Continuous Auditing. Roundtable GAIN 12 November 2008

Maat: px

Weergave met pagina beginnen:

Download "Continuous Auditing. Roundtable GAIN 12 November 2008"

Elias Lenaerts
7 jaren geleden
Aantal bezoeken:

1 Continuous Auditing Roundtable GAIN 12 November 2008

2 Roundtable Continuous Auditing 3 September 2008 Programma Rob Riesthuis: Continuous Assurance: Trend of toekomst Leonard Boogers: Continuous Heineken Participants from: TNT, B-Fact, KLM, Corus, Nuon, KPN, Gasunie, Vopak, Philips, Tom Tom, Heineken, BDO, Ahold, individuele beroepsuitoefenaren

3 Continuous Assurance: Trend of toekomst Continuous Assurance Trend of toekomst Rob Riesthuis, BDO

4 Continuous Assurance: Trend of toekomst Onderzochte hypotheses Toegevoegde waarde Continuous Assurance (CA) 1. De betrouwbaarheid van informatie neemt toe 2. Toepassing van CA leidt tot betere besluitvorming voor gebruikers Randvoorwaarde 1. CA stelt hogere eisen aan de interne beheersing 2. Implementatie van een CA framework vereist bereidheid van ondernemingen om tijd en geld te investeren 3. CA stelt hogere eisen aan het niveau van de automatisering

5 Continuous Assurance: Trend of toekomst Uitkomsten onderzoek Belangrijkheid van de hypothese - Randvoorwaarden CA CA stelt hogere eisen aan de Interne Beheersing. Implementatie van CA framework vereist bereidheid om tijd en geld te investeren. CA stelt hogere eisen aan niveau van automatisering 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%100% Meest van belang Minder van belang Minst van belang

6 Continuous Assurance: Trend of toekomst Uitkomsten onderzoek Belangrijkheid variabelen bij hypothese 'Implementatie van CA framework vereist bereidheid van ondernemingen om tijd en geld te investeren'. CA stelt hogere eisen aan de verwerkingscapaciteit en de inrichting van de hardware Scholing van medewerkers is vereist, waarbij aanwezigheid IAD afdeling een pré is Flexibiliteit van het CA framework is van belang bij de implementatie 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%100% Meest van belang Minder van belang Minst van belang

7 Continuous Assurance: Trend of toekomst Uitkomsten praktijkonderzoek Belangrijkheid van de hypotheses: toegevoegde waarden CA De betrouwbaarheid van informatie neemt toe Toepassing van CA leidt tot betere besluitvorming voor gebruikers 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Meest van belang Minst van belang

8 Continuous Assurance: Trend of toekomst Uitkomsten praktijkonderzoek Belangrijkheid van variabelen behorende bij hypothese 'De betrouwbaarheid van informatie neemt toe'. Tijdigheid van informatie neemt als gevolg van CA toe. Relevantie van informatie neemt als gevolg van CA toe. Verwerking en analyse van meer informatie leidt tot betrouwbaardere uitkomsten. 0% 10%20%30%40%50%60%70%80%90%100% Meest van belang Minder van belang Minst van belang

9 Continuous Assurance: Trend of toekomst Verkenning internal audit versus CA (1) Waarom zouden jullie het wel doen? Unieke kans om koploperspositie in te nemen Mogelijkheid om op efficiënte wijze effectief IAD functie te vervullen. Waarom zouden jullie het niet doen? Implementatiekosten (bereidheid tijd & geld) Verregaande samenwerking IT department + noodzakelijke kennis geautomatiseerde controles (EDP)

10 Continuous Assurance: Trend of toekomst Verkenning internal audit versus CA (2) Aanbevelingen Stimuleren kennis en bereidheid CA Fasegewijze implementatie Interactie XBRL Uitwisselen best practices

11 Welcome to the World of Continuous Leonard Boogers, Audit Manager Group Internal Audit

12 Internal Heineken CEO CFO Group Internal Audit (7) Western Europe (IA: 24) Central Eastern Europe (IA: 27) Americas (IA: 6) Africa Middle East (IA: 38) Asia Pacific (IA: 2) OpCo General Man Internal Audit Function 1 Function 2 Hierarchisch Functioneel FTE s are excl. JVs

13 Overview of Heineken s Risk Management Activities Strategic Risk Assessments Assess/update risks threatening achievement of (strategic) objectives and include mitigation Sustainability CoBC and WB to prevent unethical and irresponsible behaviour Sustainability (alcohol) auditing (Heineken) Company Rules To mitigate main risks over various functional areas by setting clear rules Embedded in HR s common processes and systems to keep control over routine operations Key Process Controls Risk Oversight Embedded in HR s IT processes and infrastructure to keep control over the centralising IT Key IT Controls

14 Common Audit Approach Group Internal Audit drives Common Business Control Framework (order-to-cash, purchase-topay, inventory management, record-to-report) Structured cooperation with external audit Supported by Common Tooling

15 Common Audit Approach using central data (access) Group Internal Audit Central accessibility of of data data Central tools and competencies Design Key Controls and and risks assessment Measuring Process Integrity Indicators Measuring Security Indicators Support Improvements Overall evaluation, testing, local reporting and feedback Central Database Central with HeiCORE Database with HeiCORE data data OpCo OpCo OpCo OpCo Best practice, design, analysis and support Improvements Local Internal Audit Key Controls Assessments Evaluate and discuss Indicators Testing and improvement of of controls Local Audits, Reviews and and reporting Follow up

16 Continuous Auditing Why developing a tool for Continuous Auditing 1. Single Product company 2. Roll-out of common systems challenges audit approach 3. Availability of a common tooling product Resulting in joint effort with Synaxion (Dutch supplier of Performance Management Software) further developing an Operational Control Suite for SAP

17 Continuous Auditing Why developing a tool for Continuous Auditing 1. Single Product company 2. Roll-out of common systems challenges audit approach 3. Product availability Resulting in joint effort with Synaxion (Dutch supplier of Performance Management Software) further developing an Operational Control Suite for SAP

18 Process Integrity Indicator PII important in common audit approach Implemented in 15 local internal audit department s Business coverage 85% Monthly / weekly central data extraction Indicator structure Purchase to Pay: orders, goods / invoice receipt, payment Order to Cash: order, delivery, billing, cash receipt Warehouse Management Record to Report: general ledger Master Data Indicator indicates if internal controls in business processes are designed and functioning

19 Process Integrity Indicator - Benefits Reporting Score card presentations allowing trend analysis and benchmarking between targets / OpCos Exception based auditing, quickly identifying areas for further detailed analysis Drill down functionality via pivot tables Technique Centralised storage of results No interference with production environment SQL server storage allows for preprocessing Extensive security features ensuring data confidentiality User friendly

20 Process Integrity Indicator - examples Are selected internal controls in processes designed and functioning? 1) Example Order-to-Cash Control objective: Correct, complete and timeliness processing of sales orders in relation to authorised price list in SAP. PII: # of changes to billing documents 2) Example Purchase-to-Pay Control objective: Approval procedure of orders is conform authorisation tables in SAP PII: % vendor invoices posted without PO reference

21 Process Integrity Indicator : Benchmark per OpCo

22 Process Integrity Indicator : Benchmark per OpCo

23 Process Integrity Indicator : Monthly PII trends for one OpCo

24 xxx

25 Learnings 1. Development remains a learning curve 2. IT 3. Training in interpretation of indicators and its details 4. Under-estimation of required level of SAP understanding 5. More time consuming than expected 6. Intensity of business involvement differs... But overall conclusion: Value for money

26 xxxxx

Vergelijkbare documenten

CobiT. Drs. Rob M.J. Christiaanse RA PI themabijeenkomst Utrecht 29 juni 2005 9/2/2005 1

CobiT. Drs. Rob M.J. Christiaanse RA PI themabijeenkomst Utrecht 29 juni 2005 9/2/2005 1 CobiT Drs. Rob M.J. Christiaanse RA PI themabijeenkomst Utrecht 29 juni 2005 9/2/2005 1 Control objectives for information and related Technology Lezenswaardig: 1. CobiT, Opkomst, ondergang en opleving