Many audit shops rely on IT auditors to support their use of data analytics; however, the IT audits typically focus on general and application controls. Around this time I wrote an article for the EDPACS magazine which encouraged IT auditors to look beyond the black box – to look at how IT supports, drives, and impact business processes. I have included below. IT Auditors need to come out of the…
The “Big one that got Away” – involved hundreds of millions of dollars in contracts for hardware and software maintenance over ten years. I ran a couple of tests to highlight red flags related to fraud risks and identified the fraudster a couple of times – but didn’t pursue the issue enough to uncover the fraud. The first red flag was identified when I performed an audit to determine if…
After my year of consulting in numerous private sector companies I felt that my experience not only with ACL, but also with risk assessment and fraud risk assessment in particular had grown. While ACL’s basic command set was powerful, there were a number of techniques that I had used specifically for fraud that were not (at this time) included in the basic ACL command set. They required the use of…
This was another exciting year for me. First, in 1999, I had decided to take a year off without pay and do some sub-contracting for ACL (I forgot to mention this in 1999 post). It gave me the opportunity to really expand my analysis skills. Also, I worked on the development of DirectLink for SAP which really forced me to develop a better understanding of SAP – something that has…
Technically, we were still in the planning phase of the A/P audit – but had already identified several areas of risk that needed to be analyzed further. The early payments represented a potential fraud. If you paid within 15 days, you should receive an early payment discount of between 1.5 -2.5% depending on the vendor’s terms. In addition to reviewing the invoices with ‘immediate’ payment terms, we calculated the difference…
Wow – never realized how much work this would be. I mean, I am only posting once a week – but it still takes a lot of time. Not getting many comment, but I hope people are enjoying and learning from the posts. I had hoped more people would share their experiences so we could learn from each other. I was now interested in expanding my use of data analytics…
Disaster! After 10 years of hard work to develop a decent understanding of the company’s finance, inventory, two HR and three pay systems, we switched to SAP (for finance and payroll) and PeopleSoft for HR) and another ERP system for inventory. It was bad enough that we were changing systems, but to implement separate systems for the major functions seemed idiotic and created much more work for me and the…
Even now, I firmly believe that the potential for the Y2K disaster was real. The only reason that its effects were minimized was a result of the hundreds of thousands of hours spent checking and rechecking programming code to address the “00” year problem before it occurred. For those of you too young to remember, prior to the year 2000, many databases and applications only used two digits for the…
I had been writing articles for the Internal Auditor (IIA) and other audit-related magazines for several years now, but I wanted to do more to educate and encourage auditors in the use of analytics. One day I realized that if I assembled all of my previously published IIA articles, I had about 50% of the content necessary for a book on analytics. So I started developing an outline and writing…
Our analytics team was running on all cylinders and achieving significant results. There was not just my opinion, we received an ISACA Award of Excellence at the Info Tech Audit ’95 conference for leadership and contribution to IT Audit Community. Amazingly, it was a $1,000 cash award. The team (3 people) went for out for a celebratory dinner and donated the remaining funds to a local charity. By how we…