. Environmental analysis works best in service oriented processes and those that are highly regulated or competitive, although nearly every auditable unit is affected by environmental risk to some extent. Areas of environmental risk include: Physical environment: Site, location, weather, terrain, access. Economic environment: Finances, interest rates, general economy. Government regulation: Laws, policies and regulations, real or impending. MOSS ADAMS LLP 30
31 Identify Risks Develop the Risk Universe (Cont.) Physical environment: Site, location, weather, terrain, access. Competition: Direct competitors, substitutions, indirect competitors. Constituents/Customers. Suppliers (including unions). Technology. Threat Scenarios/Brainstorming (see Handout): Special narrative speculation about how the system of internal control could possibly be defeated by fraud or natural disaster. Typically a risk framework is used to prompt risk thinking. MOSS ADAMS LLP 31
32 Identify Risks Sketch Audit Universe Develop Risk Universe Define Objectives Universe MOSS ADAMS LLP 32
33 Identify Risks Validate Audit Universe Develop Risk Universe Define Objectives Universe MOSS ADAMS LLP 33
34 Identify Risks Reassess the Audit Universe o Additional information is often gathered in risk identification process o Validate the initial audit universe through review of: Chart of Accounts Organization Chart Tl Telephone Directory Strategic Plan(s) Information Systems Inventory Audit Requests External Benchmarking MOSS ADAMS LLP 34
35 Risk Assessment Process Overview Identify Risks Measure Risks Prioritize Risks Select and Develop Audits MOSS ADAMS LLP 35
36 Measure Risks BEWARE!!! Risk measurement can be a fool s errand due to Physics Envy and False Precision i Measuring risk is not a precise science and is difficult because of its intangible nature. Focus on the overall objective; identification of high impact audits and audit program design. Often quick qualitative measurement (High, Medium, Low) is most effective. MOSS ADAMS LLP 36
37 Measure Risks Determine Risk Factors Weight Risk Factors Score Risk Factors MOSS ADAMS LLP 37
38 Measure Risks Determine Risk Factors o Risk is difficult to measure directly except by probability estimates, and even these are highly suspect without a lot of data on the consequences of each risk. o Risk factors are observable and/or measurable characteristics of risks that can combine the analysis of risks, consequences, and controls all at once into conceptual attributes to allow risk to be more easily measured. MOSS ADAMS LLP 38
39 Measure Risks Determine Risk Factors (Cont.) o There are three types of risk factors commonly in use: Subjective risk factors Due to the rapid changes in the complexity of both technology and organizations in recent decades, historical data has become less significant. Many auditable units change so much between audits that prior audit history is of little use. Sound subjective judgment by an experienced practitioner is just as valid as any other method. Example: Subjective Risk Factors: Integrity of management and Extent of rapid changes in processes. MOSS ADAMS LLP 39
40 Measure Risks Determine Risk Factors (Cont.) Objective or hit historical i risk ikfactors For stable operations, measuring the trends in historical risk factors can be useful. In all cases, current objective data are very helpful in measuring risk. Example: Objective and Historical Risk Factors: Dollars at risk (Objective) and Employee turnover rates (Historical). Calculated risk factors A subset of objective risk factor data is the class of factors calculated from historical or objective data. These are often the weakest of all factors to use because they are derivative factors of risk further upstream. Example: Calculated Risk Factors: Distance from main office and Time since last audit. MOSS ADAMS LLP 40
41 Measure Risks Determine Risk Factors (Cont.) These are often the weakest of all factors to use because they are derivative factors of risk further upstream. Example: Calculated Risk Factors: Distance from main office and Time since last audit. Caveat: Time since last audit is a very useful risk factor and we suggest that all risk assessment models include. o Selecting Risk Factors The IIA Practice Advisory outlines the need and appropriateness p of using risk factors, in particular, a consideration of probability and impact of a risk. MOSS ADAMS LLP 41
42 How many risk factors do you use? MOSS ADAMS LLP 42
43 Number of Risk kfactors Utilized Source: IIA GAIN 2009 Benchmark Study MOSS ADAMS LLP 43
44 Factors Influencing Risk kassessment Factor Government Audit Staff: 1 to 5 Universe Degree of FinancialMateriality 100% 84% 92% Complexity of Activities 94% 79% 87% Control Environment 94% 79% 89% Reputational Sensitivity 92% 53% 69% Inherent Risk 92% 72% 84% Extent of Change 89% 84% 89% Confidence in Mgmt 83% 61% 68% Fraud Potential 81% 65% 81% Time Since Last Audit 78% 67% 80% Volume of Transactions 78% 65% 70% Degree of Automation 72% 60% 72% Source: IIA GAIN 2009 Benchmark Study MOSS ADAMS LLP 44
45 Factors Influencing Risk kassessment Factor Government Audit Staff: 1 to 5 Universe Employee Turnover 69% 56% 60% Environmental Factors 64% 42% 48% Other 22% 11% 17% Competitive Pressures 17% 32% 36% Source: IIA GAIN 2009 Benchmark Study MOSS ADAMS LLP 45
46 Measure Risks o Determine Risk Factors (Cont.) Choose a number of factors to represent important t aspects of the auditable unit(s) risks. These factors should be determinant. That is, the measurements on these factors should vary within each auditable unit from conditions of low risk to high risk. Limit risk factors to no more than 10. Using 5, plus or minus 2, should ldbe your goal. The more factors, the more likely l you are duplicating the influence of a particular risk, and the less influence any particular factor has on determining ultimate risk. See Handout for list of common risk factors. MOSS ADAMS LLP 46
47 Measure Risks Determine Risk Factors Weight Risk Factors Score Risk Factors MOSS ADAMS LLP 47
48 Measure Risks o Weight Risk Factors Reminder: This is a subjective process budget efforts in this area accordingly. Develop weights for each of the risk factors chosen based on the consequences that t each factor has on the organization. It is good practice to normalize the weights; that is, to make sure that the sum of all weights adds up to 1.00 or 100%. Normally, a Direct Assignment method is used. Using judgment to determine the weight a particular factor should have in relation to other factors. Direct assignment can be done by the auditor or by a group using a consensus tool such as the Delphi Technique. MOSS ADAMS LLP 48
49 Measure Risks Determine Risk Factors Weight Risk Factors Score Risk Factors MOSS ADAMS LLP 49
50 Measure Risks o Score Risk Factors Choose a Scoring Scale Choose a scale, such as 1 to 5, to represent the strength of the factors in the auditable unit (lowto high). Document the criteria for rating for each risk factor Afi five point i scale is recommended, d although ha three point scale (low medium high, or weak average strong) or even a 10 point scale can be used. Evaluate each of the risks for the presence/absence or the relative strength/weakness of that risk factor and assign a score based on the scale selected. Calculate the overall risk score by summing the product of each factor weight by its corresponding risk score. The sum of the risk scores for each identified risk is called the total risk MOSS ADAMS LLP 50
51 Risk Assessment Process Overview Identify Risks Measure Risks Prioritize Risks Select and Develop Audits MOSS ADAMS LLP 51
52 Pi Prioritize iti Rik Risks and ddevelop Audit ditplan o Prioritize Risks and Develop Audit Plan (Cont.) There are three primary methods to select audits from the audit universe to include in the annual audit plan: Cycle Approach. Risk Based Approach Cycle Based Risk Approach The recommended Risk Based Approach by mapping risks that relate to the same or similar Auditable Unit and could reasonable fit within the same audit program. For example, the audit on the next slide has a audit score of 153. MOSS ADAMS LLP 52
53 Pi Prioritize iti Rik Risks and ddevelop Audit ditplan o Prioritize Risks and Develop Audit Plan (Cont.) Auditable Unit Entity A Cash Disbursements Risk Inadequate segregation of duties between Vendor Invoice Entry and Cash Disbursements run Risk Score 56 Audit Entity A AP Cycle Entity A Cash Accounts Payable check stock is not Entity A 35 Disbursements adequately secured. AP Cycle Entity A Accounts Payable An approved PO or vendor invoice is not required before processing disbursements. 62 Entity A AP Cycle MOSS ADAMS LLP 53
54 Pi Prioritize iti Rik Risks and ddevelop Audit ditplan o Prioritize Risks and Develop Audit Plan (Cont.) Once all risks have been mapped to relevant audits, the audits are then ranked from highest to lowest based on audit score. The annual audit plan is chosen based on the percentage of total risk that is to be covered. Typically a value between 50% to 75% is chosen. The audits from the top of the list representing this point total are chosen. The balance of the auditable units is not included in the annual plan. In the next example, the total risk is 628 and audits Nos. 1 and 2 (potentially 3) would be selected. The other audits may be scheduled for future years or left off completely. MOSS ADAMS LLP 54
55 Pi Prioritize iti Rik Risks and ddevelop Audit ditplan o Prioritize Risks and Develop Audit Plan (Cont.) Audit Audit Score Audit Audit 2 Entity A Cash 153 Disbursements Audit Audit 4 75 Audit 5 50 Audit 6 25 MOSS ADAMS LLP 55
56 Key Points A risk based audit planning approach is the key to adding value through h internal audit. A risk based audit planning process doesn t have to arduous. Great is the enemy of good. Risk Identification is (by far) the most important (and difficult) step in the process. Over reliance on an established Audit Universe can lead to a lack of risk focus Risk Weighting and Scoring have rapidly diminishing returns. Beware Physics Envy. MOSS ADAMS LLP 56
57 Questions? Thank You! The material appearing in this presentation is for informational purposes only and is not legal or accounting advice. Communication of this information is not intended to create, and receipt does not constitute, a legal relationship, including, but not limited to, an accountant client relationship. Although these materials may have been prepared by professionals, they should not be used as a substitute for professional services. If legal, accounting, or other professional advice is required, the services of a professional should be sought. MOSS ADAMS LLP 57
Comprehensive Risk Assessment and Developing the Audit Plan
Comprehensive Risk Assessment and Developing the Audit Plan Laure Boyd, CIA, CGAP Internal Audit Manager Leon County Clerk of the Circuit Court and Comptroller Our Time Today Background Risk Assessment
Financial Services Group
Fraud Detection and Prevention Presented by: Carrie Kennedy, CPA, Partner Anthony Porter, CPA, Manager 1 The material appearing in this presentation is for informational purposes only and should not be
ACCOUNTS PAYABLE AUDIT RECOVERING LOST DOLLARS AT NO COST
ACCOUNTS PAYABLE AUDIT RECOVERING LOST DOLLARS AT NO COST 1 Our Objective To assist organizations in finding lost thousands of dollars in profits through duplicate payments, duplicate billings, overpayments,
Enterprise Risk Management
Cayman Islands Society of Professional Accountants Enterprise Risk Management March 19, 2015 Dr. Sandra B. Richtermeyer, CPA, CMA What is Risk Management? Risk management is a process, effected by an entity's
How To Prevent Fraud On A Credit Card
Fraud Detection and Prevention Financial Management Advisory Council August 28, 2014 Sarah Mahugh, CPA, MBA Financial Audit Audit Manager Overview Fraud trends Fraud Risks and internal controls Case Studies
How to set up a people based. accounting system that makes your. small business work for you. Thomas G. Post. Certified Public Accountant 281-351-2688
How to set up a people based accounting system that makes your small business work for you. By Thomas G. Post Certified Public Accountant 281-351-2688 www.texastaxman.com 1 Title How to set up a people
Internal Audit Practice Guide
Internal Audit Practice Guide Continuous Auditing Office of the Comptroller General, Internal Audit Sector May 2010 Table of Contents Purpose...1 Background...1 Definitions...2 Continuous Auditing Professional
T&E Expense Reporting: Tips, Techniques & Strategies to Minimize Reimbursement Fraud
T&E Expense Reporting: Tips, Techniques & Strategies to Minimize Reimbursement Fraud FEATURED FACULTY: Richard B. Lanza, CPA, CFE, CGMA, President of Cash Recovery Partners LLC 973-729-3944 rich@richlanza.com
5 Important Controls to Mitigate Employee Fraud
5 Important Controls to Mitigate Employee Fraud LMCIT WEBINAR : FEBRUARY 10, 2015 IN PARTNERSHIP WITH EIDE BAILLY Presenter: Jason Olson, MBA, CPA/CFF, CFE, CFI Presentation Disclaimer These seminar materials
Risk Management and Internal Audit Specialized Training Course Audit Risk Assessment Methodology
Risk Management and Internal Audit Specialized Training Course Audit Risk Assessment Methodology May 20, 2015 Internal FR 2 Risk and Risk Assessment Defined Risk Institute of Internal Auditors (IIA) The
INTERNAL CONTROL POLICIES
INTERNAL CONTROL POLICIES 2701 Internal Control Policy 2701.1 Addendum Internal Control Standard #1 Payments Cycle 2701.2 Addendum Internal Control Standard #2 Conversion Cycle 2701.3 Addendum Internal
Types of Fraud and Recent Cases. Developing an Effective Anti-fraud Program from the Top Down
Types of and Recent Cases Developing an Effective Anti-fraud Program from the Top Down 1 Types of and Recent Cases Chris Grippa (404-817-5945) FIDS Senior Manager with Ernst & Young LLP Works with clients
THE ABC S OF DATA ANALYTICS
THE ABC S OF DATA ANALYTICS ANGEL BUTLER MAY 23, 2013 HOUSTON AREA SCHOOL DISTRICT INTERNAL AUDITORS (HASDIA) AGENDA Data Analytics Overview Data Analytics Examples Compliance Purchasing and Accounts Payable
DATA ANALYSIS: THE CORNERSTONE OF EFFECTIVE INTERNAL AUDITING. A CaseWare IDEA Research Report
DATA ANALYSIS: THE CORNERSTONE OF EFFECTIVE INTERNAL AUDITING A CaseWare IDEA Research Report CaseWare IDEA Inc. is a privately held software development and marketing company, with offices in Toronto
Pursuing Compliance with the FFIEC Guidance Risk Assessment 101 KPMG RISK ADVISORY SERVICES
Pursuing Compliance with the FFIEC Guidance Risk Assessment 101 KPMG RISK ADVISORY SERVICES Contents PART I An Increasing Threat: Identity Theft The FFIEC Response Risk Assessment Fundamentals The FFIEC
OFFICE OF AUDITS & ADVISORY SERVICES ACCOUNTS PAYABLE VENDOR MASTER FILE AUDIT FINAL REPORT
County of San Diego Auditor and Controller OFFICE OF AUDITS & ADVISORY SERVICES ACCOUNTS PAYABLE VENDOR MASTER FILE AUDIT FINAL REPORT Chief of Audits: Juan R. Perez Senior Audit Manager: Lynne Prizzia,
Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
Performing Audit Procedures in Response to Assessed Risks 1781 AU Section 318 Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (Supersedes SAS No. 55.)
10-1. Auditing Business Process. Objectives Understand the Auditing of the Enteties Business. Process
10-1 Auditing Business Process Auditing Business Process Objectives Understand the Auditing of the Enteties Business Process Identify the types of transactions in different Business Process Asses Control
AGA Kansas City Chapter Data Analytics & Continuous Monitoring
AGA Kansas City Chapter Data Analytics & Continuous Monitoring Agenda Market Overview & Drivers for Change Key challenges that organizations face Data Analytics What is data analytics and how can it help
ACCOUNTS PAYABLE VENDOR PAYMENT. Audit Report No. AP0110. November 06, 2009
ACCOUNTS PAYABLE VENDOR PAYMENT Audit Report No. AP0110 November 06, 2009 MENTAL HEALTH MENTAL RETARDATION AUTHORITY OF HARRIS COUNTY Report AUDITOR S REPORT Harris County, Texas Report November 06, 2009
CITY OF SAN ANTONIO OFFICE OF THE CITY AUDITOR. Audit of the Finance Department. Payroll. Project No. AU13-024. June 9, 2014
CITY OF SAN ANTONIO OFFICE OF THE CITY AUDITOR Audit of the Finance Department Project No. AU13-024 June 9, 2014 Kevin W. Barthold, CPA, CIA, CISA City Auditor Executive Summary As part of our annual Audit
Accounts Payable Best Practices
Accounts Payable Best Practices Presented by: Eddy Castaneda, CPA, MBA Accounts Payable Best Practices Top Practices AP Top Practices Document your current AP procedures Can identify overlapping work Can
Data Analysis Process Is A Multi Risk Process. EuroCACS 2013 Session 211
Data Analysis Process Is A Multi Risk Process EuroCACS 2013 Session 211 www.sr-cpa.info 17 September 2013 Content (1) Your lecturer Business processes in the modern world Data Analysis: Definition Why
Table of Contents. Transmittal Letter... 1. Executive Summary... 2-3. Background... 4-5. Objectives and Approach... 6. Issues Matrix...
Internal Audit Committee of Brevard County, Florida Internal Audit Review of Accounts Payable Prepared By: Internal Auditors of Brevard County September 22, 2010 Table of Contents Transmittal Letter...
San Francisco International Airport Enterprise Risk Management
San Francisco International Airport Enterprise Risk Management Mike Warren Airport Risk Manager WHAT IS ENTERPRISE RISK MANAGEMENT (ERM) It is a comprehensive program that focuses on a continuous and sustainable
U S I N G D A T A A N A L Y S I S T O M E E T T H E R E Q U I R E M E N T S O F R I S K B A S E D A U D I T I N G S T A N D A R D S
U S I N G D A T A A N A L Y S I S T O M E E T T H E R E Q U I R E M E N T S O F R I S K B A S E D A U D I T I N G S T A N D A R D S A C a s e W a r e I D E A R e s e a r c h R e p o r t CaseWare IDEA Inc.
Internal audit value optimization for insurance organizations
Internal audit value optimization for insurance organizations Webinar May 13, 2015 Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International.
Tips to Prevent and Detect Workplace Fraud
40 Tips to Prevent and Detect Workplace Fraud an E-book developed for you by: Table of Contents preventive controls detective controls 1. culture of ethics 2. free of moral hazards 3. risk management policy
CPM -100: Principles of Project Management
CPM -100: Principles of Project Management Lesson E: Risk and Procurement Management Presented by Sam Lane samlane@aol.com Ph: 703-883-7149 Presented at the IPM 2002 Fall Conference Prepared by the Washington,
Sweetwater Union High School District. Proposition O Bond Fund Performance Audit Report For the Fiscal Year Ended June 30, 2014.
Proposition O Bond Fund Performance Audit Report For the Fiscal Year Ended June 30, 2014 Prepared by: MOSS ADAMS LLP 9665 Granite Ridge Drive, Suite 600 Santa Diego, CA 92123 March 31, 2015 Board of Trustees
IT Audit- Hospital Risks, Controls and Audit. AHIA Conference. Grant Thornton LLP. All rights reserved.
IT Audit- Hospital Risks, Controls and Audit Approaches AHIA Conference Grant Thornton LLP. All rights reserved. Agenda risk and organizational exposure understanding gyour information technology environment
Advanced Data Analytics, the Fraudsters Worst Enemy
Advanced Data Analytics, the Fraudsters Worst Enemy Introducing Powerful Tools and Techniques to Uncover Fraud Agenda Overview of data analytics in the anti-fraud and fraud investigation context Capability
Accounts Payable. Reference Guide
Accounts Payable Reference Guide Last Updated: January 19, 2009 About this Guide This Guide is for use by SedonaOffice customers only. This guide is not meant to serve as an operating or training manual,
Subsequent Injury Fund
Subsequent Injury Fund Report dated April 9, 2009 Presentation to the Joint Audit Committee Timothy R. Brooks, CPA, CFE Alexandra E. Zouras, CPA July 14, 2009 Audit Overview Audit report, which covered
Risk Management in Role-based Applications Segregation of Duties in Oracle
Risk Management in Role-based Applications Segregation of Duties in Oracle Sundar Venkat, Senior Manager, Protiviti Tai Tam, Accounting Manager, Electronic Arts Core Competencies C23 Page 0 of 29 Agenda
BUSINESS CREDIT AND COLLECTION RISK ANALYSIS
AVANTGARD BUSINESS CREDIT AND COLLECTION RISK ANALYSIS What is the best information and/or risk analysis methodology to use for your credit and collection evaluation needs? Table of contents 1 Introduction
How To Audit A Financial Statement
INTERNATIONAL STANDARD ON 400 RISK ASSESSMENTS AND INTERNAL CONTROL (This Standard is effective, but will be withdrawn when ISA 315 and 330 become effective) * CONTENTS Paragraph Introduction... 1-10 Inherent
13 01 Colorado Springs Utilities Debt Management Audit
O FFICE O F T HE C ITY A UDITOR C OLORADO S PRINGS, C OLORADO 13 01 Colorado Springs Utilities Debt Management Audit February 2013 O FFICE O F T HE C ITY A UDITOR C OLORADO S PRINGS, C OLORADO 13 01 Colorado
Risk assessment. made simple
Risk assessment made simple July 2015 1 Sayer Vincent LLP Chartered accountants and statutory auditors Invicta House 108 114 Golden Lane London EC1Y 0TL Offices in London, Bristol and Birmingham 020 7841
LOCAL GOVERNMENT MANAGEMENT ASSESSMENT OVERVIEW AND QUESTIONNAIRE
LOCAL GOVERNMENT MANAGEMENT ASSESSMENT OVERVIEW AND QUESTIONNAIRE The Comptroller s Economic Development and Analysis (EDA) Division provides education and direct assistance to local governments, helping
Internal Controls, Fraud Detection and ERP
Internal Controls, Fraud Detection and ERP Recently the SEC adopted Section 404 of the Sarbanes Oxley Act. This law requires each annual report of a company to contain 1. A statement of management's responsibility
www.pwc.com/modelrisk New supervisory guidance on model Overview, analysis, and next steps
www.pwc.com/modelrisk New supervisory guidance on model risk management: Overview, analysis, and next steps Features of new guidance Issued as supervisory guidance (21 pages) not as a risk bulletin. This
OCC 98-3 OCC BULLETIN
To: Chief Executive Officers and Chief Information Officers of all National Banks, General Managers of Federal Branches and Agencies, Deputy Comptrollers, Department and Division Heads, and Examining Personnel
B Resource Guide: Implementing Financial Controls
What s in this Guide: I. Definition: What are Financial Controls? II. Why Do You Need Financial Controls? III. Best Practices: Financial Controls to Consider I. Definition: What are Financial Controls?
Streamlining the Annual Risk Assessment Process
Streamlining the Annual Risk Assessment Process Presenter: Gregory Jordan, CPA, CIA, CRMA, FLMI Senior Vice President, Chief Audit Executive Nationwide Insurance Gregory Jordan, CPA, CIA, CRMA, FLMI Chief
LOSS CONTROL SUPPLEMENTAL APPLICATION FOR INSURANCE COMPANIES
Name of Insurance Company to which application is made LOSS CONTROL SUPPLEMENTAL APPLICATION FOR INSURANCE COMPANIES NAME OF INSURED: ADDRESS: DATE: A. EMPLOYMENT PRACTICES 1. Do you require that each
CRISC Glossary. Scope Note: Risk: Can also refer to the verification of the correctness of a piece of data
CRISC Glossary Term Access control Access rights Application controls Asset Authentication The processes, rules and deployment mechanisms that control access to information systems, resources and physical
Final. Internal Audit Report. Creditors System
Final Internal Audit Report Creditors System Document Details: Reference: 1.2 / 2014-15 Senior Manager, Internal Audit & Assurance: David Jenkins ext 6567 Date: 7 th January 2015 This report is not for
High Value Audits: An Update on Information Technology Auditing. Robert B. Hirth Jr., Managing Director
High Value Audits: An Update on Information Technology Auditing Robert B. Hirth Jr., Managing Director The technology landscape and its impact on internal audit Technology is playing an ever-growing role
University of Windsor Board of Governors. That the Board of Governors approve of the Enterprise Risk Management Framework.
University of Windsor Board of Governors BG130430-4.2.3 4.2.3 Enterprise Risk Management Framework Item for: Approval Forwarded by: Audit Committee MOTION: That the Board of Governors approve of the Enterprise
BUSINESS PLAN TEMPLATE
BUSINESS PLAN TEMPLATE Business Name: (Please provide details of owners / members involved) Name of owner(s): Address: Identity Number: Tel: ( ) Cell: 1 1. INTRODUCTION OF YOUR BUSINESS IDEA 1.1. Give
10426: Large Scale Project Accounting Data Migration in E-Business Suite
10426: Large Scale Project Accounting Data Migration in E-Business Suite Objective of this Paper Large engineering, procurement and construction firms leveraging Oracle Project Accounting cannot withstand
Aberdeen City Council IT Asset Management
Aberdeen City Council IT Asset Management Internal Audit Report 2014/2015 for Aberdeen City Council January 2015 Terms or reference agreed 4 weeks prior to fieldwork Target Dates per agreed Actual Dates
Maximising internal audit value
www.pwc.ru/internalaudit Maximising internal audit value 2013 State of the internal audit profession survey Russia supplement April 2013 Introduction For 9 years PwC has conducted a global survey of the
www.pwc.com Third Party Risk Management 12 April 2012
www.pwc.com Third Party Risk Management 12 April 2012 Agenda 1. Introductions 2. Drivers of Increased Focus on Third Parties 3. Governance 4. Third Party Risks and Scope 5. Third Party Risk Profiling 6.
PROJECT RISK MANAGEMENT
PROJECT RISK MANAGEMENT DEFINITION OF A RISK OR RISK EVENT: A discrete occurrence that may affect the project for good or bad. DEFINITION OF A PROBLEM OR UNCERTAINTY: An uncommon state of nature, characterized
Model Risk, A company perspective Peter K. Reilly, FSA Valuation Actuary & Head of Actuarial Strategic Initiatives Aetna, Inc
Model Risk, A company perspective Peter K. Reilly, FSA Valuation Actuary & Head of Actuarial Strategic Initiatives Aetna, Inc 1 Agenda Thoughts/Observations on Model Risk Practical Considerations Aetna
SCOPE OF WORK FOR PERFORMING INTERNAL CONTROL AND STATUTORY/REGULATORY COMPLIANCE AUDITS FOR RECIPIENTS OF SPECIAL MUNICIPAL AID
SCOPE OF WORK FOR PERFORMING INTERNAL CONTROL AND STATUTORY/REGULATORY COMPLIANCE AUDITS FOR RECIPIENTS OF SPECIAL MUNICIPAL AID State of New Jersey Department of Community Affairs Division of Local Government
Internet Banking Authentication Guidance is Out
Brace Yourself: Updated d FFIEC Internet Banking Authentication Guidance is Out October 13, 2011 Paul Rainbow, Manager David Dyk, Manager 1 The material appearing in this presentation is for informational
Are you looking at procurement as an end-to-end process?
Are you looking at procurement as an end-to-end process? Need for Source to pay transformation Digitization / Automation is the need of the hour. Many companies in pursuit of improving their purchasing
Performance Audit City s Payment Process
Performance Audit City s Payment Process January 2013 City Auditor s Office City of Kansas City, Missouri 18-2011 Office of the City Auditor 21 st Floor, City Hall 414 East 12 th Street (816) 513-3300
Report to the Audit Committee
Report to the Audit Committee Agenda of: JANUARY 14, 2014 From: Rahoof Wally Oyewole, Departmental Audit Manager ITEM: V SUBJECT: INTERNAL AUDIT WORKPLAN THROUGH FISCAL YEAR 2014-15 AND POSSIBLE COMMITTEE
Internal Controls. A short presentation from Your Internal Audit Department
Internal Controls A short presentation from Your Internal Audit Department The Old Internal Audit Department The New Internal Audit Department We re here to help! Teach + Train = Change Our goal: Promote
Fraud Prevention and Detection in a Manufacturing Environment
Fraud Prevention and Detection in a Manufacturing Environment Introduction The Association of Certified Fraud Examiners (ACFE) estimated in its 2008 Report to the Nation on Occupational Fraud and Abuse
Credit Unions RISK ADVISORY SERVICES. Enterprise Risk Management, Internal Audit and Complex Accounting Services
Credit Unions RISK ADVISORY SERVICES Enterprise Risk Management, Internal Audit and Complex Accounting Services Credit unions care about personal service. So do we. How BDO works with credit unions Credit
Joint Audit Report for South Lakeland District Council. & Eden District Council
Joint Audit Report for South Lakeland District Council & Eden District Council Audit of IT Data Backup and Recovery Arrangements Audit of Development Management 22nd May 2015 11 th June 2015 0 Page 0 Audit
City of Berkeley. Accounts Payable Audit
City of Berkeley Accounts Payable Audit Prepared by: Ann-Marie Hogan, City Auditor, CIA, CGAP Teresa Berkeley-Simmons, Audit Manager, CIA, CGAP Frank Marietti, Senior Auditor, CIA, CGAP Presented to Council
Internal Audit Testing and Sampling Techniques. Chartered Institute of Internal Auditors May 2014
Internal Audit Testing and Sampling Techniques Chartered Institute of Internal Auditors May 2014 Controls Testing Slide 1 Testing Priorities Risk B1 Risk A1 Risk B2 Risk A2 Risk C2 Risk C1 Controls testing
Presentation Objectives Why is Internal Audit here? Concepts (Enterprise Risk Management, Strategic Risk, Strategic Risk Management, etc.
Internal Audit 1 January 13, 2012 Presentation Objectives Why is Internal Audit here? Concepts (Enterprise Risk Management, Strategic Risk, Strategic Risk Management, etc.) Summary Internal Audit 2 January
Aberdeen City Council. Fleet Management Final Report
Aberdeen City Council Fleet Management Final Report Internal Audit Report 2013/2014 for Aberdeen City Council February 2014 Internal Audit KPI Targets Target Dates Actual Dates Red/Amber/ Green Commentary
Data Analysis: The Cornerstone of Effective Internal Auditing. A CaseWare Analytics Research Report
Data Analysis: The Cornerstone of Effective Internal Auditing A CaseWare Analytics Research Report Contents Why Data Analysis Step 1: Foundation - Fix Any Cracks First Step 2: Risk - Where to Look Step
CORPORATE AUDITOR SERIES
CORPORATE AUDITOR SERIES INCLUSIONS This is a four level series that applies to positions that provide professional audit services from within Internal Audit and Consulting Services or the Office of the
I. Annual Update of Questar III BOCES Financial Risk Assessment (May 16, 2014):
Minutes: NCSD Board Audit Committee Meeting Dec. 12, 2014 8:00 a.m. 9:40 a.m. District Board Room Meeting called by Type of meeting Patricia Lanotte called the meeting to order at 8:00 a.m. Niskayuna Central
Auditing for Value in the Procure to Pay Cycle Dallas IIA Chapter. October 1, 2009
Auditing for Value in the Procure to Pay Cycle Dallas IIA Chapter October 1, 2009 Supply Chain Risk Overview * Today s Focus * Includes Working Capital benefits 1 2009 Protiviti Inc. An Equal Opportunity
Or download and view an electronic copy by visiting: www.sarasotagov.com
You can obtain copies of this report by contacting us at: Office of the City Auditor and Clerk 1565 1 st Street Sarasota, FL 34236 (941) 954-4135 Or download and view an electronic copy by visiting: www.sarasotagov.com
COSO 2013 Internal Control Integrated Framework FRED J. PETERSON, PARTNER MOSS ADAMS LLP
COSO 2013 Internal Control Integrated Framework FRED J. PETERSON, PARTNER MOSS ADAMS LLP Disclaimer The material appearing in this presentation is for informational purposes only and should not be construed
ACCOUNTS PAYABLE VOUCHER ADJUSTMENT
ACCOUNTS PAYABLE VOUCHER ADJUSTMENT TRANSACTION ENTRY OVERVIEW Use Vision Transaction Center to enter and maintain data on various types of transactions, such as disbursements, expenses, invoices, and
Financial Projections. Making sense of the money
Financial Projections Making sense of the money The Burning Questions What are your capital needs? Projections How will you get that capital? Structure: Equity or debt? Ownership structure Up-front or
Office of the Auditor General Performance Audit Report. Statewide UNIX Security Controls Department of Technology, Management, and Budget
Office of the Auditor General Performance Audit Report Statewide UNIX Security Controls Department of Technology, Management, and Budget December 2015 State of Michigan Auditor General Doug A. Ringler,
Stated below are the SCIRE activity level control objectives for purchasing and accounts payable.
SCIRE PURCHASING AND ACCOUNTS PAYABLE AND SUMMARY The goals of the purchasing function at SCIRE are to achieve open, competitive and costeffective buying, while adhering to external funding sources for
Internal Control Systems
D. INTERNAL CONTROL 1. Internal Control Systems 2. The Use of Internal Control Systems by Auditors 3. Transaction Cycles 4. Tests of Control 5. The Evaluation of Internal Control Component 6. Communication
Internal Controls over Cash for Small Nonprofits
Internal Controls over Cash for Small Nonprofits Internal controls may be a sensitive issue in small nonprofit organizations. These organizations are built on the concepts of honesty, truthfulness, and
Is Your Company Ready for a Big Data Breach? Sponsored by Experian Data Breach Resolution
Is Your Company Ready for a Big Data Breach? Sponsored by Experian Data Breach Resolution Independently conducted by Ponemon Institute LLC Publication Date: March 2013 Ponemon Institute Research Report
Community Ambulance Service District
STATUTORY AUDIT Community Ambulance Service District For the year ended June 30, 2014 Oklahoma State Auditor & Inspector Gary A. Jones, CPA, CFE This publication, issued by the Oklahoma State Auditor and
EFFECTIVE WORK PROCESSES: Internal Controls and Risk Assessment. Presented by the Office for Audit and Advisory Services
EFFECTIVE WORK PROCESSES: Internal Controls and Risk Assessment Presented by the Office for Audit and Advisory Services What if someone told you There was a way to make your work processes more effective?
IT Risk Closing the Gap
IT Risk Closing the Gap Giving the Board what it needs to understand, manage and challenge IT risk PWC Contents Foreword 1 Executive summary 3 Survey findings Does the Board fully understand the impact
MAC McCallick Accounting & Consulting 650 North Rose Drive #175 Placentia, Ca 92870 www.mac-cpa.biz 714-349-2502 www.nonprofit-connect.
MAC McCallick Accounting & Consulting 650 North Rose Drive #175 Placentia, Ca 92870 www.mac-cpa.biz 714-349-2502 www.nonprofit-connect.com July 14, 2010 Phil Anthropy Sample Non-Profit 1100 Charity Way
TABLE OF CONTENTS BACKGROUND AND INTRODUCTION... 5 PURPOSE... 5 SCOPE... 6 RISK ASSESSMENT PROCESS... 6
TABLE OF CONTENTS BACKGROUND AND INTRODUCTION... 5 PURPOSE... 5 SCOPE... 6 RISK ASSESSMENT PROCESS... 6 RISK ASSESSMENT AND EVALUATION METHODOLOGY... 6 RESULTS... 8 RISK ASSESSMENT GAPS... 9 RISK ASSESSMENT
Auditing Standard 5- Effective and Efficient SOX Compliance
Auditing Standard 5- Effective and Efficient SOX Compliance September 6, 2007 Presented to: The Dallas Chapter of the Institute of Internal Auditors These slides are incomplete without the benefit of the
Audit Sampling. AU Section 350 AU 350.05
Audit Sampling 2067 AU Section 350 Audit Sampling (Supersedes SAS No. 1, sections 320A and 320B.) Source: SAS No. 39; SAS No. 43; SAS No. 45; SAS No. 111. See section 9350 for interpretations of this section.
Frequently Asked Questions (Including Definitions)
My Business Income Consultation from Chubb Frequently Asked Questions (Including Definitions) Frequently Asked Questions How To Use The Tool Click on the question that you would like to have answered.
FINDING THE RISK IN RISK ASSESSMENTS NYSICA JULY 26, 2012. Presented by: Ken Shulman Internal Audit Director, New York State Insurance Fund
FINDING THE RISK IN RISK ASSESSMENTS NYSICA JULY 26, 2012 Presented by: Ken Shulman Internal Audit Director, New York State Insurance Fund There are different risk assessments prepared: Annual risk assessment
Construction Fraud: Stories from the Field
Construction Fraud: Stories from the Field Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. 2010 Baker Tilly Virchow Krause,
RISK AdvISoRy SeRvIceS MINING CREDENTIALS
RISK Advisory Services MINING CREDENTIALS 2 Mining credentials BDO THERE IS AN INCREASING NUMBER OF MINING COMPANIES EXPLORING INVESTMENTS IN LOCAL AND EMERGING MARKETS TODAY, ATTRACTED BY QUALITY UNMINED
RISK MANAGEMENT MATRIX FOR ACADEMIES. Contents. Introduction. Mission/objectives. Law and regulation. Governance and management.
RISK MANAGEMENT MATRIX FOR ACADEMIES Contents A B C D E F G H K J Introduction Mission/objectives Law and regulation Governance and management External factors Operational factors Human resources Environmental
Exams, Audit, SOX/MAR, ERM, ORSA,...what s next???
Exams, Audit, SOX/MAR, ERM, ORSA,...what s next??? James Menck, Senior Manager, CPA, CIA, CFE, CFE (Fraud) Jmenck@eidebailly.com 214.680.6889 Progression of Oversight How did we get here??? Increased overlap
S24 - Governance, Risk, and Compliance (GRC) Automation Siamak Razmazma
S24 - Governance, Risk, and Compliance (GRC) Automation Siamak Razmazma Governance, Risk, Compliance (GRC) Automation Siamak Razmazma Siamak.razmazma@protiviti.com September 2009 Agenda Introduction to
How To Get A Contract From The Taxman
Procuring Professional Services Buying Support www.buyingsupport.co.uk Procuring Professional Services What are they? Why are they needed? The 7 Steps to Best Value 2 What are Professional Services? Management
Developing an Effective Enterprise Risk Management Program
Developing an Effective Enterprise Risk Management Program Jay Brietz, CPA and CIA Senior Manager This material was used by Elliott Davis Decosimo during an oral presentation; it is not a complete record
How To Prevent Fraud In The United States
Fraud Detection & Prevention for Accounts Payable! Presented by Larry Holmes! Accounts Payable With Fraud! Paying for goods and services that were not received! Paying inflated prices for goods and services!