Internal Auditing: The 24/7 Approach

The time it takes to roll out such a system is surprisingly short. With the purchase-card module, Kennedy says, developing business requirements and data analytics, having ACL integrate them into its program, and creating business processes for implementing the system took about three months.

Tracking What Counts Most
Last fall, Siemens Financial Services Inc., the U.S. arm of the global financial services firm, was just starting to institute continuous auditing, rather than performing tests every one to three years (depending on the risk level of the thing being audited).

But Jason Gross, who was running the internal audit department, found that he could not go as far as he liked in designing controls for the processes being audited. That was because of the expectation by the audit committee of parent company Siemens AG that auditors be arms-length from the activities they're reviewing as well independent from management. If he were to design audit controls, he would then be participating in the management of the company rather than simply using existing controls to perform an audit. That would go beyond the proper purview of internal audit, as viewed by the Siemens AG audit committee. 

So in October the company formed a new department alongside internal audit, called controls management, with Gross in charge as vice president. He created a continuous-controls-monitoring system, which runs every night and uses many of the same elements he'd been working on for continuous auditing.

The difference between internal auditing and controls management, Gross notes, is in the level of granularity. "We're down at the data level, looking transaction by transaction, where typically an audit, depending on its objective, might just review a process and not get as deep into the data details," he says.

But it's the primary focus of the effort that draws interest. "I think we stand out a little bit, because a lot of the buzz you hear about continuous monitoring relates to generic processes such as travel and entertainment and purchase to pay," Gross tells CFO.com. "But we're monitoring our financial services business by developing the program from the ground up, because there was no package we could go out and buy to do that."

What's being monitored, essentially, is "everything that determines the value of a financial asset," says Gross's boss, Matthias Grossmann, CFO of the U.S. financial services unit, which provides financing for healthcare, energy, and industrial companies and manages $6 billion to $7 billion in assets. "Number one, of course, is information on your obligors. Is the entity migrating to different risk classes? Is there the normal underlying collateral? Do any inconsistencies show up?"

The decision to launch the controls-management department and put the focus on continuously monitoring the financial services operation was an easy one, Grossmann notes. "When we did audits using these techniques, we always found something," he says. "So we thought we could use them in our daily business, using technology we already had that was coming from a different angle. So far it looks good, and I hope we can expand it."

Gross says that, in fact, continuously monitoring controls not only can detect problems but can do so before they've happened. When the company is preparing a new lease financing contract, for example, all elements relating to the transaction and borrower are loaded into the system before the contract is finalized, which can turn up "data mismatches," he notes.

• « previous
• 1
• 2

LinkedIn Company Connections:

• ACL |
• Microsoft |
• Idea |
• Siemens Financial Services |
• Harrah's Entertainment