AUDIT ANALYTICS AUDIT

CASE STUDY B: IMPLEMENTING CONTINUOUS AUDITING AND CONTINUOUSMONITORING
has actually been processed as promised. Exceptions are passed to
Human Resources for further review.
The CMR also examines cases where exceptions have been closed
as "no leave owing," but leave is processed nonetheless (as a test of
integrity).
The CMR produces weekly activity and status summaries for
executive management.
The leave CMR is complex. We argue that it tests the boundaries of
CA/CM and thus provides an illustration of developments in an
environment with multiple data sources and a complex software and
data ecosystem. Specifically, the CMR:
accesses several systems to assemble and cross match the data;
applies relatively complex algorithms to reduce the number of
false positives; and
uses multiple platforms to deliver and monitor the exceptions
including ensuring that the exceptions are being actioned as
advised.
The value of CA/CM is diluted unless there is a robust mechanism to
track and resolve exceptions. Further, the value of CA/CM is also
reduced if the algorithms do not effectively address the suppression of
false positives. Experience suggests that external auditors tend to find
techniques of this sort to be uneconomical due to the need to incorporate
the business rules of differing clients in the algorithms. For example,
tools such as ACL can easily check for potential duplicate invoicing;
however, ACL will potentially produce large numbers of potential
exceptions unless scripts are developed to, for example, identify
matching reversals. The experience at Metcash has been that multiple
iterations of the algorithms are required to minimise false positives.
Moving Forward—Key Risk Indicators
Metcash has moved away from the AS/NZS ISO 31000 Risk Management
Standard risk profiling approach, as published by the International
Standards Organization. A static 5 × 5 matrix that builds on likelihood
and consequences is not consistently of practical use to management.
Monitoring and assessing key risks through data driven risk indicators
provides a greater benefit to management. The increasing availability of
data and sophisticated analytics has facilitated a more accurate
identification of problems in critical areas such as Food Safety and
Human Resources. The use of dashboards (see figure B-2 for example)
has enabled the risk indicator data to be effectively communicated to
management via various media including tablet devices.
163