Audit's Use of Data Analytics ACL PDF

CEB Audit Leadership Council
Audit’s Use of Data Analytics

A look at the ACL Application
April 2012
Please Contact adr@executiveboard.com with additional questions or comments
Please note that the CEB program names referenced in this document have changed since the time of publication.
Executive Summary
The Audit Director Roundtable receives a number of questions on ACL. To support member
inquiries, ADR collected user feedback on the tool. Respondent experiences and observations are
summarized below.
o All participants appreciate the ACL tool overall and commented on its analytic power. The most
common implementation hurdles are a lack of team and management buy in, gaining access to
desired data, and using the tool to its full potential.
o Effective ACL training methods include in-person and 1:1 training followed by actual usage. ACL
also provides effective training. User guides and online training have proven less successful.
o Some respondents encourage full Audit team usage of the tool while others rely on data analysis
experts within the Audit team. These experts pull data for the rest of the team as needed or help
others use the tool on a one-off basis.
o Respondents report using ACL to better understand business processes, continuously evaluate and
assess risk, provide data for every Internal Audit review, and support the audit plan. Common testing
areas include FCPA, Fraud, Accounts Payable, Accounts Receivable, Journal Entries, Payroll, Sales
Incentives, Balance Sheet, and Travel Expenses.
o In comparison to other vendors such as Excel, IDEA, SAS, Brio, and Focus, ACL is considered to
be more cost effective when it comes to ease of use and power. A couple respondents mention that
Excel continues to increase its functionality but at this point ACL can still handle a much larger
volume of data.
o Several survey participants mention that ACL demonstrates a clear ROI by helping to uncover
potential fraud, providing in-depth reporting to management, and identifying duplicate payments. One
individual identified $300,000 in duplicate vendor payments through use of ACL.
Please note that the CEB program names

referenced in this document have changed
since the time of publication.
2
© 2012 The Corporate Executive Board Company. All Rights Reserved.
Company A – Insurance
• We’ve had the tool for about three years. We have
How long has your company used been using it for simple tasks until last year. Last
ACL? year we did two projects with extensive use of the
application.
What approach did you take to • The application requires training. It is not that user
start using ACL? friendly (drag and drop, auto-relate tables..) for
auditors without IT skills.
• Finding the right accesses and tables to draw the

Did you run into any hurdles information the ACL tool gather was one of the
implementing ACL in your audit
approach? biggest hurdles in implementing the application into
our projects.
Do you have any issues passing

on ACL knowledge throughout
your organization? Which support
was more beneficial (video • Instructor and hands on training.
trainings, instructor, user manual,
Power Point presentations ...)?
What types of processes/tests do • Segregation of duties test, cutoff tests, sampling,

you use ACL for? analytical, agings .
3
Company A – Insurance: Continued
Did you compare ACL with

other data analytic software • Before we started using ACL we used Brio and Excel
(which ones?) & do you query. Excel query is limited in the amount of data it
can handle. Brio is more user friendly but it doesn’t
consider that ACL is the best have all the features (look for duplicates, etc.) that
tool for the intended ACL has.
functionalities?
Does your company have a

dedicated team of auditors
using ACL to analyze data
on a continuous basis or is
ACL been used by all your • We are starting to train all the auditors.
auditors to analyze data
each time they perform an
audit?
Do you feel ACL has added

value to your company & if • Once the scripts are created for a project, they can be
so, describe how ACL adds run periodically which adds to the efficiency of the
more value than Excel or project. Also ACL can handle large amounts of data.
another tool?

4
Company B – Energy
How long has your company used
ACL? • Approximately 4 years.
What approach did you take to start • I took ACL training on data analytics presented by ACL.
using ACL?
• Yes. We still don’t have ACL fully implemented in IA. I am the only person using
Did you run into any hurdles ACL. We have contractors who work on contract audits who use ACL. If I am
implementing ACL in your audit stuck I try to get their help. We do not use ACL on continuous basis as there are
approach? not many audits planned that would require ACL. You forget the use of ACL
functionalities if it is not used all the time
Do you have any issues passing on

ACL knowledge throughout your
organization? Which support was more • Yes. It will be difficult to pass ACL knowledge throughout the organization.
beneficial (video trainings, instructor, Instructor and user manual was more beneficial.
user manual, Power Point
presentations ...)?
What types of processes/tests do you • Use basic tests in visa and FCPA audits. Use trending, key word search and
use ACL for? other functions like classify and summarize the data.
What functionalities of ACL do you use?

Does your company find value in the • Use basic functionalities as mentioned above. There would be added value for
Direct Link but due to budget cuts and limited use of ACL, management has not
added functionalities like Direct Link? placed this as high priority.

5
Company B – Energy: Continued
Did you compare ACL with other data • We have not compared with other data analytic tools
analytic software (which ones?) & do and don’t truly know if ACL is the best tool. However,
you consider that ACL is the best tool it has given good results for our audits even with
for the intended functionalities? limited use
Does your company have a dedicated

team of auditors using ACL to analyze
data on a continuous basis or is ACL • Only one person is currently using ACL in limited
been used by all your auditors to capacity in Internal Audit.
analyze data each time they perform
an audit?
What do you think can be the major • Continuous monitoring/auditing would be beneficial to
outputs of ACL from the Internal Audit
perspective? IA.
• In some of our audits only. Don’t know about overall

Do you feel ACL has added value to benefits due to limited use. Company has benefited
your company & if so, describe how by contractors using ACL in Contract Audits. This has
ACL adds more value than Excel or
another tool? resulted in good recovery rates from overpayment to
the suppliers.
Overall, what do you consider the • ACL is a good tool but no comment on comparing
advantages and the disadvantages of with other tools. This is due to limited knowledge in
ACL as compared to other tools? the comparison space.

6
Company C – Real Estate
How long has your company used ACL? • 3 years.
• Purchased desktop and AX. Trained the entire

What approach did you take to start using
ACL? internal audit department. Started incorporating
the tool in projects, where possible.
Did you run into any hurdles implementing

ACL in your audit approach? • Learning where the data resides.
Do you have any issues passing on ACL

knowledge throughout your organization? • ACL trainer is best. We used a combination of
Which support was more beneficial (video
trainings, instructor, user manual, Power
hiring ACL trainers, inter-department training, and
Point presentations ...)? online training.
What types of processes/tests do you use

ACL for? • Data intensive areas…AP and AR mostly.
Did you compare ACL with other data

analytic software (which ones?) & do you • Compared against IDEA. Company thought ACL
consider that ACL is the best tool for the
intended functionalities? was a superior product.
7
Company C – Real Estate: Continued
dedicated team of auditors
using ACL to analyze data on •Many projects would not benefit from using ACL, but we try to
a continuous basis or is ACL incorporate ACL in every project. We use ACL on an ad-hoc
basis, and some tests are automated (script runs daily and emails
been used by all your exceptions to process owners).
auditors to analyze data each
time they perform an audit?
What do you think can be

the major outputs of ACL •Being able to test 100% of a population.
from the Internal Audit
perspective?

value to your company & if •ACL has added value. The tool is much more powerful than
so, describe how ACL adds Excel. Just identifying duplicate payments has saved the
more value than Excel or company over $300k to date.
another tool?
•Advantages are that the tool allows you to perform tests that you
Overall, what do you could not perform with many other tools in the market. The
consider the advantages and desktop version is relatively inexpensive. The technical support
the disadvantages of ACL as department is exceptional.
compared to other tools? •Disadvantages are that the tool takes training in order to use
effectively.
8
Company D – Manufacturing

ACL? • At least 11 years.
• In my 11 years with the company we have went through some training provided by ACL.
What approach did you take to start Training was a basic introduction. Most staff learn ACL simply by using it. Once folks use
using ACL? it they seem to like the powerful nature of it and want to use it again. The tough part is
getting access to the data and understanding the data we receive.
Did you run into any hurdles • We do not use the new ACL Exchange - only the stand alone (server) edition. So the
only hurdle is getting data to plug into ACL and analyze. I understand folks who
implementing ACL in your audit upgraded to Exchange have some troubles at first getting ACL to recognize their servers
approach? and databases.
Do you have any issues passing on

ACL knowledge throughout your
organization? Which support was • I've provided a few training sessions to our staff and find that face-to-face instruction
works best when you actually show folks with real data how to do things. You have to be
more beneficial (video trainings, very careful using real data and live demonstrations, however.
instructor, user manual, Power Point
presentations ...)?
• With increasing functions available in Excel a lot of what we do can be done in Excel
What types of processes/tests do you now. ACL can age quite easily, do binford number analysis in one click, and also extra
data that meet certain criteria. Some folks on our staff use it for more advanced things
use ACL for? like healthcare claims auditing or fraud. Most folks use it for data extraction from large
files and simple things like binford, aging, and classifying.
What functionalities of ACL do you

use? Does your company find value
in the added functionalities like Direct • I am not familiar with Direct Link - we do not use that to the best of my knowledge.
Link?
9
Company D – Manufacturing: Continued
• I've heard some folks indicate that IDEA is very comparable. ACL was
Did you compare ACL with other data being used when I started with the company 11 years ago so I am not
analytic software (which ones?) & do sure why we selected ACL at that time. We have a hard enough time
you consider that ACL is the best tool getting folks to use software we've had for years so it would likely be a
for the intended functionalities? real struggle to change now.

team of auditors using ACL to analyze • The folks in our department who use it most is our Data Analytics guy
data on a continuous basis or is ACL on the "Fraud Team" and our HealthCare auditors. But anyone who
been used by all your auditors to has a need for it has access via our server edition. Just most folks
analyze data each time they perform choose not to use ACL and do their own analysis in Excel.
an audit?
• Ability to audit the entire population, look for trends and abnormalities
What do you think can be the major of entire data sets and you can physically choose the sample items
outputs of ACL from the Internal Audit instead of asking for certain items in a file. Classify, Extract
perspective? commands.
Do you feel ACL has added value to

your company & if so, describe how • Yes, ACL does things Excel cannot do - but as Excel progresses the
ACL adds more value than Excel or gap between the two seems to be closing.
another tool?
Overall, what do you consider the • Advantages above. Disadvantages are unknown since I am not
advantages and the disadvantages of familiar using other software - however, the biggest issue for us is
ACL as compared to other tools? getting the data.

10
Company E – Media
• My company has been using ACL since its inception

How long has your company in 2006. It was used by the predecessor company
used ACL? for several years before that. I personally have been
using ACL since 1991.
• We had everyone in the department (IT and

What approach did you take to Financial) attend two rounds of ACL training, and
start using ACL? then required the use of ACL on nearly every
engagement.
Did you run into any hurdles • Minimal. Certain organizations are more difficult to
implementing ACL in your audit get data from, and some of our auditors are more
approach? adept at the software.
Do you have any issues

passing on ACL knowledge
throughout your organization?
Which support was more • Not so far, as I have been the torch-bearer.
beneficial (video trainings,
instructor, user manual, Power
Point presentations ...)?
11
Company E – Media: Continued
• Sales and billing, including contract and sales administration, audience

deficiency analysis
• Sales commissions
• Accounts receivable, cash and collections
What types of • Trade and barter
• General accounting and financial statements
processes/tests do • Procurement and disbursements, including the use of petty cash and
purchasing cards
you use ACL for? • Payroll
• Programming
• Fixed Assets
• Trafficking
• Travel and entertainment expenses
• Edit
What • Filtering
• Defining new, computed fields
functionalities of • Data
ACL do you • Extraction and exportation
• Joining and merging tables
use? Does your • Sorting
• Analyze
company find • Count records
• Total fields
value in the added • Run statistical analysis on fields
• Stratify and classify on fields
functionalities like • Summarize
• Perform Benford Analysis
Direct Link? • Look for gaps and duplicates

12
Company E – Media: Continued
analytic software (which ones?) & do
you consider that ACL is the best tool • No, we did not compare.
for the intended functionalities?

data on a continuous basis or is ACL
been used by all your auditors to • All auditors are trained to use ACL.
an audit?
What do you think can be the major

outputs of ACL from the Internal Audit • Analysis of 100% of your data to determine anomalies for additional
perspective? scrutiny.

your company & if so, describe how • ACL adds value in the predefined functions that it has and its self-
ACL adds more value than Excel or documenting nature providing an audit trail.
another tool?
Overall, what do you consider the

advantages and the disadvantages of • I don’t have any experience with its contemporary competitors, but in
ACL as compared to other tools? 1991, it was light years ahead of anything else on the market.
• It can take a special kind of auditor to take ACL and make it effective
Any other considerations/ info you and efficient. Someone who likes to dive into the data, wade around in
would like to share? it, and then see what is really there. Not everyone likes to do that, but
when someone does, it’s a powerful tool.
13
Company F – Government
ACL? • 4 years.
What approach did you take to start

using ACL? • Formal training.
Did you run into any hurdles • A major hurdle is having the auditors understand that data analysis can
implementing ACL in your audit change the way they do audits – from risk assessments, to conducting
approach? the audit, to reporting and follow-up.
Do you have any issues passing

on ACL knowledge throughout
your organization? Which support • Instructor-led training with immediate use by the auditors is key to the
was more beneficial (video implementation of ACL in supporting audits. It is also useful to have an
ACL expert available to provide occasional advice and support.
trainings, instructor, user manual,
Power Point presentations ...)?
• Understanding the business process – we use summaries and

trend analysis over multiple years to understand the business
(operations, etc).
What types of processes/tests do • Conduct – test key controls, recalculate key measures, identify
you use ACL for? Risk indicators of risk, analyze business processes, determine differences
assessment – we use trend between areas (e.g. regions) and perform directed and statistical
analysis, including comparisons samples.
with other entities and previous • Follow-up – re-run analyses to determine if control weaknesses have
fiscal years, and control testing be addressed and recommendations implemented.
• Continuous risk assessment – re-run key risk indicators and
compare to baseline levels.
14
Company F – Government: Continued
• We use the standalone version of ACL. Key

What functionalities of ACL functionalities include: read only access to data;
do you use? Does your ability to read data for many different platforms and
company find value in the systems; the automatic logging feature (commands
added functionalities like and results); ability to export to other software in
Direct Link? order to provide clients with information; the ability to
relate multiple tables.
Did you compare ACL with

other data analytic software • We have compared with IDEA, SAS, FOCUS, EXCEL
(which ones?) & do you and other analysis software. The software is user-
consider that ACL is the best friendly, powerful and flexible. ACL also has built-in
tool for the intended features and commands that are specific to audit; and
functionalities? the scripting language is easy to learn and use.

dedicated team of auditors • We use a combination approach. ACL experts will
using ACL to analyze data obtain and prepare data files as well as perform more
on a continuous basis or is complex analyses and build scripts for use by the
ACL been used by all your audit teams. All auditors are required to have a
auditors to analyze data minimum level of ACL expertise and are able to run
each time they perform an scripts and perform basic ACL commands.
audit?
15
Company F – Government: Continued
• ACL can improve your understanding of the audit entity and business operations,
What do you think can contributing to improve identification and assessment of risk. This leads to
improved scope and audit objectives. During the conduct and reporting phase,
be the major outputs of ACL will improve the efficiency and effectiveness of the audit
ACL from the Internal process. Being able to re-run analysis can significantly improve the follow-up
process. On an ongoing basis ACL can be used as part of a continuous auditing
Audit perspective? process to perform an ongoing assessment of risk and testing of key controls.
Do you feel ACL has • ACL has improved the internal audit function in the planning, conduct, reporting
added value to your ,and follow-up of every audit (not just financial audits). It is more powerful than
Excel – having audit specific commands, numerous functions to perform specific
company & if so, tasks. It has a logging feature that supports supervisory review; can not alter or
damage the source data; is easy to use; and has a simple but powerful scripting
describe how ACL adds language. In addition, it reads mainframe EBCDIC and PC ASCII data with
conversion and can read data in a wide variety of formats (Excel, Access,
more value than Excel or reports, PDF, etc).
another tool?
Overall, what do you • ACL is easy to use. It does not require auditors to learn programming
consider the advantages languages like visual basic to take advantage of the power of its
scripting language. It is low cost to start (standalone) but offers a
and the disadvantages of solution that allows the user to expand if necessary (Audit Exchange,
ACL as compared to etc). ACL offers excellent training and user support as well as
consulting services.
other tools?
Any other • Any audit function not using data analysis is quite simply not as efficient
considerations/ info you or effective as they should be. ACL allows you to take audit to the next
level where audit can provide significant value to senior management.
would like to share?
16
Company G – Leisure
How long has your company • For the last 1.5 years. Our company used it several years before, then there
was a gap of a few years where the company used IDEA, and then switched
used ACL? back to ACL.
• The department established a data analytics team, which was using IDEA at the
What approach did you take to time. As part of our long-term planning we analyzed the pros/cons of the
software packages to see which best aligned with our long term data analytics
start using ACL? plan and ACL came out on top.
• Yes – some were technology hurdles which were not terribly difficult, such as
data access (e.g. – we installed the ACL Direct Link product for our SAP
Did you run into any hurdles environment). On the other hand, some of our other data access challenges
implementing ACL in your audit are more significant once we move outside of the SAP environment. The
approach? bigger challenge is probably changing our thinking from traditional audits and
audit approaches. Another challenge has been integrating reporting from ACL
work into our audit reporting.

passing on ACL knowledge • At this point, we have not really passed ACL knowledge throughout the
throughout your organization? organization. Outside of the data analytics team, the rest of the organization is
a consumer of the data ACL produces, but are not really ACL users yet. I think
Which support was more the most beneficial method for us will be instructor-led training, with the
beneficial (video trainings, instructors primarily being the data analytics specialists. I’m not a fan of video
instructor, user manual, Power training, and it’s very doubtful anyone will read user manuals.
17
Company G – Leisure: Continued
What types of processes/tests do • Journal entry testing, AP testing, time and expense, fraud
investigation, base lining, and balance sheet testing. We have
you use ACL for? plans to add to that list this year and beyond.
What functionalities of ACL do • Aside from desktop, we rely heavily on Direct Link. We have just
you use? Does your company implemented AX Core and will be deploying analytics to that
platform this year. We did not purchase any other add-ons with
find value in the added AX, such as exception management. Within desktop, we use
functionalities like Direct Link? most of the built-in functionality including a lot of scripting.
• Yes, primarily with IDEA, which we were already using. There are a
few other players, but for our needs and budget, those were the
primary contenders. IDEA is a strong piece of software with good
scripting functionality, however ACL won out primarily due to:
• Scripting – Although IDEA has a pretty good scripting engine and

good documentation, it is more difficult to learn than ACL’s scripting,
unless you have a programming background. Also, (in my opinion)
the ACL user interface is a little easier to use.
• Cost – Despite the stereotype that ACL is a more expensive product,

Did you compare ACL with when we priced out the cost of extending out our capabilities over
other data analytic software time with the more advanced products (i.e. ACL’s AX and Exception
Management and the comparable IDEA Server and Caseware
(which ones?) & do you Monitor) and the software/hardware/consulting required to support
consider that ACL is the best them, the costs were very similar and ACL actually priced out a little
tool for the intended cheaper in our comparison.
functionalities? • Support – ACL 24x7 premium support is top-notch and the hands-
down winner. A comparison of the two isn’t even worth discussing.
• User Community – The ACL user community system is world-wide

and very mature. The online user forums are a fantastic resource,
and virtually every major city has a local ACL user group. My
research into the IDEA user community showed it to be nascent at
best.
• (note – this research comparison was done in late 2010)

18
Company G – Leisure: Continued
dedicated team of auditors using
ACL to analyze data on a • We have a dedicated data analytics team that uses ACL and produces information for
continuous basis or is ACL been consumption by the rest of the audit group. Most of this is on an audit-by-audit basis, but
used by all your auditors to we plan to deploy some continuous analytics this year.
analyze data each time they
perform an audit?
• Some of the outputs are similar, in that some of our data analytics work results in audit
reports, albeit on a different scope than our other audits. The primary benefit is obviously
What do you think can be the that we can test a wide range of data versus one entity at a time with the traditional model.
We’re still trying to define what the outputs from our analytics work should be, but I think
major outputs of ACL from the they could include dashboards and exceptions from continuous audit activities. It is also
Internal Audit perspective? very useful when performing many types of investigations and fraud work. Another
“output” is new processes that we can deploy to help our audit team get more coverage,
target their testing, and be more efficient.

value to your company & if so, • Yes – for many of the reasons already mentioned – increased coverage and automation
describe how ACL adds more probably being the biggest at this point. Some of the testing can also be centralized,
value than Excel or another depending on where the data is stored.
tool?
• Text from above covers most of the advantages vs. comparable tools. There are
obviously other tools that have more features and are more robust (e.g. – SAS), however
Overall, what do you consider when you look at the capabilities of the product and what we are using it for, I believe it is
the advantages and the the best option, considering cost and complexity. I think the biggest area for improvement
in the product is in reporting, where it’s extremely lacking. If it had tighter integration with
disadvantages of ACL as Excel through scripting, or had dashboard capabilities similar to a product like Tableau, it
compared to other tools? would be a HUGE plus. I also think they could stand to integrate more built-in features,
like automatic fuzzy-matching and other statistical analyses. I think that’s a big hole in the
product as well.

19
Company H – Financial Services
How long has your company
used ACL? • 3 years.
• We chose an area within the business (AP&P) and held scoping

What approach did you take to meetings with the key stakeholders to map the processes and identify
start using ACL? where ACL could be used to automate existing manual analysis and
implement new tests.
Did you run into any hurdles • Yes, building confidence within the business that ACL was a tool that
they could benefit from was a big hurdle. We needed well structured
implementing ACL in your audit practical examples to show why ACL would provide functionality that
approach? could not be done in Excel.

passing on ACL knowledge • ACL knowledge transfer has been difficult. Initially all Internal Audit members
were trained but this approach didn’t prove very effective, since most of the
throughout your organization? team didn’t use the tool for a while. After some time they just couldn’t
Which support was more remember how to do certain things. We have one ACL champ and all work
beneficial (video trainings, involving ACL ends up with that person, mostly because of the need to have
the results quick. We do have a plan to have one additional member proficient
instructor, user manual, Power in ACL, but probably no more than two.
• We try to use ACL in every IA review, eliminating sampling as much as

What types of processes/tests possible. On top of that, we have been implementing continuous
do you use ACL for? controls monitoring in various areas of the business such as AP&P,
Payroll, Fixed Assets, Purchasing Cards, Revenue, etc.

20
Company H – Financial Services:
Continued
• We use both Direct Link and Audit Exchange. Direct Link is great for our
What functionalities of ACL do Continuous Controls projects, although sometimes it can be tricky finding the
you use? Does your company right data since DL accesses the tables and the end-users usually don’t have that
find value in the added knowledge, so we still require assistance from SAP IT at times. With Audit
Exchange, we are still running version 1, but are keen to upgrade to have the
functionalities like Direct Link? functionality of non-ACL users running pre-written scripts.
Did you compare ACL with other

data analytic software (which
ones?) & do you consider that • I have not used other data analytics tool and I was not working for my current
employers when ACL was purchased.
ACL is the best tool for the
intended functionalities?
What do you think can be the • Savings to the business. Enabling the business to recover lost money has given
major outputs of ACL from the great visibility of ACL within the company, and that can be easily achieved with
Internal Audit perspective? very simple tests like “Duplicates on payments”.
Do you feel ACL has added • Definitely adds value to the company. The stakeholders are usually surprised on
value to your company & if so, how quickly we can produce meaningful information, even using data from
describe how ACL adds more completely different sources. To demonstrate its advantage over Excel, for
example, we show how ACL can deal with millions of records and perform
value than Excel or another repeated tasks a lot simpler and safer that writing macros.
tool?
Overall, what do you consider • Advantages: powerful embedded analytics, unlimited records, easy access to
the advantages and the SAP, trail of commands (log), read-only, flexibility with the import/export.
• Disadvantages: DirectLink doesn’t have standard reports (only access tables),
disadvantages of ACL as lack commands to use the views better (like transferring views from one table to
compared to other tools? other)… I’m a big fan of ACL, so can’t think of many disadvantages.
21
Company I – Aerospace & Defense
How long has your company used ACL? • 11 years.
What approach did you take to start using

ACL? • Group training.
Did you run into any hurdles implementing • Lack of users knowledge of systems, data and
ACL in your audit approach?
desire to change approaches.

knowledge throughout your organization?
Which support was more beneficial (video • Not really, experience and one on one support
trainings, instructor, user manual, Power doing projects works best.
• User account management, AP duplicate

What types of processes/tests do you use
ACL for? payments, FCPA, Inventory, Master data, change
history, etc.

analytic software (which ones?) & do you • Yes multiple times and yes it is the best tool (or
consider that ACL is the best tool for the
intended functionalities? we would use something else).
22
Company I – Aerospace & Defense:
Continued
been used by all your auditors to • Available to all auditors, core team does most complex analysis.
an audit?
• The outputs are only limited to knowledge, time and desire, it's just a
tool. Populations, samples and exceptions/discrepancies. Things like
What do you think can be the major data analyses, comparisons between master and transaction data,
statistical information from transactions, potential transactions to follow-
outputs of ACL from the Internal Audit up for detailed fraud testing, duplicate payments,
perspective? accounts/badges/computers or other company assets assigned to
terminated users, etc.

your company & if so, describe how • Yes, ACL with Direct Link is not really comparable to other
ACL adds more value than Excel or general purpose tools.
another tool?
Overall, what do you consider the

advantages and the disadvantages of • Read only, log, scripting, direct access to SAP data.
ACL as compared to other tools?
• The real challenge for auditors is how well they identify risks,
understand the relevant processes where the controls reside,
and can they translate those process to the table/field level data
Any other considerations/ info you required to do any significant analysis or CAAT. It's not a tool
would like to share? question, it's a skill set and network (I.e. network within their IT
organization) question.
23
Company J – Financial Services
How long has your company used ACL? •Approximately 4 years.
What approach did you take to start using •Informal, ad hoc approach taken to data analytics. Compared
ACL? audit analytic tools available and selected ACL as tool of choice.
•Perception that data analytics was ‘technical’ and an ‘IT domain’.

Did you run into any hurdles implementing Need to demonstrate the value ACL brought over and above
ACL in your audit approach?
traditional audit techniques.

knowledge throughout your organization? •Once a business area was engaged, it was relatively easy to
Which support was more beneficial (video demonstrate the return on investment. Product demo’s and
trainings, instructor, user manual, Power PowerPoint's were most effective.
•ACL is used to support the annual audit plan and undertake data
What types of processes/tests do you use analysis to test controls. Continuous auditing is currently in place
ACL for? for vendor duplicates, expense analysis, travel analysis, general
ledger user access and investment monitoring.
•Up until recently we were an ACL desktop shop only and made
What functionalities of ACL do you use? use of standard pre-built functionality and ability to script
Does your company find value in the added
functionalities like Direct Link? continuous routines. Currently implementing AX3 Core and
Exception to leverage benefits from the server solution.
24
Company J – Financial Services:
Continued
analytic software (which ones?) & do you
consider that ACL is the best tool for the • Yes, IDEA was compared and ACL selected.
intended functionalities?
Does your company have a dedicated team • There is a dedicated data analytics team (2FTE) that provide subject matter
of auditors using ACL to analyze data on a expertise, deliver continuous auditing solutions and drive the strategy. We
continuous basis or is ACL been used have also rolled out ACL training to a large percentage of the senior auditor
by all your auditors to analyze data each population to try and ensure that data analytics (and use of ACL) is an
time they perform an audit? available skill set to utilize in support of the audit plan.
• 100% coverage of data to identify all exceptions/control failures and quantify

What do you think can be the major issues to support audit reports. Continuous auditing solutions also provide
outputs of ACL from the Internal Audit timely insight into business processes and controls and can help to inform
perspective? planning of future audit work.
Do you feel ACL has added value to your • Yes it does add value. It provides value through ability to run complex queries
company & if so, describe how ACL adds easily through the standard menu options, creates a log to provide audit trail of
more value than Excel or another tool? activity and scripting allows for repeatable tests to be created.
• Advantages -Audit log, ability to handle large volumes of data, ability to

Overall, what do you consider the automate analytics and read only access to data. Disadvantages – poor script
advantages and the disadvantages of ACL syntax/error messages in desktop, graphing and reporting functionality poor
as compared to other tools? (data exported and excel utilized) and testing of new desktop releases does not
seem to eradicate major bugs (that delays our decision to upgrade) .
Any other considerations/ info you would • Support has always been excellent (both ACL directly and UK channel
like to share? partners).

25
Company K – Insurance
How long has your company

• 6+ years.
used ACL?
What approach did you take to • Provided software to staff and an introductory onsite training by ACL - folks were then
encouraged to use ACL in their projects and this accounted for 5% of their annual
start using ACL? performance objectives.
• Our department still does not have a large volume of users. In the last couple of years,
Did you run into any hurdles we scaled back to 5 licenses. We implemented a Data Analytics team (staff of 4 today)
over the last couple years, however they seem to primarily use Access and Excel. One
implementing ACL in your audit hurdle is getting people comfortable using it. Our Data Analytic team is comprised of
approach? folks that had experience using other tools such as Access, so their unfamiliarity with the
tool has contributed to limited use.

passing on ACL knowledge • There is a good handful of auditors that are knowledgeable in the use of ACL and
throughout your organization? frequently use it in their audits. We have created a repository of training material, have
had onsite classes instructed by ACL and have an "analytics used" repository list that we
Which support was more initiated. There are still many folks not using these tools, however. The best support
beneficial (video trainings, was having an onsite instructor, and when that is not feasible… the video trainings are
great. The ACL knowledge base and their support services are excellent too, and they
instructor, user manual, Power are quick to help us resolve any issues we run across.
26
Company K – Insurance: Continued
What types of processes/tests do you •Assessing operational areas, transactions, system calculations,
use ACL for? payroll activity, disbursements, collections, etc.
•Data integrity/validation, looking for duplicate, classification and

What functionalities of ACL do you stratification, generating statistics, population analytics to test
use? Does your company find value controls or to select a risk-based sample, Benford Analysis
in the added functionalities like Direct
Link? (recently used). We have limited scripting knowledge in the
department. I have not even heard of Direct Link.
Did you compare ACL with other data •The department had ACL when I joined. I'm not sure what
analytic software (which ones?) & do comparisons were done to other tools. I consider ACL to be the
you consider that ACL is the best tool best tool for the intended functionality, however I'm not familiar
for the intended functionalities? with other products other than Excel or Access.

team of auditors using ACL to analyze •ACL is available for all auditors to use. We have a dedicated
been used by all your auditors to Data Analytics team of 4, however they are not required to use
analyze data each time they perform ACL. At least one uses it regularly.
an audit?
What do you think can be the major •Population Testing, the graphs are also useful, telling the story
outputs of ACL from the Internal Audit
perspective? with data provides facts rather than just opinions.

27
Company K – Insurance: Continued
Do you feel ACL has • I think ACL has added value to my company. ACL has functionality
added value to your built-in to tackle key analytic steps in quick and simple commands (i.e.
table joins, duplicate analysis, stratification) to allow data to be quickly
company & if so, converted into usable analysis for decision making, risk identification
and quick identification of gaps, issues or other control
describe how ACL concerns. Excel is a great tool, but seems to require more steps and
adds more value than more intricate knowledge of the particular commands and tools, and it
can't do everything that ACL can… certainly not as quickly either.
Excel or another tool?
Overall, what do you

• The advantage of ACL is to quickly analyze large volumes of data in a
consider the usable format. The disadvantages can be getting the data to properly
input, depending on the format. ACL also has some little ticks and
advantages and the finicky elements that a user has to get accustomed to, otherwise they
disadvantages of ACL may give up quickly when hitting a road block (i.e. sampling on a
filtered set of data requires you to perform a "count" first… otherwise
as compared to other the sample pulls from the full set of data – pre-filter).
tools?
Any other • Like any tool, ACL is most usable and beneficial when you understand
considerations/ info what it has to offer and how to perform the intended analysis. The first
hurdle is getting folks comfortable using the tool, then overcoming the
you would like to challenge of how best to get the actual data needed to perform the
right analysis.
share?

28
COPIES AND COPYRIGHT
As always, members are welcome to an unlimited number of copies of the materials
contained within this handout. Furthermore, members may copy any graphic herein
for their own internal purpose. The Corporate Executive Board requests only that
members retain the copyright mark on all pages produced. Please contact your
Member Support Center at +1-866-913-8102 or
exbd_support_fin@executiveboard.com for any help we may provide. The pages
herein are the property of the Corporate Executive Board. Beyond the membership,
no copyrighted materials of the Corporate Executive Board may be reproduced
without prior approval. COPIES AND COPYRIGHT
LEGAL CAVEAT
The Audit Director Roundtable has worked to ensure the accuracy of the information
it provides to its members. This report relies upon data obtained from many sources,
however, and the Audit Director Roundtable cannot guarantee the accuracy of the
information or its analysis in all cases. Furthermore, the Audit Director Roundtable is
not engaged in rendering legal, accounting, or other professional services. Its reports
should not be construed as professional advice on any particular set of facts or
circumstances. Members requiring such services are advised to consult an
appropriate professional. Neither the Corporate Executive Board nor its programs
are responsible for any claims or losses that may arise from a) any errors or
omissions in their reports, whether caused by the Audit Director Roundtable or its
sources, or b) reliance upon any recommendation made by the Audit Director
Roundtable .

CORPORATE EXECUTIVE BOARD
WWW.EXECUTIVEBOARD.COM
Audit Director Roundtable
Corporate Executive Board

1919 North Lynn Street
Arlington, VA 22209
Telephone: +1-571-303-3000
Fax: +1-202-303-3100
The Corporate Executive Board Company (UK) Ltd.

Victoria House
Fourth Floor
37–63 Southampton Row
Bloomsbury Square
London WC1B 4DR
United Kingdom
Telephone: +44-(0)20-7632-6000
Fax: +44-(0)20-7632-6001

Please Contact adr@executiveboard.com with additional questions or comments since the time of publication.

Audit's Use of Data Analytics ACL PDF

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Audit's Use of Data Analytics ACL PDF

Hochgeladen von

Copyright:

Verfügbare Formate

CEB Audit Leadership Council

Audit’s Use of Data Analytics

Please note that the CEB program names

• Finding the right accesses and tables to draw the

Do you have any issues passing

What types of processes/tests do • Segregation of duties test, cutoff tests, sampling,

Did you compare ACL with

Does your company have a

Do you feel ACL has added

Please note that the CEB program names

Do you have any issues passing on

What functionalities of ACL do you use?

Please note that the CEB program names

Does your company have a dedicated

• In some of our audits only. Don’t know about overall

Please note that the CEB program names

How long has your company used ACL? • 3 years.

• Purchased desktop and AX. Trained the entire

Did you run into any hurdles implementing

Do you have any issues passing on ACL

What types of processes/tests do you use

Did you compare ACL with other data

What do you think can be

Do you feel ACL has added

How long has your company used

Do you have any issues passing on

What functionalities of ACL do you

Does your company have a dedicated

Do you feel ACL has added value to

Please note that the CEB program names

• My company has been using ACL since its inception

• We had everyone in the department (IT and

Do you have any issues

• Sales and billing, including contract and sales administration, audience

Please note that the CEB program names

Does your company have a dedicated

What do you think can be the major

Do you feel ACL has added value to

Overall, what do you consider the

What approach did you take to start

Do you have any issues passing

• Understanding the business process – we use summaries and

• We use the standalone version of ACL. Key

Did you compare ACL with

Does your company have a

Do you have any issues

• Scripting – Although IDEA has a pretty good scripting engine and

• Cost – Despite the stereotype that ACL is a more expensive product,

• User Community – The ACL user community system is world-wide

• (note – this research comparison was done in late 2010)

Please note that the CEB program names

Do you feel ACL has added

Please note that the CEB program names

• We chose an area within the business (AP&P) and held scoping

Do you have any issues

• We try to use ACL in every IA review, eliminating sampling as much as

Please note that the CEB program names

Did you compare ACL with other

How long has your company used ACL? • 11 years.

What approach did you take to start using

Do you have any issues passing on ACL

• User account management, AP duplicate

Did you compare ACL with other data