EUROPEAN COURT OF AUDITORS

Transcription

1 EUROPEAN COURT OF AUDITORS EUROSAI conference Application of software tools in Audit Audit Support, Quality and Development Assyst II project : a new audit system for the ECA Christophe Grosnickel, project manager 18/09/2012

2 History of audit support tools only paper Excel spreadsheets WinDAS (Powerbuilder + Oracle, custom dev) Assyst (Autoaudit on Lotus Notes, package by Paisley Thomson Reuters) 2013 Assyst II on Sharepoint (custom dev) 2

3 WinDAS Transactions database 3

4 WinDAS Audit programmes 4

5 WinDAS Observation forms 5

6 Assyst Audit tasks 6

7 Assyst Audit programme 7

8 Assyst Planning information 8

9 Assyst Observations 9

10 Assyst Benefits One single application for all auditors (fin/perf) Covers the full process Introduced formal procedures and standard documents for the first time in an IT system 10

11 Assyst II project Main drivers No Paisley support of Assyst after 2012 > the new version is a fully new product Assyst not sufficiently tailored to ECA needs Poor knowledge management and searching capabilities Poor editing capabilities compared to MS Office tools Not used by 100% of auditors, and not consistently. Most advanced features (management features) not used. 11

12 Why Sharepoint? Decision to go for a home made tool tailored to the Court s needs, rather than an off-the-shelf solution. Sharepoint offers a full development platform. Build on top of existing software components Reduces dependence towards external companies Focus on Knowledge management and Collaboration Open architecture / Integration capabilities Storage of all audit documents in a single place from the audit sites to the intranet/extranet Better integration with MS Office tools In line with DIT Strategy to migrate to a MS centric platform, in order to reduce the number of technologies 12

13 Project plan Pilot approach (fin then perf) Black belt network Agile development methodology Phase 1: audit planning and execution (APM to SPF) > first global deployment between March and September 2013 Phase 2: audit monitoring and reporting (final reports and implementation reports) 13

14 Project governance Project team = Business PM + IT PM + BA + key business users IT development team = IT PM + 3 dev + architect Black Belt network Steering committee = board of directors Project owner = CEAD director 14

15 Business analysis Business process analysis covering the full audit cycle > BPMN models Increasing the knowledge of audit processes on IT side to improve collaboration 15

16 Business analysis 16

17 IT DEVELOPMENT METHODOLOGY SCRUM Methodology Involve the business actors as much as possible in the development phase Develop in an interactive and iterative way: show the results every 2 weeks (Sprint) and agree on the next work items for the development team. Requirements Design Implement Test Instead of doing one activity after the other Scrum teams perform a bit of all activity at once 17

18 Functional coverage (phase 1) Focus on audit planning and execution Dedicated audit sites and audit templates sites Import of transaction information from an external database Assistance to the creation of Audit programmes templates One page audit programme form dynamically created from AP templates vs transactions Audit site specific Document library optimized for the handling of Evidence documents Audit site specific Document library optimized for the handling of Permanent documents Database of historical observations ( ) Improved approval workflows Step-by-step Observation (findings) management Finding statement document generation 18

19 Functional coverage 19

20 Business logical model v1 20

21 Business logical model v2 21

22 Example: OBJECTIVES SUBJECTS Evidence collection plan Detailed questions / steps France UK Ministry-Paris Region Project 1 Project 2 Project 3 Ministry-London Region Project 1 Project 2 Project 3 Q1 Q1,1 Criterion 1 1 x x 2 x x 3 x x x x x x 4 x x x x x x 5 x x x x x x 6 x x Criterion 2 1 x x 2 x x 3 x x set of all questions for criterion 1 in UK set of all questions for criterion 2 in UK Q1,2 Criterion 3 1 x x x x x x 2 x x x x x x 3 x x x x x x 4 x x x x x x 5 x x x x x x Criterion 4 x x Criterion 5 x x Q2 Q2,1 Criterion 6 x x Q2,2 Criterion 7 x x Q3 Q3,1 Criterion 10 x x Q3,2 Criterion 11 x x Q3,3 Criterion 12 x x set of all questions for criterion 3 in France typical values per audit 5 to 30 criteria 4 to 10 Member States 5 to 15 projects Ministry question set Project question set 22

23 Assyst II sites Layout Lists Auditees Units ASSYST2 Top level site Pages Help pages Forums Audits Unit/Dir. sites Audit sites Templates Lists Ad-hoc list Forums Pages Ad-hoc page Tasks Libraries Ad-hoc library Library AP WP ED SPF Others Forums APs Transaction 1 Audit step 1 Audit step 2 Transaction 2 Audit step 1 Audit step 2 Findings Finding 1 Fact 1 Fact 2 Finding 2 Fact 1 Fact 2 Tasks sites Template Activities AP 1 Audit step 1 Audit step 2 AP 2 Audit step 1 Audit step 2 Library Template doc 1 23

24 Assyst II Audit site Document libraries 24

25 Assyst II Transactions list 25

26 Assyst II Audit Programme forms 26

27 Lessons learned As in most IT system development or implementation projects, many organisational/procedural issues come out and take long discussions and approval to be solved Difficult/Costly to provide a nice-looking, responsive and ergonomic user interface with Sharepoint, even with custom coding Scrum methodology helps to identify system requirements which are not clearly expressed or agreed, but it takes longer as some design/developments are made and then dropped 27

28 Thank you! 28