Impact of Shared Services on Internal Audit Deryck Fuller, Mike Cappetta, Melissa Paulson October 24, 2013

Agenda Our Audit Universe Risk Assessment Process Case Studies Benefits of Shared Services Keys to success

3 MGM Resorts International – A Brief History 1993 MGM Grand: The City of Entertainment 1998 ACQUISITION 1: New York Primm ValleyBuffalo Bill’s Whiskey Pete’s 2000 ACQUISITION 2: BellagioThe Mirage Treasure Island Boardwalk Golden Nugget Beau Rivage Golden Nugget – Laughlin MGM Grand- Darwin, Australia MGM Grand- Detroit 2005 ACQUISITION 3: Mandalay BayExcalibur LuxorGold Strike Colorado Belle EdgewaterCircus Circus Circus Reno Gold Strike Tunica Slots-A-FunRail Road Pass Monte Carlo Nevada Landing City Center Divested

Risk Assessment Process Company Wide Risk Assessment Business Process Risk Assessment

Risk Assessment Process How often do you perform risk assessments? How do you gain comfort with controls over financial reporting by testing a single process? How do you determine business units to test in a shared services environment? How do you determine sample selections in a shared services environment?

Key Questions for Shared Service Audits Does my audit universe need to be redefined? How can I better define my audits in the new environment? How should I reassess my audit strategy on an ongoing basis? Do the controls now reside at the SSC or are they still in the business units? How much coverage can I get as a result of auditing at the center? Do I need to audit only at the SSC? How does an SSC affect sample size and sample selection when one moves from a decentralized environment to a shared environment? Are the processes and templates used across the SSC consistent? Do work-arounds proliferate? Can I use automation in the audit process more effectively now that I am auditing in an SSC environment? Source : PWC

Business Process Audits (Case Studies) Accounts Payable Revenue Accounting General Accounting

Accounts Payable Do the controls now reside at the SSC or are they still in the business units? Do I need to audit only at the SSC? How much coverage can I get as a result of auditing at the center? Are the processes and templates used across the SSC consistent? Does this impact sample size?

Revenue Accounting Do the controls now reside at the SSC or are they still in the business units? How much coverage can I get as a result of auditing at the center?

General Accounting How much coverage can I get as a result of auditing at the center? Are the processes and templates used across the SSC consistent?

Benefit of Shared Services

Keys to success Understand new technologies implemented Add value by identifying process improvements Early involvement –Steering committee –Milestone reviews Reassess audit strategy on an ongoing basis Don’t fall into the SALY trap

Thank you!