GRC Tuesdays: Hidden Gems – Go from Sample Audit to Full Scope with Automated Analytics

[T_Frenehard]

The audit procedure is a key aspect of both the planning and the execution phases of the audit cycle as it helps auditors prepare the most adequate work program when planning the engagement, and then collect and analyse data to be able to draw conclusions.

Depending on the audit phase, there are different techniques that can be used.

For instance, the European Court of Auditors categorizes them in 2 groups:

• “During the planning phase, the auditor is interested in more general information as part of the learning process to understand the subject matter. Qualitative techniques are particularly useful at such stage to identify the significant issues, develop preliminary ideas and build hypotheses. These techniques are also particularly well suited to complex problems.
• As the audit proceeds, the auditor will need more specific information to assess and measure performance, or to document errors or problems already known (e.g. from the planning phase). Quantitative analysis, involving an examination of numerical data, is one of the most powerful audit tools for developing evidence-based conclusions. Such analysis adds considerable value to the audit work, as it can provide clear measures of costs, benefits and performance.”

You might already know that there are various options in SAP Audit Management covering the qualitative techniques, including the test and question procedure types to carry out surveys, document interviews, observations, inspections, etc.

But did you know that SAP Audit Management also includes Computer Assisted Audit Techniques (“CAAT”) to automate the data analysis by analysing large volumes of information to identify and raise anomalies and process deficiencies? This typically addresses the “Quantitative analysis” requirements.

What’s more, not only do these capabilities help perform analytics testing or identify fraudulent behaviours, they can also automatically create a working paper.

In a time when everyone is looking for how AI can help reduce workload, these analytical capabilities already exist for audit and are ready to be used.

Furthermore, this can enable audit departments to shift from sample audit – when they select a subset of data to be manually reviewed – to full audit scope where volume of data to be analysed no longer matters as this will be done automatically and effortlessly by a machine.

Business Rule Procedures from SAP Process Control

In our first “hidden gem”, SAP Audit Management allows audit teams to use the business rules defined in SAP Process Control to retrieve and analyze data from a business system through an ad hoc query.

To be activated, the SAP Audit Management system must be integrated to SAP Process Control and the connectors configured. Once the technical prerequisites have been fulfilled, this feature can be used as follows:

• When preparing the work program for an audit

Within a scope item of the audit program, go to the Procedures section and choose Add > Business Rule.

Document the name of the business rule and its description (optional) and Create.

Once created, drill-down into the business rule and go to the Ad Hoc Query section. The business rule audit procedure will now be available to auditors to use during the execution phase.

Of course, you can also already search the business rules in SAP Process Control and then execute the relevant one to identify significant issues to be addressed during the engagement.

• When performing the engagement

Once the work program has been approved and that the audit in progress, auditors can go to the Ad Hoc Query section within a Procedures of a scope item of the audit program and choose Select Business Rule.

They then select a connector – i.e., the SAP Process Control system where the business rules are defined, and select the business rule they want to run.

Auditors can then select the target business system in which the query will be performed and Execute Query to run it. Deficiencies will then be displayed on the screen but users can simply click on Generate Working Paper to save the query results automatically in a working paper created by the audit system in the section just below.

Detection Procedures from SAP Business Integrity Screening

Our second “hidden gem” today relates to detection procedure.

With this capability, audit teams can use the detection and investigation capabilities provided by SAP Business Integrity Screening to find irregularities in business data.

If a detection strategy finds irregularities and generates alert items, then these items populate a working paper that is added to the work package. From the working paper, auditors can use the investigative tools of SAP Business Integrity Screening to further analyze each anomaly.

• When preparing the work program for an audit

First, you need to maintain the audit-specific detection strategies in SAP Business Integrity Screening.

Then, in SAP Audit Management, drill-down into a scope item of the audit program and create a detection procedure by going into the Procedures section in the work package and choosing Add > Detection.

From there, document the title, description (optional) of the detection procedure and select the relevant detection strategy from SAP Business Integrity Screening and Save.

Note: only detection strategies that have been specially marked for use in SAP Audit Management may be used. These strategies will then not be used by SAP Business Integrity Screening for detection.

The detection audit procedure will now be available to auditors to use during the execution phase.

• When performing the engagement

Once the work program has been approved and that the audit in progress, auditors can start using the analytics capability to help them in their work. To do so, users simply need to drill down into the scope item of the work program and go to the Procedures section. From there, the Detection procedure created earlier is available and can be executed by clicking on Run.

Go to the Automatic Runs section and choose Select Business Rule.

Once the run is completed, a working paper is automatically generated, which can be found in the Working Papers section with any irregularities found recorded as Alert Items.

Both capabilities can significantly extend the reach of the audit team and help them cover a much fuller scope.

If you are interested in reading more about these capabilities of SAP Audit Management, then have a look at the dedicated pages of the SAP Help Portal:

• Business Rule Procedure in Audit Preparation
• Business Rule Ad Hoc Query in Audit Execution
• Detection Procedure in Audit Preparation
• Perform Detection Procedures in Audit Execution

What about you, does your audit team use Computer Assisted Audit Techniques to support the audit cycle? I look forward to reading your thoughts and comments either on this blog or on Twitter @TFrenehard

And if you are interested in learning more about SAP solutions for Governance, Risk, and Compliance, feel free to fill-in the demo request form!