Process Mining in Internal Audit - CZ use case
0 likes20 views
Wilco Brouwers and Dave Jansen from CZ share their process mining experience as IT auditors. Also auditors see that the digital transformation is slowly impacting their way of working. Dave and Wilco believe that data analysis skills will become increasingly important for future IT auditors – not only to be more efficient, but also to be more effective. As the frontrunners within their team, Wilco and Dave have developed a new approach for auditing their digital processes of the future. Process mining plays an important role in this new auditing approach. With concrete examples, they showed where they see differences compared to the traditional audit approach in the preparation, fieldwork, reporting, and follow-up steps in their audits.
Process Mining in Internal Audit - CZ use case
- 1. Fluxicon Process mining camp 2017 CZ Internal Audit 1 Don’t wait for the digital wave, start data-driven auditing today!
- 2. Fluxicon Process mining camp 2017 2 Dave Jansen IT Audit Wilco Brouwers IT Audit Head Professional Practices
- 3. Agenda 3 1 Introduction and background 2 Use of process mining 3 Innovation from an audit perspective
- 4. 1. CZ : Health Insurance Company 4 Insured persons 3,6 million Market share 20% Insurance premium € 8.920 million Customer satisfaction 8,0 Employees 2612 ftes Three locations: Tilburg, Goes and Sittard Based in the south of The Netherlands Facts and Figures Main processes: - Insurance and payment of health costs - Focus on innovative care
- 5. 1. Our IT environment 5 Mainframe platform with DB2 Database MS Client/Server with MS SQL database Core systems for main processes on one main platform
- 6. 1. Our Internal Audit Department (IAD) 6 30 auditors (6 IT) Deliver assurance on annual reports… …with little outsource to external accountant About 16 with low BI skills High level of detailed fact finding… .. in a highly automated system So we do less interviews, samples, observations and more data analysis and process mining
- 7. 1. How did we start using Disco? 7 2015 Test/POC Incidentmanagement Business Intelligence 2017 Focus on 4 processes - Policy administration - Declaration - Purchase of goods - Debtors process Datascience Lab 2016 Trial 8 processes Issues data availability Information
- 8. Preparation • Scope/objectives • Understanding the process and current controls • Planning Fieldwork • Audit program • Findings and communication • Impact of findings Reporting • Audit summary, presentation • Agree on practical, realistic recommendations Follow-up • Follow-up review • Adjustments / new recommendations 8 2. Audit process
- 9. Preparation • Connecting 9 applications and determining communal data • 210.076.269 events • +/- 72 hours to extract, modify and merge data Fieldwork Reporting Follow-up 9 2. Data preparation for the ‘Administration of policy holders’ Python SAS Powershell
- 10. 2. Data preparation for the ‘Administration of policy holders’ 10
- 11. Fieldwork • Changes ‘out of the blue’ • Measure quality of work (how work is done) • Compliancy automated controls Reporting Follow-up 11 2. Fieldwork Preparation
- 12. 2. Fieldwork Changes out of the blue 12 Policyholder Mutation Entity Last customer contact System 1 03.02.2017 11:24:03 Core system 22.12.2016 04:03:07 External system 2 11.11.2016 15:26:10 Core system 22.07.2016 23:48:06 Core system 3 25.01.2017 09:12:24 Core system 27.12.2016 11:48:37 Workflow 4 31.03.2016 14:17:08 Core system 08.02.2016 04:02:37 External system 5 04.04.2017 08:30:22 Core system 06.03.2017 14:22:50 CRM 6 24.11.2016 10:59:12 Core system 22.06.2016 04:03:05 External system 7 23.03.2017 10:57:13 Core system 25.01.2017 17:16:06 Workflow 8 27.12.2016 15:27:52 Core system 10.05.2016 16:44:17 Email system
- 13. 2. Fieldwork Measure the quality of work 13
- 14. 2. Fieldwork Compliance of automated controls 14 • Do all signals result in manual task(s)? • Filter based on ‘signal’ • Never followed by manual task within 2 days • Result 424 cases are not ‘compliant’ • Within 4 days every signal is followed by manual task
- 15. 2. Fieldwork Payments with no relation to scanned nota 15 Payment Scan batch Exception, only 2 cases!
- 16. 2. Fieldwork Segregation of duties check effectiveness 16
- 17. • Presentation for management • Less discussion on matters, right to the point • Visualisation helps! 17 2. Reporting Reporting Fieldwork Follow-up Preparation
- 18. 2. Reporting Simplifying the ‘Purchase process’ 18
- 19. Follow-up • In-depth analysis of specific cases 19 2. Follow up Fieldwork Preparation Reporting
- 20. Preparation Fieldwork Reporting Follow-up 20 2. Recap How we use process mining today • Internal control review • Gain integral insight into design and effectiveness of a process • Transaction testing takes only a little more time for more in depth analysis • Better recommendations • In progress: matching effectiveness of a process with the SOLL
- 21. 3. Innovation from audit perspective RECAP Current successes 21 • Detailed insight in processes makes IAD valued partner • Multi flow / multi channel • Identify process improvements New Insight • Test a broad range of transactions • Test design and operational effectiveness • Business more open to admit shortcomings More assurance • Interview becomes a detailed evaluation • Procedure checking not needed at start • Less time needed to discuss or convince Cut off traditional work
- 22. 3. Innovation from audit perspective RECAP Current challenges 22 Constantly changing of IT infrastructure Data availability/applicability in core systems Competencies of audit people: new way of thinking European privacy law (GDPR)
- 23. 23 3. Moving forward Process mining as an auditor tool Process mining as a business value
- 24. Preparation Fieldwork Reporting Follow-up 24 3. Moving forward from audit perspective THE FUTURE VISION • Continous monitoring: - check if systems and controls operate as designed - identify performance gaps and unusual transactions • Continuous auditing: - collecting audit indicators and evidence - analyse compliance with policies, procedures Continuous monitoring Continuous auditing
- 25. 25 3. Innovation from an audit perspective Continuous monitoring Continuous auditing Business perspective CZ strategic drivers • Pressure to improve governance and internal controls • Need to improve performance and remove excess costs Value: enhanced internal controls and improved performance IAD value • Objective insight into the status of controls and transactions • Efficiently test a broader range of transactions and controls Value: greater audit efficiency and effectiveness
- 26. 3. How do we plan to move forward ? 26 IAD improvements fieldwork for all key processes • needs teamwork at IAD side linking financial, process and IT knowledge • changing the way of thinking as an auditor • more integration of the results of process mining into reporting • needs – at least – a solid and stable datawarehouse Business commitment to build up to CM • information managers and datascience lab connected • changing way of looking at data • changing the way of looking at internal control
- 27. 27 Thanks for your attention, we enjoyed !!! Questions and contact information Dave Jansen dave.jansen@cz.nl Wilco Brouwers wilco.brouwers@cz.nl Interested? Join us @ CZ!