Webinar Description: In my years leading data analytics projects and teams, I have come across several different structures for the integration of DA. Some were at large multinational corporations and others were at small- and medium-sized organizations, including government bodies. Today, we'll look at four different models for the management of data analytics in Internal Audit departments. The key characteristics of each model will be described, as well as the strengths and weaknesses. Participant Outcomes: By the end of this session, participants will be able to identify the model which best fits their organization.

1. 10/10/2019
1
Key Presenter:
Michael Kano, ACDA
Data Analytics Specialist
Arbutus Software
Structuring Your Organization for
Success with Data Analytics
About Jim Kaplan, CIA, CFE
 President and Founder of AuditNet®,
the global resource for auditors
(available on iOS, Android and
Windows devices)
 Auditor, Web Site Guru,
 Internet for Auditors Pioneer
 IIA Bradford Cadmus Memorial Award
Recipient
 Local Government Auditor’s Lifetime
Award
 Author of “The Auditor’s Guide to
Internet Resources” 2nd Edition
Page 2
1
2

2. 10/10/2019
2
ABOUT AUDITNET® LLC
• AuditNet®, the global resource for auditors, serves the global audit
community as the primary resource for Web-based auditing content. As the first online
audit portal, AuditNet® has been at the forefront of websites dedicated to promoting the
use of audit technology.
• Available on the Web, iPad, iPhone, Windows and Android devices and
features:
• Over 3,100 Reusable Templates, Audit Programs, Questionnaires, and
Control Matrices
• Webinars focusing on fraud, data analytics, IT audit, and internal audit
with free CPE for subscribers and site license users.
• Audit guides, manuals, and books on audit basics and using audit
technology
• LinkedIn Networking Groups
• Monthly Newsletters with Expert Guest Columnists
• Surveys on timely topics for internal auditors
Introductions
Page 3
HOUSEKEEPING
This webinar and its material are the property of AuditNet® and its Webinar partners.
Unauthorized usage or recording of this webinar or any of its material is strictly forbidden.
• If you logged in with another individual’s confirmation email you will not receive CPE as
the confirmation login is linked to a specific individual
• This Webinar is not eligible for viewing in a group setting. You must be logged in with
your unique join link.
• We are recording the webinar and you will be provided access to that recording after
the webinar. Downloading or otherwise duplicating the webinar recording is expressly
prohibited.
• You must attend the entire Webinar to receive CPE (no partial CPE will be awarded).
• If you meet the criteria for earning CPE you will receive a link via email to download
your certificate. The official email for CPE will be issued via NoReply@gensend.io and it
is important to white list this address. It is from this email that your CPE credit will be
sent. There is a processing fee to have your CPE credit regenerated post event.
• Submit questions via the chat box on your screen and we will answer them either during
or at the conclusion.
• You must answer the survey questions after the Webinar or before downloading your
certificate.
3
4

3. 10/10/2019
3
IMPORTANT INFORMATION
REGARDING CPE!
• WEBINAR ATTENDEES - If you attend the entire Webinar, and meet the eligibility criteria, you
will receive an email with the link to download your CPE certificate. The official email for CPE
will be issued via NoReply@gensend.io and it is important to white list this address. It is from
this email that your CPE credit will be sent. There is a processing fee to have your CPE credit
regenerated post event.
• We cannot manually generate a CPE certificate as these are handled by our 3rd party provider.
We highly recommend that you work with your IT department to identify and correct any email
delivery issues prior to attending the Webinar. Issues would include blocks or spam filters in
your email system or a firewall that will redirect or not allow delivery of this email from
Gensend.io
• We are not responsible for any connection, audio or other computer related issues. You must
have pop-ups enabled on you computer otherwise you will not be able to answer the polling
questions which occur approximately every 20 minutes. We suggest that if you have any
pressing issues to see to that you do so immediately after a polling question.
The views expressed by the presenters do not necessarily represent the views,
positions, or opinions of AuditNet® LLC. These materials, and the oral presentation
accompanying them, are for educational purposes only and do not constitute
accounting or legal advice or create an accountant-client relationship.
While AuditNet® makes every effort to ensure information is accurate and complete,
AuditNet® makes no representations, guarantees, or warranties as to the accuracy or
completeness of the information provided via this presentation. AuditNet® specifically
disclaims all liability for any claims or damages that may result from the information
contained in this presentation, including any websites maintained by third parties and
linked to the AuditNet® website.
Any mention of commercial products is for information only; it does not imply
recommendation or endorsement by AuditNet® LLC
5
6

4. 10/10/2019
4
AGENDA
• Introductions
• Why does DA need formalizing?
• Four Models Overview
• Key Considerations
• What works best?
Michael Kano
Michael is a recent addition to the Arbutus Software team. He has 25 years of experience in
data analytics and internal audit with organizations in the USA, Canada, and the Middle East.
From 2015 to 2019, he was a senior member of the data analytics practice at Focal Point Data
Risk, a US-based professional services firm.
Prior to Focal Point, Michael led eBay, Inc.’s data analytics program in the InternalAudit
department. He was tasked with integrating data analytics into the audit workflow on
strategic and tactical levels. This included developing quality and documentation standards,
training users, and providing analytics support on numerous audits in the IT, PayPal, and
eBay marketplaces business areas. He also provided support to non-IA teams such as the
Business Ethics Office and Enterprise Risk Management teams.
During his years at eBay, Michael supported audits throughout the organization in the IT,
compliance, operations, vendor management, revenue assurance,T&E, and human resources
areas.
Michael's software experience includes ArbutusAnalyzer, ACL Desktop/Direct Link,Alteryx,
Microsoft Access, SQL, andTableau. He led ACL Services Ltd.’s global training team for 8
years.
He is a graduate of the UCLA Anderson School of Management.
7
8

5. 10/10/2019
5
Why does DA need formalizing?
• It’s not a fad and it’s not going away
• Data is a key part of the audit environment
• Findings based on data evidence
• Multiple, massive data sets
• Variety of formats
• High-speed, high-volume transactions
• Pressure to perform
0000010
0000100
1110010
0110000
1100011
POLLING QUESTION 1
9
10

6. 10/10/2019
6
FOUR MODELS
1
Internal-
Dispersed/Distributed
Individual auditors
manage their own tools
and procedures
2
Internal-
Centralized/Dedicated
DA as a distinct
competency with
formalized procedures,
policies, and processes
3
Organization-
Internally Sourced
DA conducted by other
department(s) on behalf
of IA
4
Outsourced/Co-Sourced
DA conducted by an
external organization
What are some of the key items we must take into account?
• StrategicValue Perception
• DATools
• Accountability
• Resources
• Data Management
• Cost
• Documentation
• Data IntegrityVerification
• Metrics
Key Considerations
11
12

7. 10/10/2019
7
1 2 3 4
Internal-
Dispersed/Distributed
Internal-
Centralized/Dedicated
Organization-
Internally Sourced
Outsourced/Co-Sourced
Low due to lack of
visibility or distinction;
cost is commingled
Medium to high due to
distinctiveness
Low to medium Medium to high due to
line-item status
StrategicValue Perception
Do key players in our organization understand and value the contributions
of data analytics?
• Chief Audit Executive
• Audit Committee-right of data access in audit charter
• Business & tech leadership
1 2 3 4
Internal-
Dispersed/Distributed
Internal-
Centralized/Dedicated
Organization-
Internally Sourced
Outsourced/Co-Sourced
Multiple tools One or two key tools Multiple tools One or two key tools
Data AnalyticsTools
Are our tools the best fit for our needs?
• Powerful analytical capabilities
• Read multi-source data formats and types
• User training & support availability
• Read-only
• Execution log for audit trail
• Scheduling/continuous capability
13
14

8. 10/10/2019
8
1 2 3 4
Internal-
Dispersed/Distributed
Internal-
Centralized/Dedicated
Organization-
Internally Sourced
Outsourced/Co-Sourced
Yes, but only as
auditors
Yes, clear and distinct
accountabilities
Not necessarily Yes, by contract
Accountability
Are the DA users accountable?
• Direct line between individual analysts and their output
• Can be a metric in evaluation
1 2 3 4
Internal-
Dispersed/Distributed
Internal-
Centralized/Dedicated
Organization-
Internally Sourced
Outsourced/Co-Sourced
Yes, but only as
auditors. Little/no
formal or structured
assessment of skills
Yes, clear and distinct
skills and deliverables
Not necessarily; may not
have a close enough
relationship to evaluate
Yes, by contract
Resources
Do we have the skills we need?
• Formal training and coaching
• Specifically included in job description and evaluations
• Depth and breadth of experience
15
16

9. 10/10/2019
9
Identifying Potential Resources
• Previous experience (Arbutus,ACL, IDEA, SQL,VBA, SAS…)
• Math majors
• Actuaries
POLLING QUESTION 2
17
18

10. 10/10/2019
10
1 2 3 4
Internal-
Dispersed/Distributed
Internal-
Centralized/Dedicated
Organization-
Internally Sourced
Outsourced/Co-Sourced
Possible, but with
weak oversight
Easier to implement and
maintain
Rely on providing
departments
May be weak without
proper safeguards
Data Management
Are we managing data with the appropriate infrastructure
and policies?
• Dedicated server(s) and network infrastructure
• Policies and practices for maintaining confidentiality and
security
• Independent access to data
1 2 3 4
Internal-
Dispersed/Distributed
Internal-
Centralized/Dedicated
Organization-
Internally Sourced
Outsourced/Co-Sourced
Diluted/commingled Identifiable Hard to identify unless
department allocates cost
Contract cost
Cost
• Key elements: software, infrastructure, training,
FTEs
• ROI question: # of audits, scope, precision,
efficiency…
Can we (or should we) identify the cost of DA?
19
20

11. 10/10/2019
11
1 2 3 4
Internal-
Dispersed/Distributed
Internal-
Centralized/Dedicated
Organization-
Internally Sourced
Outsourced/Co-Sourced
Can be challenging to
implement across
teams
Feasible Usually not available Request by contract
Documentation
• Data dictionaries
• Audit planning document
• Data request form
• Client request form
• Process/script description
• Engagement checklist
• Script execution log (including DIV)
• Deliverables/turnover document
• Script library
• Post-Execution
What documentation should we have?
1 2 3 4
Internal-
Dispersed/Distributed
Internal-
Centralized/Dedicated
Organization-
Internally Sourced
Outsourced/Co-Sourced
Can be challenging to
implement and
maintain across teams
Feasible Usually not available Request by contract
Data IntegrityVerification
Why?And what tests should we run?
• Due diligence to identify any possible data errors prior to
audit testing
• General tests
• Data-specific tests
0000#10
0@00100
111*010
0110000
1100011
21
22

12. 10/10/2019
12
Data: From Raw to Processed
The Process
Sources of Corruption
23
24

13. 10/10/2019
13
GeneralTests : Numeric Data
 Corruption
 FieldTotal
 HighestValue
 Second-highestValue
 Ratio of 2nd to HighestValue
 Lowest value
 Average
 Range
 AbsoluteValue
 Median
 Number of Zeros
 Number of Positives
 Number of Negatives
 Standard deviation
GeneralTests
Date Data
 Corruption
 Oldest Date
 Newest Date
 Span (valid dates only)
 Weekends
 Blank Dates
 Invalid Non-Blank Dates
Character Data
 Uniqueness*
 Non-blank*
 Valid entries
 Short length
 Non-printable characters
*Where expected
25
26

14. 10/10/2019
14
Data-SpecificTests
Logical relation between two fields
• Invoice date vs PO date
• Recalculations
PatternValidity
• Phone numbers
• Zip codes
• Custom codes
Record Integrity
• Uniqueness
• Data shifts
Data Shifts
27
28

15. 10/10/2019
15
Metrics
• Number of audits
• Quality
• Coverage
• Precision
• Consistency
• Development of custom applications
• Continuous/automated capability
AVOID
THE ROI
TRAP!
How do you evaluate your DA capability?
POLLING QUESTION 3
29
30

16. 10/10/2019
16
What works best?
• Evolutionary process
• Hybrids of models
• Strong leadership
• Ability to attract and retain talent
• Fit with corporate culture
FOUR MODELS
1
Internal-
Dispersed/Distributed
Individual auditors
manage their own tools
and procedures
2
Internal-
Centralized/Dedicated
DA as a distinct
competency with
formalized procedures,
policies, and processes
3
Organization-
Internally Sourced
DA conducted by other
department(s) on behalf
of IA
4
Outsourced/Co-Sourced
DA conducted by an
external organization
Questions?
THANK YOU!
Michael Kano
Data Analytics Specialist
mkano@arbutussoftware.com
(604) 456-6338
Arbutus Analytics
31
32