Mission Risk & Internal Control The New Normal November 18, 2015 Derek Davison derek.davison10@gmail.com 703.798.1944 Tashu Trivedi ttrivedi@tfcci.net 301.792.2401

Introductions Tashu Trivedi, President and CEO, TFC Consulting, Inc. Over 23 years of Federal audit and financial management experience Former KPMG senior audit manager Extensive knowledge of OMB and GAO internal control requirements Chair of AGA’s CPAG Small Business Committee Derek Davison, Owner, DLD Consulting, Inc. 15 years of Federal and commercial financial modeling and risk analytics experience Modeled and analyzed over $2.5 Trillion in Federal assets and guarantees Regularly works in highly scrutinized environments Former Director of Development of FI Consulting

Session Objectives Discuss overall trends in risk management & internal control Demonstrate and improve awareness of analysis techniques Demonstrate tools and data that could become part of the solution

Current Trends in Internal Control Shift from financial risk to mission risk Emphasis on ERM approach More emphasis on fraud, waste, and abuse More data analytics and continuous monitoring required Democratization of data Downward budget pressures (Do more with less)

Overall Movement Towards Mission Risk COSO 1992: Internal Control–Integrated Framework Leading internal controls framework Periodically updated (most recently in 2013) (Likely) OMB A-123 Revisions Based on COSO and the UK Orange Book Require ERM approach Emphasize portfolio of risks that effect mission not just financial risk State and Local Governments Many state and local governments have already adopted COSO or implemented similar ERM solutions

What is Mission Risk? Financial Risk Credit Risk Operations Risk Reputation Risk Cyber Security Risk Privacy Risk Fraud, Waste, Abuse Risk Program Risk Market Risk Technology Risk Disaster Risk All Other Risks Consists of all risks, both positive or negative, that effects the ability of an entity to achieve its objectives. Should be viewed as a portfolio of risks Better understand interconnectedness between risks

COSO Framework Control Environment Risk Assessment Control Activities Information & Communication Monitoring Activities

Analytical Techniques Continuous Monitoring/Dashboards Heat Maps Geospatial & Multiple Data Forms Time Maps Network Visualizations Sentiment Analysis

Analysis Tools MS Excel 2013 R Software R Studio Google MyMaps Analytics and data capabilities significantly enhanced PowerMaps R Software Open source software environment for statistical computing and graphics Thousands of free analytical and data visualization packages https://www.r-project.org/ R Studio Open source Integrated Development Environment (IDE) Makes it easy to develop, share, and scale R projects https://www.rstudio.com/ Google MyMaps Open source custom google maps https://www.google.com/maps/d/

Analysis Data Data.gov Open Baltimore Goal is to improve public access to high value, machine readable public datasets 188,952 distinct datasets Many apps use this data http://www.data.gov/ Open Baltimore Goal is to provide the public access to city data in an effort that supports transparency, openness, and innovation. 110 distinct datasets https://data.baltimorecity.gov/

Open Source Software Widely used software made available with a public license Often developed in a collaborative public manner Same security concerns as proprietary software 18F - Analytical use in Federal Government https://calc.gsa.gov/

Open Source Software

What is Continuous Monitoring? There is no standard definition of Continuous Controls Monitoring; The following includes the common themes among the definitions… “Continuous controls monitoring is a set of technologies and processes to detect risk and compliance issues through continuous monitoring and reduce the cost of audits through continuous auditing of the controls in financial and other transactional applications.” Dashboards!

What is Continuous Monitoring?

What is Continuous Monitoring?

What is Continuous Monitoring?

What are Heat Maps? A heat map is a graphical representation of data where the individual values are represented as colors. Quickly Analyze Data Facilitates Communication Risk Analysis Continuous Monitoring Others?

What is Geospatial Analysis? MAPS! MAPS! MAPS! Tabular geospatial data typically has no meaning Plotting on a map can yield valuable insights

What are Time Maps? Data visualizations that allows the analysis of discrete events

What are Time Maps? Credit Card Data Transactional Data Timesheet Data Badging Data IP Data Access Data Social Media Data Program Data Others?

What are Network Visualizations? A network is any collection of items in which pairs of these items are connected in some manner. Homophily (pronounced HOME-ah-filly) is the propensity of network members to select connections with other members who have similar characteristics Program Data Vendor Data IP Data People Relationships

What is Sentiment Analysis? Sentiment analysis (also known as opinion mining) refers to the use of natural language processing, text analysis and computational linguistics to identify and extract subjective information in source materials.

Session Objectives - Wrapup Discuss overall trends in internal controls Demonstrate and improve awareness of analysis techniques Demonstrate tools and data that could become part of the solution

Questions

Useful Links Presentation Data and Tools Search over 185,000 data.gov datasets: http://catalog.data.gov/dataset Search data.gov apps: http://www.data.gov/applications?q=&currentpage=1 Open Baltimore datasets: https://data.baltimorecity.gov/ Download R Software: https://www.r-project.org/ Download R Studio: https://www.rstudio.com/ Take Free Online R Training: https://www.coursera.org/course/rprog Open custom google maps: https://www.google.com/maps/d/ Quickly search GSA rates across multiple firms, schedules, and labor categories. 18F GSA Calc Tool: https://calc.gsa.gov/ Continuous Monitoring Examples Real-time statistics and visualizations on popular R package downloads: https://gallery.shinyapps.io/087-crandash Real-time statistics on Federal website usage: https://analytics.usa.gov/ Heat, Geospatial, and Time Map Examples Treasury’s Financial Stability Monitor: http://financialresearch.gov/financial-stability-monitor/ Baltimore towing (all towing, holiday towing, stolen-car towing: https://www.youtube.com/watch?v=Pts-4GQnTyg Baltimore Murals (includes photos): https://www.google.com/maps/d/u/0/viewer?mid=zxL9m1fOOEiI.kBRydVaqsJvs Time maps of Baltimore towing company behavior: http://rpubs.com/vadimus/bmore_tow_time_maps Network Visualizations and Cluster Analysis Examples Network Visualizations of Baltimore City Agencies and Vendors: http://rpubs.com/vadimus/baltimore_network Sentiment Analysis and Text Mining Examples Government Fraud, Waste, and Abuse News Story search and analysis: https://vadimus202.shinyapps.io/Govt_Fraud