上海泰蓝信息网络有限公司 - tlan.net.cn½¬变审计和风险.pdf · Chinese Summer, 2013 GRC • ACL| GRC - May • Cloud Solution Launches This Spring expanding capabilties

数字化IT审计高峰论坛会议资料

----ACL TRANSFORMING AUDIT AND RISK

上海泰蓝信息网络有限公司

资料所有内容均由上海泰蓝信息网络有限公司进行维护，如果您在阅览中有

任何疑问，请致电上海泰蓝信息网络有限公司支持中心。

服务热线：400-606-9812

服务邮箱：[email protected]

欢迎加入微信群

****© ACL Services Ltd.ACLACLACLACL | | | | Transforming Audit and RiskTransforming Audit and RiskTransforming Audit and RiskTransforming Audit and Risk

ACL ACL ACL ACL –––– Transforming Audit and Risk Transforming Audit and Risk Transforming Audit and Risk Transforming Audit and RiskACL---ACL---ACL---ACL---改变审计与风险

Ross PaulRoss PaulRoss PaulRoss PaulVice President Go To Market and ITVice President Go To Market and ITVice President Go To Market and ITVice President Go To Market and IT

2222© ACL Services Ltd.ACLACLACLACL | | | | Transforming Audit and RiskTransforming Audit and RiskTransforming Audit and RiskTransforming Audit and Risk

TEAM CYATEAM CYATEAM CYATEAM CYAAUDIT, RISK, & COMPLIANCEAUDIT, RISK, & COMPLIANCEAUDIT, RISK, & COMPLIANCEAUDIT, RISK, & COMPLIANCE

AuditAuditAuditAudit’’’’s Value Transformations Value Transformations Value Transformations Value Transformation审计的价值转变

AUDITAUDITAUDITAUDIT RISK MANAGEMENTRISK MANAGEMENTRISK MANAGEMENTRISK MANAGEMENT COMPLIANCECOMPLIANCECOMPLIANCECOMPLIANCE

CFOCFOCFOCFOAUDIT COMMITTEEAUDIT COMMITTEEAUDIT COMMITTEEAUDIT COMMITTEE

ACCOUNTING & FINANCEACCOUNTING & FINANCEACCOUNTING & FINANCEACCOUNTING & FINANCE


The IIA The IIA The IIA The IIA ““““Three Lines of DefenseThree Lines of DefenseThree Lines of DefenseThree Lines of Defense”””” Model Model Model Model国际内审协会的““““三道防线””””模型

““““GRCGRCGRCGRC””””““““INTEGRATED GRCINTEGRATED GRCINTEGRATED GRCINTEGRATED GRC””””

““““GRC REPORTINGGRC REPORTINGGRC REPORTINGGRC REPORTING””””

““““AUDITAUDITAUDITAUDIT””””


Transforming Audit Transforming Audit Transforming Audit Transforming Audit 变革中的审计ACLACLACLACL’’’’s Vision for Integrated, High-Impact Audits Vision for Integrated, High-Impact Audits Vision for Integrated, High-Impact Audits Vision for Integrated, High-Impact Audit

RiskAssessment

KnowledgeContent

AuditManagement

AuditAnalytics


CorporateCorporateCorporateCorporateRisksRisksRisksRisks

AuditsAuditsAuditsAudits ObjectivesObjectivesObjectivesObjectives““““What What What What

Could Go Could Go Could Go Could Go WrongsWrongsWrongsWrongs””””

ControlsControlsControlsControls TestsTestsTestsTests ExceptionsExceptionsExceptionsExceptions FindingsFindingsFindingsFindings

Effective Audit ProcessEffective Audit ProcessEffective Audit ProcessEffective Audit Process高效的审计流程


Corporate Corporate Corporate Corporate RisksRisksRisksRisks AuditsAuditsAuditsAudits ObjectivesObjectivesObjectivesObjectives

““““What What What What Could Go Could Go Could Go Could Go WrongsWrongsWrongsWrongs””””

ControlsControlsControlsControls TestsTestsTestsTests ExceptionsExceptionsExceptionsExceptions FindingsFindingsFindingsFindingsCorporate Corporate Corporate Corporate RisksRisksRisksRisks AuditsAuditsAuditsAudits ObjectivesObjectivesObjectivesObjectives

““““What What What What Could Go Could Go Could Go Could Go WrongsWrongsWrongsWrongs””””

ControlsControlsControlsControls TestsTestsTestsTests ExceptionsExceptionsExceptionsExceptions FindingsFindingsFindingsFindings

Effective Audit ProcessEffective Audit ProcessEffective Audit ProcessEffective Audit Process

Specialized, Problem-Specific Knowledge

RiskAssessment

AuditContent

AuditManagement

AuditAnalytics

Strategic Risks Projects Risks

Integrated RiskAssessment

Project & Controls

Management

Risk & ControlAnalytics

IntegratedContent

Effective Integrated GRC ProcessEffective Integrated GRC ProcessEffective Integrated GRC ProcessEffective Integrated GRC Process

Issues

高效的GRCGRCGRCGRC流程


Strategic ValueStrategic ValueStrategic ValueStrategic Value(Analysts)(Analysts)(Analysts)(Analysts)

Strategic ValueStrategic ValueStrategic ValueStrategic Value(Executives)(Executives)(Executives)(Executives)

Strategic Strategic Strategic Strategic RisksRisksRisksRisks ProjectsProjectsProjectsProjects ObjectivesObjectivesObjectivesObjectives RisksRisksRisksRisks ControlsControlsControlsControls TestsTestsTestsTests ExceptionsExceptionsExceptionsExceptions IssuesIssuesIssuesIssues

Strategic risks become visible in ACTUAL transactional data

Issues and transactional exceptions link DIRECTLY AND VISUALLY to

strategic risks

Transforming GRC Through DataTransforming GRC Through DataTransforming GRC Through DataTransforming GRC Through Data通过数据改变GRCGRCGRCGRCHigh-Impact, Data-Focused Integrated GRCHigh-Impact, Data-Focused Integrated GRCHigh-Impact, Data-Focused Integrated GRCHigh-Impact, Data-Focused Integrated GRC影响大，以数据为核心的整合GRCGRCGRCGRC

Strategic ValueStrategic ValueStrategic ValueStrategic Value(Organization)(Organization)(Organization)(Organization)

Issues and transactional exceptions identified continuously drive overall risk

assessments and resulting actions


IntegratedContent

Transforming Integrated GRCTransforming Integrated GRCTransforming Integrated GRCTransforming Integrated GRC改变整合的GRCGRCGRCGRC

Integrated Risk Assessment

Project & Controls

Management

Risk & Control Analytics


DATA ANALYSISDATA ANALYSISDATA ANALYSISDATA ANALYSIS

• Ad-hoc analysis Ad-hoc analysis Ad-hoc analysis Ad-hoc analysis of of of of data populations data populations data populations data populations designed designed designed designed to detect to detect to detect to detect transactionstransactionstransactionstransactions that that that that manifest the manifest the manifest the manifest the occurrenceoccurrenceoccurrenceoccurrence of of of of business riskbusiness riskbusiness riskbusiness risk

ENTERPRISE ENTERPRISE ENTERPRISE ENTERPRISE CONTINUOUS CONTINUOUS CONTINUOUS CONTINUOUS MONITORINGMONITORINGMONITORINGMONITORING

• Recurring analysis Recurring analysis Recurring analysis Recurring analysis of transactional of transactional of transactional of transactional data designed data designed data designed data designed to to to to prevent prevent prevent prevent occurrenceoccurrenceoccurrenceoccurrence of business risk of business risk of business risk of business risk through through through through identification of identification of identification of identification of operational operational operational operational deficiencies or deficiencies or deficiencies or deficiencies or control gapscontrol gapscontrol gapscontrol gaps

GRCGRCGRCGRC

• Management and Management and Management and Management and measurement of measurement of measurement of measurement of risks and controls risks and controls risks and controls risks and controls against business against business against business against business objectives objectives objectives objectives in in in in accordance with accordance with accordance with accordance with regulations, regulations, regulations, regulations, standards, policies standards, policies standards, policies standards, policies and business and business and business and business decisions.decisions.decisions.decisions.

Core Value of Audit Analysis Core Value of Audit Analysis Core Value of Audit Analysis Core Value of Audit Analysis 审计分析的核心价值



• ““““I am investigating I am investigating I am investigating I am investigating to find fraud.to find fraud.to find fraud.to find fraud.””””

ENTERPRISE ENTERPRISE ENTERPRISE ENTERPRISE CONTINUOUS CONTINUOUS CONTINUOUS CONTINUOUS MONITORINGMONITORINGMONITORINGMONITORING

• ““““I want to monitor I want to monitor I want to monitor I want to monitor my environment to my environment to my environment to my environment to prevent fraud from prevent fraud from prevent fraud from prevent fraud from happening.happening.happening.happening.””””

GRCGRCGRCGRC

• ““““I want to know I want to know I want to know I want to know how vulnerable I how vulnerable I how vulnerable I how vulnerable I am to fraud by am to fraud by am to fraud by am to fraud by under-standing under-standing under-standing under-standing how likely it is to how likely it is to how likely it is to how likely it is to occur, what the occur, what the occur, what the occur, what the potential impact is, potential impact is, potential impact is, potential impact is, and how we can and how we can and how we can and how we can avoid it.avoid it.avoid it.avoid it.””””

In Practice In Practice In Practice In Practice 在实际应用中



• Version 10 Launches This Summer

• Fully Localized in Chinese Summer, 2013

• Version 4 Launches This Spring


ENTERPRISE CONTINUOUS ENTERPRISE CONTINUOUS ENTERPRISE CONTINUOUS ENTERPRISE CONTINUOUS MONITORINGMONITORINGMONITORINGMONITORING

• Version 4 Launches This Spring


GRCGRCGRCGRC

• ACL| GRC - MayACL| GRC - MayACL| GRC - MayACL| GRC - May

• Cloud Solution Launches This Spring expanding capabilties of existing audit and compliance management solution

• Only Available in English Language

• Localization Timing TBC

ACLACLACLACL’’’’s Product Portfolio s Product Portfolio s Product Portfolio s Product Portfolio 产品概览

Content - Specialized, Problem-Specific Knowledge – Next Winter


IT Audit can independently validate and IT Audit can independently validate and IT Audit can independently validate and IT Audit can independently validate and assess controls and security, perform risk assess controls and security, perform risk assess controls and security, perform risk assess controls and security, perform risk assessments and business impact analyses, assessments and business impact analyses, assessments and business impact analyses, assessments and business impact analyses, and improve operational and system and improve operational and system and improve operational and system and improve operational and system performanceperformanceperformanceperformance

�Segregation of DutiesSegregation of DutiesSegregation of DutiesSegregation of Duties– Extract security rules and independently verify SOD – Determine whether rights were exploited – Identify where users with the same role have

different access rights

�Application SecurityApplication SecurityApplication SecurityApplication Security– Compare employee termination date to last login

date for user IDs – Analyze IDs with last login date over a specified

threshold – Extract IDs where the date of last password change

exceeds security standards – Identify concurrent logins of the same ID

DATA ANALYSISDATA ANALYSISDATA ANALYSISDATA ANALYSISIT Audit Applications ITIT Audit Applications ITIT Audit Applications ITIT Audit Applications IT审计应用

Active DirectoryActive DirectoryActive DirectoryActive DirectoryIdentify active directory entries not assigned to

current employees Analyze active directory group membership

changes Identify inactive active directory accounts

Monitor additions to sensitive active directory groups such as Domain Admin

System SecuritySystem SecuritySystem SecuritySystem SecurityAutomatically identify inappropriate security settings,

or changes to key security parameters Correlate distributed security logs and look for suspicious activity (e.g, unusual time, duration,

frequency) Stratify incoming and outgoing activity by IP address

to identify suspicious activity


Accident Fund Insurance of AmericaAccident Fund Insurance of AmericaAccident Fund Insurance of AmericaAccident Fund Insurance of America美国事故基金保险公司Industry:Industry:Industry:Industry: Insurance

Needs:Needs:Needs:Needs: Recover and manage costs, and identify potential duplicate payments.

ChallengesChallengesChallengesChallenges: : : : Data integrity issues. Inability to access data from multiple sources. Unable to effectively monitor risk.

BenefitsBenefitsBenefitsBenefits– Analyzed data for both formal audits and special projects for

business units, including Claims, Finance, Information Technology, Third-Party Administration, Actuarial, Legal, and Finance

– Repeatable audit testing capabilities– Early identification of errors including duplicate payments– Saved hundreds of thousands of dollars– Strengthened internal controls and developed innovative quality

assurance programs

Saved money lost through Saved money lost through Saved money lost through Saved money lost through control gaps and errors, control gaps and errors, control gaps and errors, control gaps and errors,

including duplicate payments, including duplicate payments, including duplicate payments, including duplicate payments, overpayments and cost overpayments and cost overpayments and cost overpayments and cost

avoidances avoidances avoidances avoidances

“ACL has greatly enhanced the efficiency, quality, and consistency of our audit process. By acquiring deeper levels of technical and business process knowledge, the internal auditor has also become a more valuable commodity to our organization.”

Thomas MackieThomas MackieThomas MackieThomas MackiePrincipal Audit Consultant

View the Full View the Full View the Full View the Full Case StudyCase StudyCase StudyCase Study


GE Capital GE Capital GE Capital GE Capital –––– Australia & New Zealand Australia & New Zealand Australia & New Zealand Australia & New Zealand通用财务————澳洲&&&&新西兰Industry:Industry:Industry:Industry: Finance

Needs:Needs:Needs:Needs: A more efficient way to analyze the log files through data analytics.

ChallengesChallengesChallengesChallenges: : : : Data leakage protection. Accurately capture, analyze and monitor data flows across varied systems, devices and geographical IT installations. Limited review of the data with manual analysis techniques and spreadsheet software.

Benefits:Benefits:Benefits:Benefits:– Significantly reduced the time and effort required to analyze the

large security logs– Identify potential unauthorized and unusual data copying activity

for deeper investigation.– Improve detection capabilities

Automated analytics provide Automated analytics provide Automated analytics provide Automated analytics provide data leakage and preventiondata leakage and preventiondata leakage and preventiondata leakage and prevention

assuranceassuranceassuranceassurance

“The IT and Senior Management team was impressedwith the additional level of control and analysis that theACL solution provided; as well as the ability to directlyand efficiently access the data.”

Arnold MendozaArnold MendozaArnold MendozaArnold MendozaIT Internal Audit Manager



American Automobile AssociationAmerican Automobile AssociationAmerican Automobile AssociationAmerican Automobile Association美国汽车联合会

ACL training and consulting ACL training and consulting ACL training and consulting ACL training and consulting promotes full-coverage data promotes full-coverage data promotes full-coverage data promotes full-coverage data

analysisanalysisanalysisanalysis

“ACL technology offers nearly unlimited opportunities to access, analyze and normalize data to deliver higher quality audit work. It’s a powerful solution that audit staff members can apply to an ever-growing list of audit activities.”

Bob WalkerBob WalkerBob WalkerBob WalkerInternal Audit Manager


Industry:Industry:Industry:Industry: Insurance

Needs:Needs:Needs:Needs: Recover and manage costs, and identify potential duplicate payments. Increase auditors’ knowledge and use of ACL in everyday audit activities and data testing.

Challenges:Challenges:Challenges:Challenges: Deliver higher-quality audit work based on full data coverage to promote a tighter control environment across the enterprise.

Benefits:Benefits:Benefits:Benefits:– Deeper data analysis for higher quality audits– Analyze T&E purchases, P-cards, payroll records, and a variety

of other audit analyses– Better business and operations monitoring


Visualize, widely share and Visualize, widely share and Visualize, widely share and Visualize, widely share and act on information act on information act on information act on information uncovered in analysis uncovered in analysis uncovered in analysis uncovered in analysis testing across the businesstesting across the businesstesting across the businesstesting across the business

Powerful VisualizationPowerful VisualizationPowerful VisualizationPowerful Visualization强大的图像展示

Graph and visualize results to Graph and visualize results to Graph and visualize results to Graph and visualize results to identify trends and patterns identify trends and patterns identify trends and patterns identify trends and patterns

for line of business for line of business for line of business for line of business stakeholders and executivesstakeholders and executivesstakeholders and executivesstakeholders and executives

Real-time alerts let management Real-time alerts let management Real-time alerts let management Real-time alerts let management know when critical thresholds know when critical thresholds know when critical thresholds know when critical thresholds are hit so they can take action are hit so they can take action are hit so they can take action are hit so they can take action

when requiredwhen requiredwhen requiredwhen required

Provides context to results Provides context to results Provides context to results Provides context to results through Drill-Downs, Time- Sliders, through Drill-Downs, Time- Sliders, through Drill-Downs, Time- Sliders, through Drill-Downs, Time- Sliders,

Tooltips and Series Selection Tooltips and Series Selection Tooltips and Series Selection Tooltips and Series Selection –––– taking analytic results and taking analytic results and taking analytic results and taking analytic results and

findings to a whole new levelfindings to a whole new levelfindings to a whole new levelfindings to a whole new level


Siemens Financial Services Inc.Siemens Financial Services Inc.Siemens Financial Services Inc.Siemens Financial Services Inc.西门子财务服务公司Industry:Industry:Industry:Industry: Financial Services

Needs:Needs:Needs:Needs: Web-based application to manage, distribute, assign, review and escalate exceptions.

Challenges:Challenges:Challenges:Challenges: Increase security over access to the controlled analytic environment.

Benefits:Benefits:Benefits:Benefits:– Increased security and team efficiency– Strengthen financial and operating controls – Identify and remediate errors and anomalies—more controls

testing of complete populations– Streamlined SOX testing and other regulatory compliance efforts– Data input validations, system processing & calculations, edit

checks, data trending, change management

Streamlined SOX testing and Streamlined SOX testing and Streamlined SOX testing and Streamlined SOX testing and other regulatory compliance other regulatory compliance other regulatory compliance other regulatory compliance

effortseffortseffortsefforts

"Our ACL solution helps us work much more efficiently. We’ve reduced our dependency on manual controls and streamlined our SOX testing approach.”

Jason A. Gross, Jason A. Gross, Jason A. Gross, Jason A. Gross, CPA, CIA, CFE, CISA, ACDA Vice President, Controls Management



ArgentinaAustraliaAustriaBahrainBeneluxBulgariaCanadaCanadaCanadaCanada

GreeceHong Kong

IndiaIrelandIsraelItaly

Japan

JordanKuwait

LebanonNordicsOman

ParaguayPoland

ChinaCyprus

EcuadorEgypt

FinlandFrance

Germany

PortugalQatarRussia

Saudi ArabiaSingaporeSingaporeSingaporeSingapore

South AfricaSouth Korea

SpainTaiwanTurkeyUAE

United KingdomUnited KingdomUnited KingdomUnited KingdomUnited States

Uruguay

CANADACANADACANADACANADA

UNITED UNITED UNITED UNITED STATESSTATESSTATESSTATES

Over 15,000 Customers in > 150 CountriesOver 15,000 Customers in > 150 CountriesOver 15,000 Customers in > 150 CountriesOver 15,000 Customers in > 150 Countries

ACLACLACLACL————25252525 Years of Global Leadership 25 Years of Global Leadership 25 Years of Global Leadership 25 Years of Global Leadership 25年全球领导地位

1996 1996 1996 1996 German, German, German, German, FrenchFrenchFrenchFrench

1997 1997 1997 1997 PortuguesePortuguesePortuguesePortuguese

2003 2003 2003 2003 Chinese Chinese Chinese Chinese

2005 2005 2005 2005 JapaneseJapaneseJapaneseJapanese

2005 2005 2005 2005 PolishPolishPolishPolish2010 2010 2010 2010 BulgarianBulgarianBulgarianBulgarian

1987 ACL 1987 ACL 1987 ACL 1987 ACL FOUNDEDFOUNDEDFOUNDEDFOUNDED

1996 1996 1996 1996 SpanishSpanishSpanishSpanish

2012 2012 2012 2012 KoreanKoreanKoreanKorean


CommercialCommercialCommercialCommercial

Public SectorPublic SectorPublic SectorPublic Sector

InfluencersInfluencersInfluencersInfluencers

Wells Fargo FoothillWells Fargo FoothillWells Fargo FoothillWells Fargo Foothill

YouYouYouYou’’’’re in Good Company re in Good Company re in Good Company re in Good Company 现有客户

Global 500Global 500Global 500Global 500 70%70%70%70%

Fortune 500Fortune 500Fortune 500Fortune 500 89%89%89%89%

Fortune 100Fortune 100Fortune 100Fortune 100 98%98%98%98%

Big 4, 100s of Educational institutionsBig 4, 100s of Educational institutionsBig 4, 100s of Educational institutionsBig 4, 100s of Educational institutions

33K users in >40 Linked in groups33K users in >40 Linked in groups33K users in >40 Linked in groups33K users in >40 Linked in groups

200+ departments in 37 national governments200+ departments in 37 national governments200+ departments in 37 national governments200+ departments in 37 national governments

1000+ regional, state and local governments1000+ regional, state and local governments1000+ regional, state and local governments1000+ regional, state and local governments


Contact InformationContact InformationContact InformationContact Information联系方式

Ross PaulRoss PaulRoss PaulRoss PaulVP Go To Market and ITVP Go To Market and ITVP Go To Market and ITVP Go To Market and [email protected][email protected][email protected][email protected]

ACL ACL ACL ACL 1550 Alberni Street, Vancouver, BC, Canada V6G 1A5 1 604 669 4225 | [email protected] | www.acl.com

www.acl.com/linkedin | www.acl.com/twitter | www.acl.com/facebook


Documents

上海泰蓝信息网络有限公司 - tlan.net.cn½¬变审计和风险.pdf · Chinese Summer, 2013 GRC • ACL| GRC - May • Cloud Solution Launches This Spring expanding capabilties