Robotic Process Auditing
1 like459 views
The document discusses the role of robotic process automation (RPA) in auditing, emphasizing its potential to enhance efficiency and accuracy in audit processes. It highlights the features of AuditNet, a global resource for auditors, and outlines training and certification opportunities related to RPA. Additionally, it provides insights into the practical applications of RPA in various auditing functions, alongside the benefits and challenges of integrating technology into auditing tasks.
Robotic Process Auditing
- 1. Robotic Powered Auditing (“RPA”) Rich Lanza | Managing Director Audit Innovation © Grant Thornton LLP. All rights reserved. About Jim Kaplan, CIA, CFE President and Founder of AuditNet®, the global resource for auditors (available on iOS, Android and Windows devices) Auditor, Web Site Guru, Internet for Auditors Pioneer IIA Bradford Cadmus Memorial Award Recipient Local Government Auditor’s Lifetime Award Author of “The Auditor’s Guide to Internet Resources” 2nd Edition 2 1 2
- 2. © Grant Thornton LLP. All rights reserved. About AuditNet® LLC • AuditNet®, the global resource for auditors, serves the global audit community as the primary resource for Web-based auditing content. As the first online audit portal, AuditNet® has been at the forefront of websites dedicated to promoting the use of audit technology. • Available on the Web, iPad, iPhone, Windows and Android devices and features: • Over 3,100 Reusable Templates, Audit Programs, Questionnaires, and Control Matrices • Webinars focusing on fraud, data analytics, IT audit, and internal audit with free CPE for subscribers and site license users. • Audit guides, manuals, and books on audit basics and using audit technology • LinkedIn Networking Groups • Monthly Newsletters with Expert Guest Columnists • Surveys on timely topics for internal auditors Introductions 3 © Grant Thornton LLP. All rights reserved. HOUSEKEEPING This webinar and its material are the property of AuditNet® and its Webinar partners. Unauthorized usage or recording of this webinar or any of its material is strictly forbidden. • If you logged in with another individual’s confirmation email you will not receive CPE as the confirmation login is linked to a specific individual • This Webinar is not eligible for viewing in a group setting. You must be logged in with your unique join link. • We are recording the webinar and you will be provided access to that recording after the webinar. Downloading or otherwise duplicating the webinar recording is expressly prohibited. • If you said you would like CPE you must attend the entire Webinar to receive CPE (no partial CPE will be awarded). • If you meet the criteria for earning CPE you will receive a link via email to download your certificate. The official email for CPE will be issued via [email protected] and it is important to white list this address. It is from this email that your CPE credit will be sent. There is a processing fee to have your CPE credit regenerated post event. • Submit questions via the chat box on your screen and we will answer them either during or at the conclusion. • You must answer the survey questions after the Webinar or before downloading your certificate. 4 3 4
- 3. © Grant Thornton LLP. All rights reserved. IMPORTANT INFORMATION REGARDING CPE! • ATTENDEES - If you attend the entire Webinar you will receive an email with the link to download your CPE certificate. The official email for CPE will be issued via [email protected] and it is important to white list this address. It is from this email that your CPE credit will be sent. There is a processing fee to have your CPE credit regenerated post event. • We cannot manually generate a CPE certificate as these are handled by our 3rd party provider. We highly recommend that you work with your IT department to identify and correct any email delivery issues prior to attending the Webinar. Issues would include blocks or spam filters in your email system or a firewall that will redirect or not allow delivery of this email from Gensend.io • We are not responsible for any connection, audio or other computer related issues. You must have pop-ups enabled on you computer otherwise you will not be able to answer the polling questions which occur approximately every 20 minutes. We suggest that if you have any pressing issues to see to that you do so immediately after a polling question. • CPE for this event will be non-NASBA. © Grant Thornton LLP. All rights reserved. The views expressed by the presenters do not necessarily represent the views, positions, or opinions of AuditNet® LLC. These materials, and the oral presentation accompanying them, are for educational purposes only and do not constitute accounting or legal advice or create an accountant-client relationship. While AuditNet® makes every effort to ensure information is accurate and complete, AuditNet® makes no representations, guarantees, or warranties as to the accuracy or completeness of the information provided via this presentation. AuditNet® specifically disclaims all liability for any claims or damages that may result from the information contained in this presentation, including any websites maintained by third parties and linked to the AuditNet® website. Any mention of commercial products is for information only; it does not imply recommendation or endorsement by AuditNet® LLC Disclaimer 5 6
- 4. © Grant Thornton LLP. All rights reserved. Additional Disclaimer This Grant Thornton LLP presentation is not a comprehensive analysis of the subject matters covered and may include proposed guidance that is subject to change before it is issued in final form. All relevant facts and circumstances, including the pertinent authoritative literature, need to be considered to arrive at conclusions that comply with matters addressed in this presentation. The views and interpretations expressed in the presentation are those of the presenters and the presentation is not intended to provide accounting or other advice or guidance with respect to the matters covered For additional information on matters covered in this presentation, contact your Grant Thornton LLP adviser © Grant Thornton LLP. All rights reserved. AuditNet® and cRisk Academy • If you would like forever access to this webinar recording • If you are watching the recording, and would like to obtain CPE credit for this webinar • Previous AuditNet® webinars are also available on-demand for CPE credit http://criskacademy.com http://ondemand.criskacademy.com Use coupon code: 50OFF for a discount on this webinar for one week 8 7 8
- 5. © Grant Thornton LLP. All rights reserved. Richard B. Lanza, CPA, CFE, CGMA • Managing Director in Innovation for Grant Thornton, LLP • Over 25 years of ACL, Excel and other software usage • Received the outstanding achievement in business award by the Association of Certified Fraud Examiners for developing the publication Proactively Detecting Fraud Using Computer Audit Reports as a research project for the IIA • Recently was a contributing author of: • Detecting Corruption with Analytics: A Roadmap – The International Institute for Analytics • Global Technology Audit Guide (GTAG #13) Fraud In An Automated World – Institute Of Internal Auditors. • Cost Recovery – Turning Your Accounts Payable Department Into A Profit Center – Wiley And Sons. • Data Analytics: A Roadmap for Expanding Capabilities (published 2018 in partnership with the IIA's Internal Audit Foundation) • In 2015, discovered a new textual analytic technique using letters called the Lanza Approach to Letter Analytics (LALA)TM The views expressed by the presenters do not necessarily represent the views, positions, or opinions of Grant Thornton, LLP. These materials, and the oral presentation accompanying them, are for educational purposes only and do not constitute accounting or legal advice or create an accountant- client relationship. [email protected] Richard B. Lanza, CPA, CFE, CGMA 9 © Grant Thornton LLP. All rights reserved. 1 Identify the top opportunities for robotic process automation in audit processes. 2 See where you can become a “citizen programmer”, building the bots in your business processes. 3 Walk through case studies of applied audit-focused RPA Learning objectives 10 4 Consider the limitations and benefits of RPA into a total cost of ownership exercise. 9 10
- 6. © Grant Thornton LLP. All rights reserved. Mankind's Fascination with Robots Since the 1920's people have been fascinated by the idea of "robots" • A quick scan of popular culture shows us just how interesting robots and AI have been for the past century as subject matter. 11 © Grant Thornton LLP. All rights reserved. Distrust of Technology Audit report issued by Marwick, Mitchell & Co. based on their audit of Northern Shoe Company, Duluth, Minnesota - February 5, 1908 The adding machine in its riper place is an excellent institution but when it is resorted to on every occasion for the simple addition of two and two it becomes not only useless but dangerous…….Apart altogether from the time wasted in this way, the use of the machine which at first may be due to laziness on the part of the employee becomes at length a necessity for it is a well-known fact that the constant use of any mechanical calculator leads inevitably to trophy of the calculating faculty. A man who cannot calculate nimbly and accurately is of very little use as a bookkeeper. We would strongly advise that the adding machine be removed from the office or its use very much restricted. https://caats.ca/ 12 11 12
- 7. © Grant Thornton LLP. All rights reserved. Specific Tech Driving Modern Robotics 13 Machine Learning Algorithms Facial Recognition Software Predictive Analytics Natural Language Processing 3D Printing Geotagging/GPS location The Internet of Things Optical Character Recognition © Grant Thornton LLP. All rights reserved. Ideal Attributes For Using Robotics • Simple and Tedious (Process complexity is low) • Repetitive (The process will be run numerous times in a given period) • Relatively Static (The process does not change much over time) • Beneficial to run on a schedule (continuously monitoring a control provides additional benefits • Costly to Perform Manually 14 13 14
- 8. © Grant Thornton LLP. All rights reserved. "Robots" In The Context of Audit • In the audit automation world, a "robot" is a digital "worker" that performs a repetitive task • These digital "bots" have been in use for years in other industries (if you've ever interacted with a chat bot, or Siri you've seen robotics tech in action). • Some technologies that physical robots and AI rely on can be useful (predictive models, machine learning algorithms). • Robots in audit can be automated controls, scripts than run on a scheduler or combine either of these two items with AI to do work more efficiently. 15 © Grant Thornton LLP. All rights reserved. Value proposition 16 Why? How? People Process Technology Insights Efficiency Analytics Automation A.I. 15 16
- 9. (Automated) Audit Data Analytics © Grant Thornton LLP. All rights reserved. Analytics programs 18 IRP Issuer risk profiling • Predictive analytics • Financial reporting fraud • Restatement • Material weakness • Bankruptcy • Governance concerns • Litigation FSP Forensic support program • Forensic & analytics expertise applied to selected audits • Fraud brainstorming • Incremental / tailored management inquiry • Journal entry testing • Tailored analytics ADA Audit data analytics • Whole ledger analytics • Transactional scoring • Account combinations • Numerical / digital • Text / letter • Semantic 17 18
- 10. © Grant Thornton LLP. All rights reserved. Analyze Report Transform Validate System Specific Scripts Ensures complete & accurate client data Extract End-to-End automation Whole Ledger Analytics 19 Auto Map and Tag Calculated fields, entry types Pre-Set Quality Tests DR = CR, G/L completeness testing Scripted Analytics 100+ analytics organized into four areas Pre-Formatted Workpapers Excel spreadsheets, Power BI, mobile apps Audit Team Interaction Data + auditor expertise = quality and insights Assess and Enhance 190+ benchmarks for insights and efficiency Augment Benchmark © Grant Thornton LLP. All rights reserved. Overcoming Data Challenges • Normalizing data is 80% of the time (in the beginning) • “By most accounts, 80 percent of the development effort in a big data project goes into data integration and only 20 percent goes toward data analysis.” —Intel Corporation • Data is in every process • It may not be ERP / It may be in your “Big Data” • 90% of data is text • Audit (Internal & External) is the best partner to get the data • They are independent / Not proving the data is a scope limitation • Tend to establish the most secure data warehouses 20 19 20
- 11. © Grant Thornton LLP. All rights reserved. Automated Data Normalization • Store procedures for data cleanup once • Create a normalized set of data fields named by YOU • Ensure data quality tests are run prior to analysis • Automate these routine tasks to increase analyst’s time • Enrich the data by organizing it by type codes 21 © Grant Thornton LLP. All rights reserved. Automating Data E.T.L. • All of the Company's data is captured in an SAP G/L • Audit team had to budget almost 100 hours just on importing and combining various report extracts • Data analytics and innovation were introduced in the current year audit • Data import process was reduced from 25 hours /quarter to only 2 hours/quarter 22 21 22
- 12. © Grant Thornton LLP. All rights reserved. 404: Training Data Not Found • Robots are not perfect; and will fail, behave unexpectedly and trip over their own feet (just like me from time to time). • Robots will never replace auditors; but instead will make their jobs easier and allow them more free time to innovate. 23 Image from the DARPA Robotics Challenge © Grant Thornton LLP. All rights reserved. Whole ledger analytics: transactional scoring 24 Top entries SCORE_RATIO INC_STMT_IMPACT BAL_SHEET_IMPACT Description Posting Date 1 0.338 (216,678.08) 216,678.08 To balance to subledger 12/31/2016 Abs.Income StatementImpact Risk Score Ratio 23 24
- 13. © Grant Thornton LLP. All rights reserved. Other Analytics Solutions 25 ACCOUNTS PAYABLE Performs control analysis, proactive fraud testing through vendor risk ranking and cost recovery detection for the procure to pay process. 75 SCRIPTS REVENUE Identifies revenue transactions that indicate a higher risk of material misstatement as well as control analysis. 50 SCRIPTS P-CARD Identify risky P-Card transactions and usage behaviors. 30 SCRIPTS TRAVEL & EXPENSE Analyze travel and expense data to identify inappropriate or suspicious employee expenses, and manage T&E efforts. 20 SCRIPTS FCPA Third Party Vendor Risk-rank vendors by elements of risk that may result in a FCPA violation, individual vendor analysis and predictive analytics to predict transactions costs by vendor. 25 SCRIPTS Whole Ledger Analytics Dashboard WB58 25 26
- 14. Slide 26 WB58 after this slide, insert trending by month and benchmarking toolkit slide from WLA summit training? Wolohan, Brian, 5/13/2019
- 15. © Grant Thornton LLP. All rights reserved. Audit evidence from external data 27 Sales Correlates with: Client Website Traffic + App Usage Account Openings Correlate with: Web Search for Client Name + App Downloads © Grant Thornton LLP. All rights reserved. Benchmarking WLA for machine learning • Journal Statistic Examples • Average lines per journal • % of journals posted by day • Average income effect per journal • User Statistic Examples • Average entries per user per day • % of manual to automated entries • WLA Result Examples • Entries and line items by WLA report (e.g., round dollar journals) • Risk score average, median and standard deviation 28 27 28
- 16. Robotic Process Automation © Grant Thornton LLP. All rights reserved. Process Characteristics for RPA 30 29 30
- 17. © Grant Thornton LLP. All rights reserved. Example Target Functions and Process Areas Revenue Cycle Information Technology Procure to Pay Order to Cash Record to Report Supply Chain Insurance Authorization Datacenter Customer Master Gen. Acct. / Close Vendor Master CRM & Customer Service Network Operations Sourcing / Contract Management Reporting Credit / Contract Demand Management Charge Posting Security Admin. PO Process Order Process External Reporting Materials Management Training & Development Service Desk Goods Receipt Treasury Logistics / Delivery Capacity Flow Management Write-offs Desktop Support Invoice Process Billing / Disp. Res. Tax Transport & Logistics Performance Metrics Database Admin. Collections Payment Process FP & A Carrier Management Cash PostingApplications Cash Application Controllership T & E Returns Management Functions (L1) High level aggregations of company functionality Process Areas (L2) Bundles of processes that belong to the same area of responsibility Industry- Specific Ops In addition to the cross-industry functions listed at right, we find RPA opportunities in industry-specific processes such as loan servicing (Banks), claims processing (Insurance), rebates and tracings (Manufacturing), etc. Denials Management 31 © Grant Thornton LLP. All rights reserved. User Access Review Controls Grant Thornton automated user access control testing for the following attributes: • Whether access was approved by appropriate personnel • Whether the approval occurred within the required time frame • If the access is set to be revoked then the account is flagged for immediate attention and an alert is sent to the control owner. Human Resources Roles Validation The clients control stated that HR personnel with access to modify payroll information must also have a role assigned that prevents modification of their own payroll information. Grant Thornton automated this test to verify that all HR personnel are restricted from modifying their own payroll fields. SQL Database Backup Jobs Grant Thornton automated a test to verify that SQL jobs are in place to backup SQL databases on a regularly scheduled basis. This automated test also included tests for the following attributes: • The backup jobs are configured to backup the full database per the backup requirements • The backup alerts are set to notify personnel when a backup fails or is completed successfully • The alerts are configured to notify appropriate personnel Removal of Inactive SAP account access Grant Thornton automated a test for inactive SAP account access that is greater than the Company's specified threshold. Any account that has not accessed the system within this threshold is flagged for immediate attention and an alert is sent to the control owner for access to be removed. Control Automation Examples 32 31 32
- 18. © Grant Thornton LLP. All rights reserved. 33 Use Case Example User access review approval testing Business Benefits: Reduction in control testing time Increased assurance through test of control samples (can include 100% population testing) Auditor capacity shifted to handle more complex tasks & exceptions ICA Business Issue: Control testing that is time consuming (hours) and low value for management Import the testing population data Execute the test in R Clean the data in either MLS or R The data gets exported from MLS into a SQL database The data is visualized in a PowerBI report API Minimal human interaction © Grant Thornton LLP. All rights reserved. Changing the Nature of Risk Mgmt Before Adjustments to Microsoft Control (user access control): • User access for SAP sampled at 25 users per quarter, catching potential access issues every three months • Excessive time spent testing – 2 hours per control per year Automated control monitoring using advance analytics – efficient value protection Sample based control testing - basic risk management Partial Assurance Before 2 hours per control Value Protection After <5 minutes per control Manual Compliance Assessment Automated Compliance Monitoring After Adjustments to Microsoft Control (user access control): • SAP user access tested at 100%, in real time • Testing performed in seconds or minutes • Microsoft responds to user access problems in real time – as opposed to quarterly Pass / Fail Control 1 Pass Control 2 Pass Control 3 Pass Control 4 Fail Control 5 Pass Time savings of 95%+ per control – from risk mitigation to value protection Efficiency Value Protection Before After 34 33 34
- 19. Robotic Powered Auditing © Grant Thornton LLP. All rights reserved. Workflow automations 36 Example: property, plant and equipment Performs audit procedures: • Prepares fixed asset rollforward • Reconciles to general ledger • Recalculates depreciation expense • Identifies most efficient selection approach • Generates selection for test of details Scans for notable activity: • Disposals in ending sub ledger • Additions disposed of in the same year • Assets whose standard life deviates from the norm 35 36
- 20. © Grant Thornton LLP. All rights reserved. Employee Benefit Plan Loans Analyser Automating procedures over participant loans Data Receipt and Ingestion Receive the loans detail report from the Record Keeper Complete the "EBP Loans Tool - Data Request Form" Analytics Team cleanses the loan detail report and imports into ACL. Step one Step two Fill Out the Dialog Box Data fields are input in software dialog boxes Client specific variables are input into dialogs (ie. each participant in the Plan can only have 2 loans). Step three Run the Script / Export Results Software script is run Non-compliant participant loans are identified Dashboard in Excel acts as the engagement team workpaper. Step four Evaluate the Results Dashboard with notable items Investigation is performed and results are documented. 37 © Grant Thornton LLP. All rights reserved. Continuous automation 38 Example: confirming customer activity and balances Generated hundreds of confirmations in under 3 minutes • Extracted each customer's transaction and balance detail • Prepared and distributed e-mail confirmations • Provided customers with one-click confirmation option Processed responses automatically • Electronically logged replies to confirmations • Created automated workpapers Bespoke automation solution was designed, developed, and deployed in less than one week 37 38
- 21. People, Process and Technology © Grant Thornton LLP. All rights reserved. Auditor of the future skillset • Ability to reimagine the audit • Data analytics mindset Asking the right questions Extracting, transforming and loading relevant data Applying appropriate data analytics techniques Interpreting and sharing the results with stakeholders • Critical thinking (questioning mind, weighing evidence) • Communication: • Interaction with a team and with the client (asking the right question and listening) • Writing – communication of facts and articulation of persuasive argument • Ability to collaborate with people of different geographies and varying skill sets • Selling new innovation / change management 40 39 40
- 22. © Grant Thornton LLP. All rights reserved. Desired analytic-enabled auditor skills • Analytics mindset • Analytic technical skills • Data management and acquisition • Database modeling • Tool development and programming • Predictive modeling and statistics • Other Skills • IT project management 41 © Grant Thornton LLP. All rights reserved. Robotic Process Automation Limitations RPA cannot read any data that is non-electronic with unstructured inputs • An example would be input such as paper invoices. In this case, RPA will only work with a collection of other implemented technologies (such as OCR) required to make it digital and structured. RPA requires some form of static consistency • For example, invoices may be received in different formats, with fields placed in different areas. For a ‘Bot’ to be able to read an invoice, all supplier invoices must be received in the same format with the same fields. • Although robots can be trained by exception to read different fields, they cannot read multiple different formats – unless these are all digital and configured separately. 42 41 42
- 23. © Grant Thornton LLP. All rights reserved. Robotic Process Automation Limitations RPA is not a cognitive computing solution • It cannot learn from experience and therefore has a ‘shelf life’. • As processes evolve – for example, through the introduction and use of other technologies — they may become redundant and require changes. • It is therefore wise for a company to examine the process prior to building a ‘Bot’. Applied to a process that is inefficient and/or on the way out, that shelf life may be reduced to just a year. Applying RPA to an inefficient process will not fix it – "paving cowpaths" • RPA is not a Business Process Management solution and does not bring an end-to-end process view • The same goes for out of date infrastructure – RPA will only mask the underlying issues. • Clients should focus first on addressing the root causes of their process or technology inefficiencies and then apply RPA to maximize the benefits. 43 © Grant Thornton LLP. All rights reserved. Start with what you have Your data can be a rich source of insights and business intelligence. Inexpensive tools can be used to get started in analyzing this data. Ask for help. There is no need to go it alone; we love solving problems and helping clients to innovate. Having innovative clients helps us to innovate and create even more value. It’s a virtuous cycle. Lessons Learned 44 Demonstrate value early and often. Smaller wins can fund bigger wins and help foster institutional momentum. 43 44
- 24. © Grant Thornton LLP. All rights reserved. Questions 45 © Grant Thornton LLP. All rights reserved. AuditNet® and cRisk Academy 46 • If you would like forever access to this webinar recording • If you are watching the recording, and would like to obtain CPE credit for this webinar • Previous AuditNet® webinars are also available on-demand for CPE credit http://criskacademy.com http://ondemand.criskacademy.com Use coupon code: 50OFF for a discount on this webinar for one week 45 46
- 25. © Grant Thornton LLP. All rights reserved. Thank You! 47 Jim Kaplan AuditNet® LLC 1-800-385-1625 Email: [email protected] www.auditnet.org Richard B. Lanza, CPA, CFE, CGMA Contact Information D: +1 732 516 5527 M: +1 732 331 3494 Email: [email protected] 47