ACL User Conference New York City June 8th, 2009

Welcome and Opening Remarks Lunch | Roundtables | Networking New York: Monday, June 8 7:30 a.m. - 8:30 a.m. Breakfast | Registration | Networking 8:30 a.m. - 8:45 a.m. Welcome and Opening Remarks 8:45 a.m. - 9:45 a.m. The Road to Continuous Assurance: A Team's Transition from Audit to Continuous Controls Monitoring Jason A. Gross, CPA, CIA, CFE, CISA, ACDA Vice President Controls Management Siemens Financial Services 9:45 a.m. - 10:15 a.m. Break | Networking 10:15 a.m. - 11:15 a.m. Gaining Audit Assurance: Continuous Audit Techniques with ACL David Toussas, CISA, Director IT Audit Tiffany & Co. 11:15 a.m. - 12:30 p.m. ACL Impact Award Winner 12:30 p.m. - 1:30 p.m. Lunch | Roundtables | Networking 1:30 p.m. - 3:30 p.m. Workshop: Advanced Techniques to Improve Audit Efficiency Michael Keiffer, CPA, CIA, CISA, CTA, ACDA ACL Certified Master Trainer Workshop: Continuous Auditing & Monitoring with ACL Dustin Lewis, CISA, ACDA Senior Technology Consultant, ACL Services Ltd. 3:30 p.m. - 4:00 p.m. 4:00 p.m. - 5:00 p.m. ACL Use it or Lose It: Benchmarking Workshop Facilitated by Steve Biskie, CPA, CITP, CISA Best Practices Director, ACL Services Ltd. 5:00 p.m. - 7:00 p.m. Cocktail Reception

The Road to Continuous Assurance by Jason Gross Control Management versus Internal Audit No longer independent Actively participates in the business decisions Become more of the event driver towards continuous monitoring

In Order To Succeed… Obtain support & commitment from Audit Committee and Management Continuous Auditing should complement the Audit Plan Start small; build from success Automate/leverage from well-defined periodic audits Gain reliance by external auditors and add value

Technology Tools… Optimize current data analytic scripts and schedule routines on a ‘continual’ basis’ Obtain direct access to the data Cultivate core team of skilled auditors using technology for data extraction and analysis

Continuous Audit Techniques with ACL by David Toussas No little blue box under our chairs Interesting overview of the history of the company The evolution of using ACL in their business Overcoming the challenges/access to data Get buy-in

Evolution of ACL at Tiffany 2001: Created A/P Testing Module in ACL 2003: Initial Attempt at Continuous Audit 2003: Identified Issue in Production Report 2004: Utilized U.S. Sales Data Warehouse 2005: Enhanced Post Void Testing 2005: Travel & Entertainment (cash advances)

Challenges they faced Staffing Sustainability Turnover in the SOX-Era has been challenging Limited resources with technical skills Sustainability Data exists on various platforms and databases Majority of time spent developing/running queries Staff is uncomfortable downloading/importing

What they did about it New Goals Implement Centralized repository for data gathering Consistently refresh data Ability to control changes to ACL Modules Expand Continuous Audit into International Retail Identify additional projects Implement Upgrade ACL Server to ACL AuditExchange

Impact Award Winners Manuel Coello - Stanley Works North American Winner Continuous Monitoring using ACL and their successes David T. Miod - United States Air force Overall winner Cost reductions in the millions if not billion+

Manuel Coello - Stanley Works

Smorgageboard of ACL Uses Travel Improvement Event Contracts Improvement Event GPC Improvement Event Supply Improvement Event AVPOL Improvement Event Reimbursements Improvement Event All with dollar savings in the millions

Continuous Auditing and Assurance By Dustin Lewis – ACL Do ad hoc first then automate Early wins/high risk areas Analytic Essentials (for Audit Exchange Only) Run Verify Comment tricks End of blank line ends comments Making font bigger (or smaller) Example of cleaning up files All commands in upper case Use of permanent variables (_status) Set Debug?

Benchmarking Workshop Use it or lose it Must not have been too eventful for me Each table had ½ hour to come up with ACL application ideas that was unique ½ hour to share our ideas Mine was duplicate reporting – first thing facilitator said was no dup reporting ideas since everyone has one. Our table wasn’t picked Last item on the agenda before cocktail hour