Data Analysis Process
Is
A Multi Risk Process
Your lecturer
Business processes in the modern world
Data Analysis: Definition
Why we need DA?
Related Standards
A review of risks involved in the Data
Analysis Audit “DAA”
Case Study based on the survey stage
Combined Survey in comparison to a
regular survey
Content
(3)Case Study Review
List of Inherent Risks in the case study data
analysis process vs. inherent risks in the DAA
Conclusion
Your Lecturer
(1)Aya Steiner, CPA, CISA, CIA, CRMA,
Born in Tel Aviv, Israel; in 1972.
Lives with a partner, 2 sons and a Persian cat.
B.O.B in Business & Accounting
Experienced in identifying and quantifying
business, operational
&IT risks
Has high level of experience in programming
audit codes in various data analysis software
During the past 13 years, has filled several roles
in industrial, financial, retail & government
sectors in Israel.
Areas of expertise:
(1) Internal Auditing
(2) IT Auditing
(3) Data Analysis Auditing
Member of the Israeli Chapter Council and a
member in several committees
Your Lecturer
(3)Initiator, lecturer & manager of the Data
Analysis Auditor certification program in
Business processes in modern world
Behind every business process there is at least one DB and at least, one or more, computerized systems
In every business process, an auditor needs to cope with the increase of:
(1) exposure to failure due to complexity of business IT process
(2) the constant growth in data volume (3) the quantity & complexity of IT
Business processes in modern world
One should also consider the constant growth in the
number and variety of:
(1) products
(2) change rate of procedures
(3) rules & regulations in each country &
worldwide
(4) The human Factor – experience, skills &
abilities of auditors and audited *
Business processes in modern world
IT systems are critical in achieving competitive advantage The number of procedures & regulations needed to be implemented and observed in IT software in order to accomplish compliance is horrific
Each computerized control / check demands an organized process of characterization
The cost and vast amount of financial resources needed – Thus The gap…
Business processes in modern world
The range, scope and sophistication of embezzlements and frauds
A much higher proficiency, experience, caution* and know-how are required from the auditor
An increasing need for implementing technological audit tools in the audit process
Data Analysis Definition:
(1) Investigating and analyzing data from different
computerized systems and environments
(2) Identifying business & IT risks
in the audited processes
(3) Using automated means as much as possible
(4) Achieving change from raw information
into relevant, reliable and presentable
knowledge in the audit report
Why do we need Data Analysis?
Generally the use of data analysis methodology
can achieve:
(1) Effective identification of business and IT audit
risks on the whole.
(2) Effective and relevant response to the audit
risks.
(3) Quantification and evaluation of anomalies and
irregularities
Why do we need Data Analysis?
(2)(4) To achieve substantial increase in the quantity
of anomalies and irregularities identified in the
audited
(5) To increase quality of generated products from
the audit process as well as locating
Why do we need Data Analysis?
(3)(6) To implement checks, which in the past, were
done only by computer programmers
(7) To achieve assurance of manual and
computerized controls
Related Standards
(1)International Standard No.G13 - Risk evaluation
Audit Risk:
The risk of false presentation in financial reports. This consists of:
(1) Inherent risk
(2) Control risk
(3) Detection risk
All the above deal with possible risks the audit team will not expose substantial errors.
Data analysis can effectively, efficiently and reliably deal with the above audit risks as a whole
Related Standards
(2)International Standard No.G16 – Data Analysis Technologies
(1) States that the DA process creates inherent risks of its own
(2) Talks about the significance of choosing well trained professionals for conducting the DA process
(3) Gives several examples of inherent risks in the DA process
List of
General
risks in “DAA”
(1)1) Data analysis process is a structured process which combines the need for knowledge, experience and extreme caution in conducting the process in general
2) Each Stage of the data analysis process is based on previous stages - thus the particular need for
(3) Failure in one of the stages, or sub stages, of the process, can directly & profoundly affect the relevance and quality of the final product
(4) Need for comprehensive knowledge of IT software in general
(5) Acquaintance with different kinds of data bases
(6) Programming skills & logical comprehension
List of Inherent risks in DA Process
(1) Inadequate Population – refers to the risk that the
designated and received audited population would not reliably reflect the audited process, be partial or false
(2) Definition of anomalies and irregularities can be insufficient – this refers to the risk in the survey
List of Inherent risks in DA Process
(3) The need for high level of experience in identifying
risks and irregularities – refers to the risk that a data
analysis auditor might not be experienced enough to
identify risks or irregularities in the computerized checks
List of Inherent risks in DA Process
(4) Comprehending the business operation and IT
audited process – refers to
one of the biggest risks in the data analysis process.
If the auditor doesn't comprehend the layers of the audited process, he may incorrectly understand and conclude various kinds of data information
List of Inherent risks in DA Process
(5) QA of the data auditor process as a whole –
refers to the risk that the
data auditing process
, at
each of its stages, will not be audited by a
professional & experienced data analysis
audit
manager
This will directly and profoundly inflict on the quality
of the data analysis products and their relevance
List of Inherent risks in DA Process
(6) The use of reports received from the audited, refers
to the risk that the data analysis auditor will choose
to accept / receive the raw data needed from the system reports which are not characterized properly (7) The use of data stored in non-operational systems of
a business, refers to the risk the auditor will use
List of Inherent risks in DA Process
(8) Incorrect, or partially correct files received
from operational systems refer to the risk
that the data analysis auditor's work will be based
on partial or incorrect files
(9) QA stage refers to the risk that the
data analysis auditor will not perform all the
necessary QA checks
(10) Computerized audit checks – refer to the
risk that the logic used by data analysis
programmers might not be sufficient or
adequate
It may cause a situation whereby irregularities
might not surface at all
List of Inherent risks in DA Process
(11) An unskilled data analysis auditor can
wrongly neutralize records, define inadequate
keys needed for joining files, compare data of
various report periods, thus, not extract all
inherent possible irregularities
I saw this risk occurring too many times…
List of Inherent risks in DA Process
List of Inherent risks in DA Process
(12) Success in the verification stage – refers to risk that although the data analysis auditor has done his work correctly at the audit verification stage, he will not be able to receive confirmation on findings and
irregularities (already) found.
The ability to bring findings as well as closures is a
critical skill and ability for the success of the process as a whole
Case Study
Company X
One of the biggest retail companies in Israel
Based on the survey stage of
Data Analysis methodology carried out
in
Survey Stage
The survey stage is the first stage conducted by the
auditor. In this Stage the auditor collects information about:
(1) The audit scope (2) The audit process
(3) All information systems which support the process (4) Past audit reports; procedures and SOX
One survey in which the audit process is reviewed in several dimensions parrarely and in different
combinations and scopes: (1) Internal audit
(2) Classical IT audit (3) Data Analysis audit
The combined survey audit provides a
comprehensive picture of the audited
process
The implementation of the combined survey
stage enables implementation of a number
of different audits parrarely in one audit
process
The combined survey stage can
significantly reduce overall resources
needed to conduct each audit separately
The combined impact of conducting one
combined audit is higher than the impact of
each audit separately
Case Study
Stock taking Process in
one of the largest retail
companies in Israel
Company X
Case Study – Company X
Stage 1
Review the survey stage in an audit of the inventory stock taking process… Each time with a different auditor:
(1) An internal auditor “hat”
(2) An IT auditor “hat”
Case Study – Company X
Stage 2
We shall review the combined survey Stage done on the stock taking process with the aid of The Combined Hat…
A virtual hat which combines all above hats introduced
Case Study – Company X
The Combined Hat
The Data Analysis Auditor (DAA) Hat
Uses combined knowledge & experience from: (1) Internal auditors.
(2) IT auditors. (3) Programmers.
Case Study – Company X
Further General Information
The budget designated for each audit separately is limited – 150 hours per audit
A considerable part of each separate audit is allocated to preparation hours of the audit as well as time for writing and presenting the report separately
Case Study – Company X
Further General Information
1. The company sells a variety of brands of its products in chain stores all over the country
2. All brands are physically managed in one logistical center
3. Each brand is stored in a different physical area in the main warehouse
Case Study – Company X
Further General Information
4. Each storing location (virtual or physical) receives a computerized warehouse number in the system.
5. Virtual computerized warehouses exist for different needs.
Additional information
gathered during the survey done
by the
Internal auditor
(1) Annual inventory procedures in warehouses or stores. (2) Dealing with virtual warehouses close to stock taking. (2) Calculating methods of stock differential values.
(3) Sample testing of items with high level stock differential rates.
Additional information
gathered during the survey done
by the
Internal auditor
(4) Presence during stock taking process in warehouses and stores.
(5) Basic analysis of company X stock differential reports generated by computerized system.
Additional information
gathered during the survey done
by the
IT auditor
(1) Who are authorized users updated on inventory changes.
(2) Duplicate records control. (3) Missing records control.
Additional information
gathered during the survey done
by the
IT auditor
(4) Frequency of interfaces between computerized systems.
(5) Data backup, in addition to preservation of full history of data changes.
Additional information
gathered during the survey done
by the
Programmer
(1) Software systems which participate in stock management and stock
taking processes.
(2) Unique identification of each brand in the system tables.
(3) Annual volume of stock movements
Additional information
gathered during the survey done
by the
Programmer
(4) Calculation of stock data done during different stages of calculation processes in the system.
(5) Records and layouts
(6) meaning of values in different fields.
Additional information
gathered during the survey done
by the
DAA
(1) Focusing on realization of significant risks in all layers of inventory process in
addition to stock taking process
(2) Identifying combined behavior of business and IT audited in a manner which indicates a hitch or a problem. All Of The Above & Much More
Additional information
gathered during the survey done
by the
DAA
(4) Identifying additional data analysis tests which can “close” all pre identified exposures which used to be done in the past only by programmers.
(5) Verifying suspicions of exposure by repeated questioning of several audited parallely
Some real survey process products found
in the implementation of Combined Hat
based on the above case study:
(1) A computerized problem was identified during stock taking preparations, which had left “inventory” in virtual warehouses
(2) High volume of stock difference rates was identified, on item level, in one of the brands and in specific
Some real survey process products found
in the implementation of Combined Hat
based on the above case study:
(3) A problem of quality assurance of incoming inventory into the warehouses was identified.
(4) A problem in the item building process, was identified. (5) A profound and problematic logistical behavior was identified.
List of Inherent Risks in the case study
data analysis process
Parallel risk likelihood in the case study
General Inherent Data Analysis Risk
The business operation and IT audited process combined were very complex
1. Comprehending the business
operation and IT audited process 2. The need for high level of
experience in identifying risks and irregularities
Item management is different for each brand
Warehouse manager is new & withholding information
Different behavior in one brand which caused an inherent stock taking problem
List of Inherent Risks in the case study
data analysis process
Parallel risk likelihood in the case study
General Inherent Data Analysis Risk
Identifying different unique item keys for each brand
Comprehending the meaning of table fields and values in fields
No duplicate transactions were found by keys given by IT
manager
A complex structure of positive & negative transactions in system tables
List of Inherent Risks in the case study
data analysis process
Parallel risk likelihood in the case study
General Inherent Data Analysis Risk
Computing positive & negative transactions
Computerized audit checks – refers to the risk that the logic used by data analysis programmers might not be sufficient or adequate
A combined IT & managerial problem was identified during stock taking preparation
A problem of QA of incoming inventory was identified
List of Inherent Risks in the case study
data analysis process
Parallel risk likelihood in the case study
General Inherent Data Analysis Risk
The very complex DAA work was done by a very professional and experienced DAA & Programmer who worked according to a
specific methodology QA of the data auditor process as a
whole – audited by a professional & experienced DAA manager
The pre assessed time parallel to the actual time needed was
significantly lower Provided the survey process is not
adequately done, overall resources needs can be significantly increased
