Prof. Dr. Nick Gehrke Alexander Rühle

Prof. Dr. Nick Gehrke Alexander Rühle

AGENDA 15:00 16:00 Session 1 1. Introducing Process Mining 2. Case #1: Financial Process Mining 3. Introducing the profiling methodology 4. Case #2: Financial Process Mining and Profiling 16:30 17:30 Session 2 5. Summary Session 1 6. Introducing Factor Analysis 7. Case #3: Financial Process Mining, Profiling, Factor Analysis 8. Summary of Key Challenges

0. INTRODUCING PROF. DR. NICK GEHRKE, CISA Prof. Dr. Nick Gehrke Diplom-Kaufmann Certified Tax Advisor Certified Information Systems Auditor ~10 years audit experience ~ 5 years Big 4 nick.gehrke@nordakademie.de Tel.: +49 (0) 173 25 02 699

0. INTRODUCING ALEXANDER RUEHLE, CISA Alexander Rühle Diplom-Kaufmann Certified Internal Auditor Certified Information Systems Auditor alexander.ruehle@sapliance.com Tel.: +49 (0) 172 44 92 971 sapliance, CEO and Co-founder Smart Audit, CEO and founder ~10 years audit experience ~ 5 years Big 4

1. INTRODUCING PROCESS MINING Process Mining establishes transparency for IT-based processes. Key advantages: objective quick analysis complete convenient

1. INTRODUCING PROCESS MINING 1. Process Mining takes existing data from ITsystems as a starting point 2. Extracts the different variations of the process 3. Automatically turns them into an understandable visualisation of the process

1. INTRODUCING PROCESS MINING How does Process Mining support auditors?

1. INTRODUCING PROCESS MINING Evolution of process audits (2012) Interview, Data Analysis, Sampling Process Mining, Data Analysis, Sampling Interview (Walkthrough), Sampling

1. INTRODUCING PROCESS MINING General Process Mining Challenges for Auditors 1. Data Aquisition 2. Data Security 3. Linking Process Data 4.Tool

CASE #1: FINANCIAL PROCESS MINING Research Project Virtual Accounting Worlds at University of Hamburg 2010-2013 Design of the Financial Process Mining Algorithm First prototype of sapliance mitigating the first challenges of process mining Predefined Data Data Encryption SAP Data extraction Automated Financial Process Mining

CASE #1: FINANCIAL PROCESS MINING How does the Financial Process Mining function? Standardized ERP System (SAP) SAP standard tables (Basis, FI, SD, MM) Automated reconstruction of SAP processes starting in the financial statements, end to end Every entry is explained by one or more sequences that lead to this entry Every sequence can be mapped to several accounts

CASE #1: FINANCIAL PROCESS MINING Reconstruction of actual sequences in the dataset

CASE #1: FINANCIAL PROCESS MINING Scenario 1 German customer Russian Entity Internal Audit Department Audit Objectives: 1. Understand actual business processes 2. How do processes explain the financial statements? 3. Identify abnormalities 4. Select specific samples based on abnormalities

CASE #1: FINANCIAL PROCESS MINING Disco Example

CASE #1: FINANCIAL PROCESS MINING Predefined Data Data Encryption SAP Data extraction Automated Financial Process Mining Export Data Import to Process Mining Tool Analyze Processes Select Samples Verify Samples in SAP Fieldwork Generalize Observation Report

CASE #1: FINANCIAL PROCESS MINING Lessons Learned 1. Reality is complex especially in SAP 2. Cognitive limitatations in analyzing graphs 3. Budget limitations lead to choice of either Reducing complexity Significant scope reduction 4. Process Mining has no substantive audit objective Full Scope Financial Process Mining + Audit Methodology

3. INTRODUCING THE PROFILING METHODOLOGY WHAT IS THE IDEAL OBJECT OF INVESTIGATION? Document User Vendor Customer Journal Entry

3. INTRODUCING THE PROFILING METHODOLOGY WHAT IS THE IDEAL OBJECT OF INVESTIGATION? Document User Vendor Customer Journal Entry THE SEQUENCE IS THE IDEAL OBJECT OF INVESTIGATION

3. INTRODUCING THE PROFILING METHODOLOGY Objectives 1. Audit methodology to evaluate sequences 2. Reducing false positives 3. Auditors should spend their time with reviewing the significant sequences first 4. Audit objectives: 1. Compliance and Correctness 2. Identify Saving Opportunities 3. Review of Process Standardisation 4. Restricted Access

3. INTRODUCING THE PROFILING METHODOLOGY How does the Profiling methodology function? Definition of indicators per audit objective (>130) 1. Compliance and Correctness e.g Postings vendor to vendor 2. Saving Opportunities e.g Duplicate payments 3. Process Standardization e.g. Changes to purchase orders after invoice received 4. Restricted Access e.g. Segregation of Duties

3. INTRODUCING THE PROFILING METHODOLOGY Audit of every sequence! This sequence is prominent because Administror booked Invoice Paid on a weekend Vendor without payment terms Invoice is marked as potential duplicate payment Vendor payment bank account differs from bank account in vendor master file

3. INTRODUCING THE PROFILING METHODOLOGY All business processes are audited by all indicators.

CASE #2: FINANCIAL PROCESS MINING AND PROFILING Scenario 2 German customer Wind Energy Internal Audit Department Audit Objectives: 1. Evaluate procurement processes 2. Audit of user access

CASE #2: FINANCIAL PROCESS MINING AND PROFILING Live demo audit report

CASE #2: FINANCIAL PROCESS MINING AND PROFILING Predefined Data Data Encryption SAP Data extraction Automated Financial Process Mining Export Data Import to Process Mining Tool Analyze Processes Select Samples Verify Samples in SAP Fieldwork Generalize Observation Report

CASE #2: FINANCIAL PROCESS MINING AND PROFILING Lessons Learned 1. Auditors needs an interest in detailed data 2. Although there is a reduction of false positives, there still is a lot of data to review 3. Auditors tend to analyse the report by reviewing isolated indicator instead of combining critical indicator 4. Auditor is not supported in identifying general design issues of underlying data. Full Scope Financial Process Mining + Audit Methodology + Factor Analysis

5. SUMMARY SESSION 1

6. INTRODUCING FACTOR ANALYSIS Objectives 1. Present the auditor with those indicator combinations that best explain the data set. 2. Define a target (end point) to the data audit. 3. Guide the auditor through the audit, beginning to end.

6. INTRODUCING FACTOR ANALYSIS Difference between Profiling and Factor Analysis Profiling Factor Analysis

6. INTRODUCING FACTOR ANALYSIS What is an (explanatory) factor analysis? 1. Data reduction technique (we have too much variables) 2. A component / factor is a set of latent variables that originally explain the data set (calculate less but more meanigful factors than variables) 3. A component / factor consists of a linear combination of the variables 4. Goal is to present relationships among variables Which factors best explain the dataset?

6. INTRODUCING FACTOR ANALYSIS General Example

6. INTRODUCING FACTOR ANALYSIS The sample items = Cities

6. INTRODUCING FACTOR ANALYSIS The variables: 25 offence categories

6. INTRODUCING FACTOR ANALYSIS The analysis: Extract the Components / factors

6. INTRODUCING FACTOR ANALYSIS The Interpretation of components / factors Give them a name according to the interpretation

6. INTRODUCING FACTOR ANALYSIS And now? What has the crime study to do with process audits? Only the statistical method! Artifact is / are not but is /are Sample items Cities Process sequences Variables Offence Categories Compliance indicators in process instances Components / factors Crime patterns Process weakness patterns

6. INTRODUCING FACTOR ANALYSIS

6. INTRODUCING FACTOR ANALYSIS The resulting data matrix Case No Indicator A Indicator B Indicator C 1 1 1 0 2 0 0 1 3 1 1 0

CASE #3: FINANCIAL PROCESS MINING, PROFILING, FACTOR ANALYSIS DEMO CASE

CASE #3: FINANCIAL PROCESS MINING, PROFILING, FACTOR ANALYSIS Predefined Data Data Encryption SAP Data extraction Automated Financial Process Mining Export Data Import to Process Mining Tool Analyze Processes Select Samples Verify Samples in SAP Fieldwork Generalize Observation Report

7. SUMMARY OF KEY CHALLENGES