digitisation – what does this mean to internal audit? · internal audit, risk, business &...

Internal Audit, Risk, Business & Technology Consulting

DIGITISATION – WHAT DOES THIS MEAN TO INTERNAL AUDIT? IIA Breakfast Seminar

November 2016

© 2016 Protiviti Inc. An Equal Opportunity Employer M/F/Disability/Veterans. Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services. All registered trademarks are the property of their respective owners.

TODAY’S AGENDA

Q&A

Digitisation and Internal

Audit

Digitisation Risks

What is Digitisation?

2


WHAT IS DIGITISATION? 3


MEANING OF DIGITISATION

Digitisation is the usage of technology and digital advances, such as analytics, mobility, social media and smart embedded devices, to radically improve performance or reach of enterprises.

With Digitisation, companies across industries are racing to migrate “analog” approaches to customers, products, services and operating models to an “always-on”, real-time and information-rich marketplace.

4


DIGITISATION OVER TIME

• 2400s – Abacus Invented

• 1930s – First Computer

• 1970s – First Personal Computer

• 1990s – Emergence of the Internet

• 2000s – Emergence of Mobile Computing

• 2010s and Beyond – Peer-to-Peer Businesses, Smart Devices, Blockchain, and Digital Currencies

Technological advancements have dramatically changed the way we live, interact and do business.


DRIVING FORCES OF DIGITISATION

Real-time, online reporting of customer account activity.

Purchased devices are ready for immediate use.

Organisations have continuous access to customer data.

Transactions are approved in minutes.

Customer Expectations…

6


Customer Engagement Exploring new ways to build strong relationships with customers

Digitising Products & Services Launching new, enhanced products, and exploring new business models

Business Analytics & Decision Science Exploiting enhanced data analytics to improve decision making

Operational Performance Creatively using technology to improve performance

THE DIGITAL WAVE OF CHANGE

Digital Strategy 1

Digital Transformation Governance 2

Innovation Culture 3

Functional Transformation 4


ACCELERATED TRANSFORMATION

Meeting Expectations…

Companies must adapt and accelerate.

It is more than just process automation – this requires transforming entire business operations.

8


REDEFINING COMPANY VALUES

1

2

3

4

8

7

6

5

Customer Experience

Digital Culture

Channel Options

Regulatory Governance

Real-Time Responses

Business/IT Agility

Behavioural Analytics

Secure Access

9


TECHNOLOGIES ENABLING DIGITISATION

MOBILE Mobility serves as the cost of entry in the consumer market. Businesses seeking optimisation are already on board with mobile technologies.

SOCIAL Social technologies allow for rapid creation and sharing of knowledge over social networks, enhancing collaboration and information distribution across a business.

ANALYTICS Big data empowers analytics, which generates unprecedented insight to enable real-time boardroom decisions.

CLOUD Cloud computing offers agility, breaking down the barriers of geography and cutting the costs associated with physical server maintenance.

INTERNET OF THINGS (IoT) Environment in which objects, animals, or people are provided with unique identifiers and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction.

10


WHAT LIES AHEAD FOR DIGITISATION?

Digital transformation initiatives will be consolidated into one vision and function.

Digital transformation will become the key strategic thrust for most CEOs.

Digital transformation will require new skills and shifts in IT investments.

Artificial intelligence (AI) will drive new digital transformation revenue streams.

Big data analytics will serve as the foundation of digital transformation.

IoT will be a catalyst for the expansion of digital transformation to all corners of the economy.

WHAT LIES AHEAD FOR Digitisation?

11


DIGITISATION RISKS 12


DIGITISATION MEANS EVEN MORE IT RISK

1

2

3

Firms are using digital technologies to adapt their business models and create new business opportunities.

This has exponentially increased the amount of data produced and collected by companies.

For internal audit, it means that IT risk now spans the breadth of a firm’s operations.

13


FOUNDATIONAL IT RISKS

Cybersecurity Data Privacy User Administration

Change Management

IT Governance

Connecting with

Customers/ Clients

Data Management

Records Retention

Regulatory Compliance

Third-Party/ Vendors Fraud

Foundational IT risks are amplified in business functions and are risks that may not have received priority attention in the past (e.g., marketing, customer service, etc.).

14


EMERGING RISK AREAS

Emerging risk areas demand increased attention as organisations continue to pursue Digitisation opportunities.

Digital Culture

Digital Disruption

Connecting

Broadening Data

Governance

Evolving Technology

Trends

Globalisation of IT

15


DIGITISATION MATURITY STAGES

BEGINNERS EARLY MAJORITY EARLY ADOPTERS LEADERS

Pharmaceuticals & Healthcare

Manufacturing/IP

STAGE BEGINNERS EARLY MAJORITY EARLY ADOPTERS LEADERS

Definition Industries in this category will adopt Digitisation later than other industries. These industries approach Digitisation with a high degree of skepticism and after the majority of industries has adopted it.

Individuals in this category have adopted Digitisation after a varying degree of time. This time of adoption is significantly longer than the Leaders and Early Adopters.

This is the second fastest category of industries who adopt Digitisation. These industries have the highest degree of opinion leadership among the other adopter categories.

Leaders are the first industries to adopt Digitisation. They are willing to take risks, have the highest social class and have great financial lucidity.

FMCG Energy & Utilities

Hospitality

Telecom Retail

Financial Services

High Technology

16


Uber Case Study

BUSINESS IMPACT: DIGITISATION IS DISRUPTING TRADITIONAL MODELS

UBER CASE STUDY

In 2012, revenues for San Francisco’s yellow cab industry were approximately $250M.

Within a year, Uber expanded the yellow cab market cap by approximately 110%.

Uber, introduced in 2012, cut San Francisco’s yellow cab industry revenues to half ($125 million) by the end of 2013.

Uber now has 64% of the existing market share in San Francisco and is disrupting other geographies internationally.

“I’m predicting that over the next 10 years, we will see a number of very significant

disruptions in financial services, let’s call them Uber

moments.”

– Antony Jenkins, Former CEO of Barclays

17


INDUSTRY EXAMPLE: DIGITAL DISRUPTION OF FINANCIAL SERVICES

New Financial Transaction

Giants

Traditional Financial Services

Startups and Emerging Disruptive

Technologies

18


DIGITISATION AND INTERNAL AUDIT 19


INTERNAL AUDIT PERSPECTIVE

• How can the process, measurements, and controls be modified or enhanced?

• What are other companies doing?

• Are you missing out on some best practices?

PAST

INSIGHT OVERSIGHT FORESIGHT

PRESENT

• Is the process operating as planned?

• Are controls, resources, and performance measures adequate and operating effectively?

• Are policies being adhered to as intended?

FUTURE

• Where is this process going? Can it scale as the company grows?

• Will current controls be adequate in the future?

• What planned or future adjustments should be considered?

20


OPPORTUNITIES FOR INTERNAL AUDIT

Stakeholders are open to new ways of consuming insights.

Auditors are looking to build their skills to work effectively in this new world and underwrite their future value to the organisation.

The speed of changes and proliferation of data are creating new opportunities for internal audit to add valuable insights.

21

Deliver Value as the organisation evolves

Review the lifecycle of transformation (e.g., strategy, execution, ROI, security) to help ensure the company has made investments that will have positive outcomes and will remain safe and secure.

EXAMPLES

Social Media Cloud Computing


DIGITISATION’S IMPACT ON AUDIT PLANS

Example Audits to Consider

Cybersecurity Audits

1. Data loss detection evaluation 2. Incident response plan review 3. Insider threat and vulnerability analysis

Information Governance and Data Privacy Audits

1. Information accountability review 2. Personal information mapping review 3. Employee behavior tests 4. Data destruction audit

Mobile Technologies and Applications

1. Data encryption assessment 2. Mobile device management audit 3. Application development security risk assessment

Current Systems and Vendor Audits

1. Systems vulnerability assessment 2. Vendor preparedness review

22


DIGITISATION’S IMPACT ON AUDIT PLANS

23

Digital Transformation Governance and Strategy 1

Functional Transformation & Improvement 2

Innovation Culture 3

New Technologies Assessment 4

Using technology to reinventing Finance, Information Technology, Business Operations, Procurement, Risk Management and Audit.

Ensure that Digital Transformation programmes are established, well defined, set up for success and executed effectively.

Ensuring that the unnecessary barriers to innovation and change that exist within our clients are eliminated.

Supporting the business with decision making as they consider whether/how to embrace new or emerging technologies.

Programme and Project Management Technology Readiness Assessments

Project Assurance/Active Assurance Cyber Security & Privacy

Change Management/Enablement Data Architecture, Analytics & Reporting

Information Technology Financial Control & Reporting

Internal Audit Supply Chain & Vendor Management

Risk Management & Risk Reporting Compliance

Governance of Digital Investment Portfolio Horizon Scanning Capability

Assessing and Developing Innovation Culture

“Fit for purpose” Policy Framework

AI Robotics and Machine Learning RegTech (Regulatory Technology)

Block Chain Revolution Data Analytics/Big Data

FinTech (Financial Service Technology)

Training and Awareness

Internet of Things


TRANSFORMING THE AUDIT PROCESS

AUDIT DATA ANALYTICS

CONTINUOUS AUDITING

BIG DATA

Effective Audits and Fraud Detection

Identifying Multitude of Behaviors

Continuous Assurance

24


QUESTIONS FOR INTERNAL AUDIT TO CONSIDER

Does the current-state internal audit plan consider Digitisation risks? 1

Does IT leadership have a good understanding of the potential control impacts associated with Digitisation? 2

Does the internal audit function understand Digitisation? 3

Do our auditors have the right skills to effectively evaluate Digitisation risks and controls? 4

Does the organisation understand the impacts that Digitisation may have on data privacy, cybersecurity and other regulatory compliance obligations?

5

25


TWO IMPORTANT POINTS

Internal audit needs to integrate an awareness and recognition of digital threats into everything audit — whether this means checking on data sensitivity or auditing for proper information governance protocols. 1

Provide assurance over the organisational threats posed by Digitisation. Failing to do so could make the company’s leadership too risk averse leading to decisions that decrease competitive advantage.

2

26


TODAY’S SPEAKERS

27

Mark Peters is a Managing Director and leads our IT Audit practice in the UK. Mark specialises in supporting clients through outsourced or co-sourced internal audit support arrangements. He has worked in a diverse range of industries including Financial Services, Energy & Utilities and Consumer Products in advisory and internal audit roles for some of the world’s premier global organisations. Mark has over 25 years experience in IT audit, IT risk management, systems implementation and security.

[email protected]

Jonathan Wyatt is a Managing Director and leads our IT Consulting Practice across Europe and has a broad range of experience across Managing the Business of IT, Managing Security and Managing Applications and Data. As part of the global IT Consulting leadership team, Jonathan leads the IT Governance and Risk Management practice on a global basis. Jonathan has over 19 years experience in IT Consulting working with many of the largest organisations around the world across a diverse range of industry segments including Financial Services, Energy and Utilities, Telecommunications, Media and Consumer Products.

[email protected]

digitisation – what does this mean to internal audit? · internal audit, risk, business &...

Documents