Building for the Future

Building for the Future Alvia Brown Director, Global Operations Sean Pinto Manager, Global Operations

Our Global Analytics- Enabled Audit Strategy

4 Company Overview World s largest non-alcoholic beverage company with $46.5 billion in worldwide revenues Primarily produce and sell concentrate to bottlers who produce packaged beverages and sell them to customers Bottlers can be company-owned (CCR, Germany, Philippines, China and India, or Franchise operations Operations in more than 200 countries Workforce of approximately 150,000 Company employees

5 Corporate Audit Department Org. Chart Robin Moore, VP and Chief of Internal Audit Barbara Newman, Exec. Admin. Assistant Paul Docekal- COBC Lars Hepers- BIG/CPS Audits John Mathew- Group Audits Karen Brey- GBS/COE/Corp Audits Tim Twomey CCR Audits Alvia Brown CAD Global Operations Tim Twomey- IT Audit Thomas Markovic COBC Specialists (Worldwide) India Abhijit Ray India Staff Philippines Staff Calandra Tipton James (Park) Thomas Mark Bryan Tamara Romany Kina Morgan Julia Vaughn James Wheeler Sean Pinto Technology Pia Weckendorf- Methodology Rowland Edwards Martin Winkler China Maggie Ma China Staff Domestic (including former CCE) and International Audit Staff Global Ops. Staff Admins IT Staff- (Worldwide) Germany Staff

6 Global Operations? Global Operations team formed in 2011 out of an operational excellence exercise to bring structural efficiency to the department The team consists of two verticals Methodology, Trg Communications, Technology and Reporting Data analytics strategies and leadership is managed by the technology team, along with other significant technology initiatives Led by Director who reports to the VP/Chief of Internal Audit All department level leadership is managed by this team, leaving audit managers free to manage audits!

7 Organizational Structure: Audit Department Headed By CAE, 20 management staff, 12 CoBC (Code of Business Conduct), 9 Global Operations and 104 staff auditors 20 international, 39 domestic financial, 20 Information Technology, 25 regional (the Philippines, Germany, China and India) Data Analytics 2 personnel, non-dedicated, based in Atlanta and part of the Global Operations team

8 Systems ERP Systems: SAP, Three installations: a) Enterprise SAP Corporate, Business units, Concentrate Plants, and Regional Finance Centers b) Bottling System:» CokeONE All major Coca-Cola owned Bottlers except CCR» CCR SAP Separate SAP system for Coca-Cola Refreshments Data Analytics Systems c) AX Server (Production and Development Environments), AX Web Client (formerly AX Gateway), and ACL TM Direct Link for SAP ERP

9 Data Analytics Objectives Audit Team Support enhanced coverage of data populations audit testing Ensure effective and efficient sampling Ensure time saving by» efficient, centralized data extraction,» Formatting and filtering data for use by auditors on the field Code Investigation Team Proactively detect red flags to be investigated by fraud group Business Units Ensure dollar recovery by developing exception detection analytics

10 Yesterday

11 Yesterday What existed in January 2011 Segregated DA efforts, DA programs running in bottling locations in India, China, Philippines Sparse DA efforts in Atlanta mainly trending information, which did not resonate with audit teams What did not exist Co-ordination efforts for existing DA initiatives at CCR, or other bottlers Thinking around analytics efforts around other business verticals (regional finance centers business units, CPS plants etc) Overall strategy or vision for data analytics

12 Maturity of Atlanta Companies Q1 2012 ad hoc repetitive continuous Foresight Level 5 Monitoring Audit Contribution Insight Hindsight Level 1 Basic Level 2 Applied Level 3 Managed Level 4 Automated Sophistication

13 What did we do? Planned a) Started with the end in mind b) Guys, the two of you can t sustain this using Desktop! c) Had an auditor on our side d) Had a vendor on our side *Desktop is now ACL TM Analytics 10

14 What did we do 2? Talked a) With other companies who had a data analytics strategy b) Weeded out common good ideas c) Signed up for communities, User Groups etc. d) ACL workshop on May 10, 2012

15 Then? Set Goals Use analytics for all applicable audits in 2012 we do almost 100+ audits a year Started with 3 audit cycles - Field General Ledger and Close, Procure to Pay, and Cash Disbursements Procure ACL TM Analytics Exchange and ACL TM Direct Link for SAP ERP

16 Today

17 Today What exists Financial Audits We cover Enterprise SAP for first phase of work (used at all Region Finance Centers, Business units, CPS plants, and Corporate) Use AX Server for 5 audit processes Field General Ledger and Closing, Procure to Pay, Cash Disbursements (Payments), Cash Receipts, and Accounting for Marketing a total of 50 tests. IT Audits We have pure IT Audit Tests (UNIX/AIX configuration parameters testing, MainFrame and DB2 testing standardized on AX) a total of 32 tests Fraud/Anti-Bribery Work We also set up some tests around Fraud/FCPA work especially Keyword searches on expenses, P-Cards etc. Consistently using Direct Link (Data extraction) and AX (Data Preparation, processing) for 100% of all international audits

18 Maturity of Atlanta Companies Q1 2013 ad hoc repetitive continuous Foresight Level 5 Monitoring Audit Contribution Insight Hindsight Level 1 Basic Level 2 Applied Level 3 Managed Level 4 Automated Sophistication

19 Benefits Thus Far Audit Issues and Cost Recoveries Identified eight audit issues, including one high risk issue on five audits, thus ensuring dollar recoveries Identifying such issues in the past wouldn t have been possible with the random sampling approach. Increased Audit effectiveness More than thirty reports increased coverage of transactions to 100% Six analytics set up to point out potential red flags, which may indicate fraudulent activity. Increased Audit efficiencies In 2012, 33 tests over three audit processes replaced reports, which the auditors used to extract at location, or rely on the operation for help Anecdotal feedback from an audit team, potentially changing audit approach -- extremely encouraging as use of ACL technology has replaced manual audit testing

20 AX Efficiencies Gained Parameter Appetite Metric Pre AX Limited to 1 or 2 locations every audit (each audit is approx. 7-8 weeks) Metric - Post AX No limit (completed 17 locations in month of Aug) Size SAP data extraction time Prep and Running time for analytics on desktop Lead Time 300K 400K transactions (per extraction) 3 days 1 week (several analytics weren't processed due to size e.g. VMF changes) 9-12 hrs (approx.) 2 weeks 1.5-2MM transactions per six months per location) 20-40 minutes 1-2 hrs 2 days

21 Dates? January 2011 Formation of Global Operations March 2011 Work out a broad Data Analytics Strategy May 2011 Department level ACL training, and ACL workshop to support overall plan July 2011 Pilot Cycle 1 (ACL Analytics) Sept 2011 June 2012 Roll out 3 cycles, and solicit feedback, refine tests Aug Sept 2012 Get ACL consultants to port all existing scripts to server STAGES 1 2 3 4 5 6 7 8 9 10 11 12 February 2011 Formalize department objectives, add Data Analytics to every auditor s objectives April 2011 Meet with Companies June 2011 1. Establish resource plan 2. Work with IT and Procurement to acquire AX August 2011 Get feedback for Cycle 1 and develop Cycles 2 and 3 July 2012 Direct Link and AX Server implemented Oct Dec 2012 1. Consistent use all audits 2. More Cycles 3. Data analytics for IT Audits Timeline View of TCCC s Corporate Audit Department s DA Journey

22 Tomorrow

23 More Dates? Jan-Mar 2013 Clean up existing analytics June - July 2013 1. Begin developing audit tests for CCR 2. Upgrade AX hardware Sept 2013 1. Review and include feedback from CCR s tests 2. Complete FCPA Program Nov - Dec 2013 1. Roll out all CCR analytics 2. Complete integration of non SAP (IT, other bottlers) analytics Feb Mar 2014 Begin partnering with other organizations in the company (Ethics and Compliance, GBS, GDG) May 2014 onwards Consolidate STAGES 1 2 3 4 5 6 7 8 9 10 11 12 April May 2013 1. Get Direct Link installed on CCR s SAP, 2. Continue developing analytics for domestic and other cycles Aug 2013 1.First set of analytics rolled out for CCR 2. Work to consolidate FCPA program Oct 2013 1. Complete 10 tests for domestic audits Jan 2014 1. Work on installing Direct Link on SAP HR instance 2. Refresher Training April 2014 Develop Some HR data tests Timeline View of TCCC s Data Analytics Roadmap

24 Data Analytics The Day After Tomorrow 100% of our audits rely substantially on data analytics executed at the center. At least 20% of actual testing performed centrally Audit management uses Dashboard/Visual Management to integrate into audit planning and supplement annual risk assessment process Continuous control monitoring (CCM) program in place for executive management to see compliance status across the globe. Client Operations and CIC (Corporate Internal Controls) also use analytics to proactively measure compliance, specially for audits, which are on CSA (self Certification) Continuous monitoring of FCPA and anti bribery analytics, via heat maps and dashboards. Extend DA program to other parts of the company, e.g. Global Data Governance, The McDonalds Division, marketing/media agencies etc.

25

2012 ACL Services Ltd. 26