1. Experiences & Benefits of ACL
Peter Dean, Director, Business Intelligence and Strategy Ltd
Robin Clough, ACDA, Managing Director and ACL Certified Master Trainer, DataConsulting Ltd

2. Who are we? Peter Dean, Managing Director of BIAS
KPMG Audit, Alliance & Leicester plc, CFO
Business intelligence & data strategy expertise
Aviation Sector specialist combined with strong audit & finance experience
ACL Reseller with a focus for developing best practice technology solutions to the sector
Passion for Audit Analytics incorporating dashboard and KPI metrics to support the internal audit process
ACL is committed to innovation and has worked side-by-side with the internal audit profession to evolve with changing business needs for 24 years.
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

3. And Robin Clough, Managing Director of DataConsulting
Certified ACL trainer
Founder of DataConsulting, authorised UK ACL distributor
Formerly PwC, Deloitte
ACL user for 17 years
Focused on helping clients to get more from ACL products
ACL is committed to innovation and has worked side-by-side with the internal audit profession to evolve with changing business needs for 24 years.
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

4. In addition, it’s important to remember that there are a lot of practical steps that need to take place, but not just in terms of technology, also relating to people and process.
Auditors worldwide have achieved a lot of success with ACL desktop software – at least in the early stages of the audit analytics continuum. We also know that there are specific software technologies and capabilities that are needed to progress to the later stages. That is why we have developed - and continue to enhance - ACL AuditExchange as a managed audit analytics platform – with all its various components that address the stages of the capability or maturity model.
What is also very clear to us however, is that technology alone does not provide the greater benefits. There are many things relating to people and process that need to be in place to achieve success and optimised benefits.
Think in Terms of Data

5. Stronger Together: Our Insights for Today
The ACL Story (Robin)
Your Strategic Positioning & Roadmap (Robin)
Tips For Moving Forward (Peter)
Customer Experiences (Peter)
Summary & Questions (Peter & Robin)
ACL is committed to innovation and has worked side-by-side with the internal audit profession to evolve with changing business needs for 24 years.
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

6. The ACL Story
2011
ACL releases the ACL Audit Analytic Capability Model and AX3
2008
ACL implements Enterprise CCM for Purchase to Pay at Siemens AG globally
Release of ACL AuditExchange: a managed analytics platform and continuous auditing solution
2009
ACL releases AX2, the Business Assurance Platform to enable greater depth of analysis, and enhance productivity
2000 – 2002
ACL delivers first customized continuous auditing and monitoring applications for specific business processes
ACL implements CCM products for 6 core business processes at wide range of clients
Auditors increasingly automate use of ACL for data analysis and implement regularly repeated applications
First Interactive Audit Command Language
First PC-based audit analytics software
First Windows-based audit analytics software
First network-based audit analytics software
First server-based audit analytics software
First Continuous Controls Monitoring software solution
First managed analytics platform for audit: interactive, repeatable and continuous
First Business Assurance platform
First Capability Model designed to guide organizations through levels of using audit analytics
2003
ACL launches 1st Continuous Controls Monitoring (CCM) product suite

7. ACL solutions are available:
The ACL Story cont..
CANADA
UNITED STATES
ACL solutions are available:
In local languages
Through a global network of ACL offices and Certified Partners
ACL has a direct sales in both North America and France, and is represented worldwide through an extended network of distribution partners to ensure that globally we can deliver first class service to our growing client base.
This ensures that all users have access to the same high-standard of pre-sales assistance, product knowledge, and technical support – in any of the multiple languages ACL supports.
Argentina
Australia
Austria
Bahrain
Benelux
Bulgaria
Canada
China
Cyprus
Ecuador
Egypt
Finland
France
Germany
Greece
Hong Kong
India
Ireland
Israel
Italy
Japan
Jordan
Kuwait
Lebanon
Nordics
Oman
Paraguay
Poland
Portugal
Qatar
Russia
Saudi Arabia
Singapore
South Africa
South Korea
Spain
Taiwan
Turkey
UAE
United Kingdom
United States
Uruguay 7

8. Your Strategic Positioning & Roadmap
Audit Analytic Capability Model
Codified based on 20+ years of experience
14,000 customer organizations worldwide
Reviewed by Big Four partners
Covers the full spectrum of audit analytics needs
Will lead to an evaluation tool for our customers
ACL is committed to innovation and has worked side-by-side with the internal audit profession to evolve with changing business needs for 24 years.
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

9. The ACL Audit Analytic Capability Model
ad hoc
repetitive
continuous
Audit Contribution
Hindsight
Insight
Foresight
Level 2
Applied
Level 3
Managed
Level 4
Automated
Level 5
Monitoring
Level 1
Basic
Here is a simple overview of ACL’s audit analytic capability model.
Some of you will have heard us speak in the past about the continuum of the use of audit analytics and the 3 levels of use: ad hoc, repeated and continuous.
The new model is an evolution of the continuum concept and includes 5 different stages: Basic, Applied, Managed, Automated and Monitoring.
I think it is interesting to note that the 5 levels tend to align well with the ideas of the various levels of contribution that internal audit can make to an organization. You may have heard Richard Chambers – President of the IIA – talk about this at IIA conferences.
The Y axis on this graph refers to hindsight, insight and foresight.
The traditional audit approach tended to be a historic - or hindsight - view of what happened over a period of time. Audit data analysis certainly has an important role to play in this.
As we move to more comprehensive analytics – well managed and integrated closely into the audit process – data analysis provides significant insight into risks and controls – at a level that is not possible without such technology. It begins to provide greater contribution by internal audit by, for example, identifying detailed instances of risk, fraud, error and abuse.
As organizations move into greater automation and continuous auditing and monitoring, audit analytics provide the ability to detect trends in audit and control issues that start to provide foresight into increasing or changing risks within business and financial control processes.
One of the reasons we developed this model is that many organizations have understood the benefits of automated continuous auditing and monitoring and want to move there immediately. However, without the building blocks of the lower levels in place – in terms of people, process and technology issues – it is very difficult to achieve the intended benefits
Sophistication

10. Level 1: Basic Characteristics Benefits Audit-specific technology
Ad hoc query and analysis
Used to perform analysis of large data sets
Benefits
Rapid insight into entire data populations
Increased ability to detect fraud, errors and inefficiencies
Increased audit quality and assurance
Lets start by looking at the first Basic level.
I am sure all of you are aware of how audit specific analytic technology allows query and analysis of very large data sets in support of an audit objective.
This often starts with producing statistical overviews and classifications or summarisations of data in order to identify anomalies and to better understand the transactions and balances within a specific area
Obvious problems, such as duplicate payments, are easily identified
Such use tends to be ad hoc and relatively unplanned
The benefits include the increased assurance obtained from looking at 100% populations of data, identifying indicators of fraud and errors, and from doing so very quickly and efficiently, compared to traditional manual processes

11. Level 2: Applied Characteristics Benefits
Analytics fully integrated into audit process
Comprehensive suite of repeatable tests are designed and developed
Applied to a range of audit and control objectives
Benefits
Gain greater insight into targeted audit areas
Improved quality and reliability of tests
Improve audit efficiency and effectiveness
Level 2 – what we call the Applied level – builds upon the 1st, but is actually very distinct.
At this level analytics are fully integrated into the audit process and begin to transform how audit is performed
This means that audit planning and design of an audit program takes analytics into account – effectively creating an “analytic enabled audit program” in which, wherever beneficial and practical, an audit step or objective is achieved with the help of a specific analytic test
A full suite of repeatable tests is built in order to support an entire audit area
At this level, people and process issues begin to be increasingly important
Audit management needs to give direction and support the change in audit processes.
Typically a specialist is assigned the role of dealing with data access issues and designing and developing analytic procedures
After starting with “low hanging fruit”, over time, usage tends to be progressive as additional tests are added to support more audit objectives
As audit analytic usage becomes far greater, and wider in scope, the benefits also increase. At this level the focus around roles and processes mean that analytics improve in quality and become more reliable.
As usage at this level becomes optimized the audit process becomes increasingly efficient. Not only can many tasks be performed in a fraction of the time previously taken, audit work can focus on areas of greater risk
For example, lets take a payroll audit: lets say an analysis is performed centrally of all payroll transactions for all North American locations of a business. This analysis looks for unusual pay rates, amounts of overtime and bonuses. If one area is shown to have a high instance of anomalies and all other regions adhere to a norm, then it may be that procedures can focus on the one location and travel and audit costs substantially reduced.
I am sure there are many organizations represented here today who are somewhere around this level – probably more advanced in some audit areas than others. This is a typical level for the majority of our customer organizations.
Who would say that they are fully at this level? Who is working towards this level? Who is ahead of this level?

12. Level 3: Managed Characteristics Benefits
Centralized or local processing
Secure environment to store data
Audit analytic content shared within the team
Benefits
Manage all audit analytic content in one secure place
Do more with faster analysis
Risk mitigation / sustainability
The next , 3rd, level is one we call Managed
Level 2 involved development of many analytic tests, using many different data sets - probably some very large and involving confidential data – as well as many different sets of results. It is likely that many people were involved in this process and that all of this information was spread across various computers, with varying amounts of duplication of effort. It is not hard to understand that there are a number of challenges and risks of potential inefficiencies, difficulties in performing management review and limited security in such a decentralised environment. Perhaps as well, large and complex analyses are being performed on laptops or LAN’s and tying up computers for hours while processing is performed.
The objective at this level is to manage the audit analytic content and processes in an efficient and well controlled way. The objective is to achieve team based data analysis, in which data and processing is centralised, secure and efficient.
At this level, there are a number of people, process and technology issues to consider. Access to the central repository needs to be well managed and controlled, taking account of security and control issues. An administrator is typically appointed. Changes to tests and analytics should be QA’d.
This level further improves the efficiency and the quality of the audit analytics process. One of the key benefits of this level is also that of making the whole process more sustainable, reducing the risks of relying on individual specialists who may leave taking a lot of knowledge with them. Everything is centralised in a way that makes review by management easier and more efficient
This level is also a very important building block in getting to the next level.

13. Level 4: Automated Characteristics Benefits
Recurring and scheduled analysis
Audit processes change from cyclical to continuous
A broader set of the audit team applying analytics across the audit process
Benefits
Achieve timely insight into audit and control issues
Improve audit team efficiency through automation
Audit scope increased through multiple concurrent auditing
Once we have a comprehensive suite of tests developed and well managed, we are ready to move ahead with increasing automation and running of analytics on a regularly recurring scheduled basis.
Now much is in place from a technology perspective to begin continuous auditing. To be effective, continuous auditing itself involves some fundamental changes in audit processes. A traditional cyclical audit has a clearly defined time frame, a beginning and then an end in which an audit report is produced. A continuous audit is different in that the processes for running tests, reviewing and reporting on results are ongoing. Clearly roles and responsibilities for perfomring continuous auditing are going to be different than for a traditional cyclic approach.
Instead of performing, say, 2 or 3 audits in a given timeframe, internal audit can now be auditing, say, 5 or 6, areas concurrently, as well as focusing on specific areas of risk. Efforts are focused where needed and routine audit work reduced.
Because of the degree of automation now involved, everything from data access to processing and distribution of results, it becomes more practical to involve a broader set of non-technical auditors into the analytic process – either running tests or using the automatically generated results
The benefits can be very significant – starting with the ability to get insight into audit and control issues as they arise. This allows more timely response.
It also means that with a high degree of automation, audit team efficiency is increased. Auditors can review the results of continuous automated procedures for multiple audit areas and only respond when needed. This allows many routine areas for audit to be heavily automated and resources freed up to focus on other areas of risk and concern.

14. Level 5: Monitoring Characteristics Benefits
Exceptions routed to business process owners for review and remediation
Reporting and monitoring of the results and trends identified
Increased use of audit analytics across the organization
Benefits
Develop a partnership with business process owners to provide insight into their operational performance
Achieve timely resolution of exceptions
Provide the organization with a clearer picture of risks in business processes
With all of the building blocks in place at level 4, the next step is a logical one. If audit is regularly producing reports on control problems and potential instances of error, fraud or compliance failures – then it usually makes sense to involve business process owners more directly and notify the appropriate individuals immediately of exceptions as they occur so that an appropriate response can be made.
At this level the results of widespread testing can be accumulated and reported in order to show trends of risk areas and changing risks where, for example, a pattern of an increasing number of a certain type of exceptions becomes obvious.
Internal audit is often in the best position to demonstrate to business process management the practical value of audit analytics to detect control problems and improve operational performance. By encouraging and supporting the implementation of continuous monitoring, the benefits of audit analytic techniques become obvious to a wider audience and start to become applied within the business. It is not unusual to hear a business process owner comment that they had been looking for some form of exception reporting system that provides greater insight into operational performance and are surprised when audit can provide or demonstrate such capabilities.
The ability to identify and quickly resolve exceptions such as fraud, error and abuse has a clear value and can provide a quantified benefit to the business.
Continuous monitoring can also become an important component within an organizations risk management processes, helping to provide business with a clearer picture of risks issues and trends.

15. Technology for AACM ACL Desktop AX Core AX Gateway & MS Add-ins
Direct Link
AX Datasource
AX Exception
AX Gateway & MS Add-ins
1. Basic
2. Applied
3. Managed
4. Automated
5. Monitoring
With all of the building blocks in place at level 4, the next step is a logical one. If audit is regularly producing reports on control problems and potential instances of error, fraud or compliance failures – then it usually makes sense to involve business process owners more directly and notify the appropriate individuals immediately of exceptions as they occur so that an appropriate response can be made.
At this level the results of widespread testing can be accumulated and reported in order to show trends of risk areas and changing risks where, for example, a pattern of an increasing number of a certain type of exceptions becomes obvious.
Internal audit is often in the best position to demonstrate to business process management the practical value of audit analytics to detect control problems and improve operational performance. By encouraging and supporting the implementation of continuous monitoring, the benefits of audit analytic techniques become obvious to a wider audience and start to become applied within the business. It is not unusual to hear a business process owner comment that they had been looking for some form of exception reporting system that provides greater insight into operational performance and are surprised when audit can provide or demonstrate such capabilities.
The ability to identify and quickly resolve exceptions such as fraud, error and abuse has a clear value and can provide a quantified benefit to the business.
Continuous monitoring can also become an important component within an organizations risk management processes, helping to provide business with a clearer picture of risks issues and trends.

16. The ACL Software Family
Automation – Built-in Analytic Scheduler
Server Analytic Processing Power
Content Management – Any File Types
Access virtually any data source and automate data feeds
Enterprise Data
SQL
ERP
Basic & Applied
Managed
Automated
Monitoring
Data Access
Components
ACL D/B Interfaces
ACL is committed to innovation and has worked side-by-side with the internal audit profession to evolve with changing business needs for 24 years.
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

17. We have heard a lot in the past few years about the increasing expectations placed on internal audit and the importance of technology - specifically audit analytics – to help audit achieve its goals.
We reviewed the Model with a number of the Big 4 and firms such as Protiviti – all of whom have responded positively.
We believe that this model will help our customers evaluate where they are in their use of analytics and to better understand what needs to be done to achieve more benefits and success.
It’s a Journey

18. Start Planning the Journey : Tips for Moving Forward
Access where you are and where you would like to be
Begin to plan your strategy & scope
People, processes, technology & data
Identify current resource requirements
Target labour intensive areas
Track progress against plan
Communicate
Level 2
Applied
Level 3
Managed
Level 4
Automated
Level 5
Monitoring
Level 1
Basic
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

19. The Audit Management Role : Making CA/CM a reality
Create the Roadmap
Basic – Encourage experimentation with key data
Applied – Integrate analytics as part of audit planning
Managed – Facilitate server technology
Automated – Realign methodology (100% Data Coverage)
Continuous – Integrate with wider business departments
Build the culture for a sustainable project
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

20. Sharing Best Practice : IAAIA Workshops
The process has already started
2010 : E Ticketing Audit Work Program
2011 : Station, ERM & Continuous Audit workshops
Challenges & Benefits are being shared
Dashboards with Fraud & Risk Metrics being developed
Technology and data considerations….
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

21. Key Technology & Data Considerations
Understand the data scope, availability & ownership
Do not forget ‘orphaned’ data (e.g. Cards, website etc)
IA /IT roles and responsibilities (data structures & access)
100% transactional data? Data integration responsibility?
Align Risk Metrics, Audit Plans and Data – which order?
Assess ROI quick wins (resource, critical, potential savings)
Identify Audit Analytics technology & scripting capabilities
Start small and build incrementally on success
What have others done …?
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

22. Customer Case Study: Continuous Auditing Hawaiian Airlines
Objectives
Benefits
Implement a server based business assurance platform to draw large data volumes from numerous, disparate systems.
Enable several auditors to work with data analytics and continuous auditing projects – without the risk of creating multiple file versions, security issues or data overwrites.
Enhance audits reputation and ensure buy-in on continuous auditing from senior management.
Reduce the time required to complete projects by approximately 99% with automation.
Gain 100% data coverage, which significantly reduces the incidence of improper flight benefit usage.
Achieve a measurable, monetary ROI by using trend-based analytics and automated continuous auditing routines.

23. Customer Case Study: Continuous Auditing Hawaiian Airlines
The ACL AuditExchange solution is paying for itself in time savings alone. It will continue to deliver value as we implement continuous monitoring throughout the organization.
Mark Curnow
Manager, Corporate Audit, Hawaiian Airlines

24. The internal time savings is huge, with team members estimating that this process alone is paying for the cost of the AuditExchange technology.
Mark Curnow, Manager, Corporate Audit
Hawaiian Airlines

25. Customer Case Study: Applied Analytics Emirates
Achievements
Deeper, more thorough data analysis with higher quality results and a standardized reporting format
Continuous monitoring that quickly identifies exceptions and control gaps, and provides greater business assurance
Targeted analysis that can automatically be conducted across disparate corporate systems and data formats
Dramatically less time required to extract, prepare, format and generate information for audits – in some cases, several weeks worth of labour has been cut to 10 minutes or less
Fewer manual errors and omissions with complete data coverage, rather than random sampling

26. Customer Case Study: Applied Anaytics Emirates
It can be said that ACL is the ‘Genie’ that is producing magical results for Emirates Internal Audit.
Kalpesh S Vashi
Information Systems Audit Manager, Emirates

27. We can help you be “Stronger Together”
Aim to deliver demonstrable ROI and value-added through people, processes, technology and DATA
People – Knowledge transfer, training, post- implementation reviews and on-going support
Processes – Understand the business, risk and constraints
Technology – share, advise, implement and support sector focused solutions
DATA – The key to a successful Audit Analytics strategy is understanding the integration of all the relevant data fields and sources
ACL is committed to innovation and has worked side-by-side with the internal audit profession to evolve with changing business needs for 24 years.
Working closely with many of our 14,700 customer organizations worldwide, we’ve learned of customers who have achieved great benefits from the use of audit analytics, as well as those who have not managed to make the progress that they had hoped to achieve
Customers unsure of where they are today
Customers unsure of where they want to be
Customers unsure of how to get there
To address these challenges, we used our experience to develop an Audit Analytic Capability Model that identifies the benefits of different levels of use of audit analytics, as well as the things that need to be in place - from a people, process and technology perspective - in order to optimize these benefits.

28. Summary
ACL Services is a technology solution provider uniquely built around the needs of audit and compliance professionals.
ACL and their global partner network offers organisations a way to leverage their existing compliance and audit analytic activities for improved business performance and increased efficiency.
ACL solves audit’s challenges with a combination of market leading software, services and analytics that streamline audit processes.
Internal audit’s role in the organization is changing and the profile of their work is increasing. ACL solutions scale to the increased demands facing auditors and enable them to deliver better insights into the business.
24+ years of experience
14,700+ customer organizations worldwide
Covers the full spectrum of audit analytic needs

29. Your Trusted Partner for Audit Analytics