The majority of audit departments don’t believe they’re utilizing data analytics effectively. One aspect of better utilization is combining the strengths of two or more applications to achieve superior results. This session provides practical guidance and examples of how to combine audit-specific analytics technology with general data visualization tools to drive improved performance, better outcomes and more business value. In 90 minutes, you'll come away knowing: Why data-driven auditing can save time and increase internal audit assurance, coverage and quality. Learn to distinguish between exploratory and confirmatory queries and how Arbutus and visual reporting tools like Tableau can work together to streamline internal audit data preparation and analysis. Why methodology is so important. Understanding a repeatable process for brainstorming, documenting query design features and cross-referencing data queries. Step through specific examples of this approach that showcase how finance and audit professionals can surface previously unidentified findings in accordance with accounting policy.

1. 6/11/2019
1
Key Presenters:
Joe Oringel, Visual Risk IQ
Brad Thiessen, Arbutus Analytics
WEBINAR
How to break through barriers & drive more value from your data
analytics program.
2
About Jim Kaplan, CIA, CFE
 President and Founder of AuditNet®, the
global resource for auditors (available on
iOS, Android and Windows devices)
 Auditor, Web Site Guru,
 Internet for Auditors Pioneer
 IIA Bradford Cadmus Memorial Award
Recipient
 Local Government Auditor’s Lifetime
Award
 Author of “The Auditor’s Guide to
Internet Resources” 2nd Edition
1
2

2. 6/11/2019
2
3
About AuditNet® LLC
• AuditNet®, the global resource for auditors, serves the global audit
community as the primary resource for Web-based auditing content. As the first online
audit portal, AuditNet® has been at the forefront of websites dedicated to promoting the
use of audit technology.
• Available on the Web, iPad, iPhone,Windows and Android devices and features:
• Over 3,000 Reusable Templates, Audit Programs, Questionnaires, and
Control Matrices
• Webinars focusing on fraud, data analytics, IT audit, and internal audit
with free CPE for subscribers and site license users.
• Audit guides, manuals, and books on audit basics and using audit
technology
• LinkedIn Networking Groups
• Monthly Newsletters with Expert Guest Columnists
• Surveys on timely topics for internal auditors
Introductions
4
The views expressed by the presenters do not necessarily represent the views, positions, or
opinions of AuditNet® LLC. These materials, and the oral presentation accompanying them, are
for educational purposes only and do not constitute accounting or legal advice or create an
accountant-client relationship.
While AuditNet® makes every effort to ensure information is accurate and complete,
AuditNet® makes no representations, guarantees, or warranties as to the accuracy or
completeness of the information provided via this presentation. AuditNet® specifically disclaims
all liability for any claims or damages that may result from the information contained in this
presentation, including any websites maintained by third parties and linked to the AuditNet®
website.
Any mention of commercial products is for information only; it does not imply recommendation
or endorsement by AuditNet® LLC
3
4

3. 6/11/2019
3
© Arbutus Software Inc. 2019 . All Rights Reserved.
BradThiessen
Director of Client Services
Arbutus Analytics
With over 25 years of experience in Data Analytics.
Brad has been with Arbutus since 2007 and has worked with 100’s of organizations to help
minimize the user adoption gap and deliver more value using audit and fraud detection
analytics.
He continues to share his expertise in data analytics helping companies achieve confidence
and success in the use of analytics.
© Arbutus Software Inc. 2019 . All Rights Reserved.
Joe Oringel
Managing Director,
Visual Risk IQ
Subject Matter Expert in Data Analytics,Visual Reporting and Continuous Auditing.
Joe Oringel is a CPA and CIA with twenty-five years of experience in internal auditing, fraud
detection and forensics. He has over ten years of Big 4 external audit, internal audit, and risk
advisory experience, prior to helping foundVisual Risk IQ. Visual Risk IQ specializes in risk-
focused data analytics using a variety of software tools including Arbutus Analyzer,Tableau,
and more.
The firm has completed more than 200 successful analytics engagements since 2006, and
they have helped instill a data-driven culture for client teams in finance, audit, and
compliance functions across many industries.
5
6

4. 6/11/2019
4
7
Good news / Bad news from Gartner (2018)
Source: Gartner Research 2018
Top Insights for Risk and Internal Audit
8
The Sequel: (2019)
Source: Gartner Research 2019
Four Key Challenges for Internal Audit
7
8

5. 6/11/2019
5
9
What are some keys success factors among the 26%?
1. Repeatable Methodology
2. Diverse skills on the team
3. Demonstrated quick wins
4. Visual Reporting is central to success
5. Investment in the right tool(s)
10
About that Methodology…
9
10

6. 6/11/2019
6
11
Exploratory and Confirmatory Analytics
Consider both Confirmatory and Exploratory analysis
What’s the difference?
What kinds of questions do auditors most often answer with data analytics?
Confirmatory Exploratory
Evaluating evidence Gathering Evidence
Testing your hypotheses Understanding data and patterns
Deviation, correlation
charts. Left Join.
Ranking, Part toWhole,Time
Series and Distribution charts
Closed-ended questions Open-ended questions
12
Diverse skills are needed for audit analytics use
• Project Management
• Data Acquisition and Manipulation
• Statistical Techniques
• Visual Reporting Techniques
• Communication
• (Finance and Audit) Domain Expertise
• Change Management / Strategic
11
12

7. 6/11/2019
7
13
Diverse skills are needed for audit analytics use
• Project Management
• Data Acquisition and Manipulation
• Statistical Techniques
• Visual Reporting Techniques
• Communication
• (Finance and Audit) Domain Expertise
• Change Management / Strategic
14
Traditional report recommendation
During the CrimeanWar of the 1850s, soldier mortality rate was high
and climbing. But the majority of our soldiers are not dying from battle
wounds from combat; rather they are dying from typhus, cholera and
dysentery which are preventable matters through improved hygiene in
the makeshift war hospitals.
The Royal Commission, includingVictorian-era statistician William Farr
and Florence Nightingale hereby recommend flushing out the sewers
and improving ventilation for our country’s wounded soldiers…
Source:Wikipedia article and Graphic
13
14

8. 6/11/2019
8
15
Visual reporting recommendation – Hall of Fame #1
16
Traditional report recommendation – IT Security
During our review of the primary, in-country data center access, we
found that the many physical access controls are below company
standards; namely:
• Power connections create risk of extended system outage and
challenges for recovering applications and data
• Computer assets are susceptible to loss and damage due to fire,
water or theft
• Cabling is messy and unplanned system outages could occur due to
human error
We recommend…
15
16

9. 6/11/2019
9
17
Visual recommendation – Hall of Fame #2
18
Traditional report recommendation – Time & Labor
We reviewed hourly pay for nearly 25,000 shifts for factory workers at the Ohio
production facility.We re-computed each pay shift for all hourly workers and
compared their pay amount under the current five minute rounding convention to
similar pay if they were paid for every minute worked.
Data analysis results tell us that workers have been shorted one to four minutes per
shift more than twice as often as workers who benefitted from a similar one to four
minutes upward adjustment due to our rounding convention.The total minutes
rounded against the factory workers are more than 16,000 minutes, or nearly three
hours per worker during the year.
This condition puts the plant at risk for criticism and even fines from the Labor
Union, since Union regulations require that any rounding practices must be
administered in such a manner that employees are compensated for all time worked.
We recommend that…
17
18

10. 6/11/2019
10
19
Visual reporting recommendation - Hall of Fame #3
20
Audit Technology Landscape
• General reporting & analysis (Spreadsheets)
• Reporting & Data Visualization (Tableau, Power BI, Qlik)
• Audit Analytics (Arbutus, ACL, IDEA)
• Work Papers/Audit Management (AuditBoard, Teammate, Ideagen)
• Specialized query languages (SQL, R, Python)
• Statistical applications (SPSS, SAS, Minitab)
19
20

11. 6/11/2019
11
21
Demonstrated Quick Wins (1+1=3)
• Arbutus Analytics for repeatable results
• Tableau for enhanced visualization
• Examples to review today:
• Exploratory analytics for address data
• Conflict of Interest
• ASC 842 (Accounting for Leases)
22
Diverse skills are needed for audit analytics use
• Project Management
• Data Acquisition and Manipulation
• Statistical Techniques
• Visual Reporting Techniques
• Communication
• (Finance and Audit) Domain Expertise
• Change Management / Strategic
21
22

12. 6/11/2019
12
23
Are these the same addresses?
Addr1: 2847 Congress Pkwy West
Addr2: Suite 201
Addr1: #201, 2847W Congress Parkway
Addr2:
Addr1: 125 Fifth Str. E Addr1: 125 East 5th Street
Addr1: 707 Rooke Road Addr1: 707 Rook Rd
Addr1: 3960 Monjah Circle Addr1: 3960 Monja Circle
24
Elizabeth or Rick by any other name?
BESS LIB DICK
BESSIE LIBBY DICKIE
BET LIDDY BRODERICK
BETH LILIBET CEDRIC
BETSY LISBETH DERRICK
BETTE LISSIE ERIC
BETTY LIZ RICH
ELISE LIZA RICHARD
ELSA LIZBETH RICHIE
LIZZIE LIZZY RICKY
23
24

13. 6/11/2019
13
25
Normalizing Data
 Normalize( Vendor_Address,'addr2.txt’ )
16023, 40th Way South  16023 40TH WAY S
#105, 1470 Boston Street  105 1470 BOSTON ST
 Sort Normalize( Vendor_Address,'addr2.txt’ )
16023, 40th Way South  WAY S 40TH 16023
#105, 1470 Boston Street  ST BOSTON 1470 105
26
Checking for Matching or Close Addresses
205 E. 10th St 205 10th Street East Original
205 E 10TH ST 205 10TH ST E Normalized
ST E 205 10TH ST E 205 10TH Sort Normalized
Matched!
25
26

14. 6/11/2019
14
27
Normalizing Data
Normalize( First,'female name substitution table.sub,male name substitution table.sub’ )
JOHANN  JOHN
JOHNNY  JOHN
JON  JOHN
JONATHAN  JOHN
JENNIE  JEN
JENNY  JEN
JENNIFER  JEN
JENN  JEN
2828
Quick Lesson: Fuzzy Algorithm
 ‘Rob’ COMPARED TO ‘Robert’ = 3
 ‘Gary’ COMPARED TO ‘Mary’ = 1
 ‘Gary’ COMPARED TO ‘Gray’ = 1
 ‘123 Main Street’ COMPARED TO ‘123 Main St’ = 4
 In Arbutus used in NEAR , SIMILAR & DIFFERENCE functions
27
28

15. 6/11/2019
15
29
Conflict of Interest:
Fuzzy Match Addresses
 Compare Vendor Addresses to Employee Addresses
 Same Upper Case City, Near Normalized Address
2
9
30
Conflict of Interest:
Vendors with close Phone Number
 Check for Vendors in same City with numerically close phone numbers
 Use of Near on numeric fields
3
0
29
30

16. 6/11/2019
16
31
Conflict of Interest:
Fuzzy Match Names
 Compare Vendor and Employee Contact Names
 Normalize First Names to improve match results
3
1
32
Bringing it All Together
31
32

17. 6/11/2019
17
33
Would you rather…
34
Would you rather…or maybe?
33
34

18. 6/11/2019
18
35
ASC 842 – Accounting for Leases
 New accounting pronouncement causing long nights and headaches for many Finance teams
 Requires evaluation of today’s operating leases – is Balance Sheet Disclosure needed?
36
ASC 842 Accounting for Leases - “So What”
 Many organizations are still in the early stages of assessment and implementation
 Data prep with Arbutus analyzer, visualization by Tableau to identify payments that may be leases
35
36

19. 6/11/2019
19
37
What did we do? What did we see?
 Internal audit had recently started a project to review A/P disbursements and
look for possible duplicate payments. Visual Risk IQ was already helping
 No additional data acquisition tasks.The same data that we were already using
for duplicate payment analysis could also answer Leasing (ASC 842) questions
 Marginal cost of the additional time for analysis was a few days for data
preparation with Arbutus and visualizing the results with Tableau
 Using Arbutus plus Tableau saved a “shake the bushes” exercise that was
expected to be costly and only partially effective
 Results were a very happy chief accounting officer
38
Example of Data Preparation and Duplicate Detection Process Objective is to identify payment
patterns that might be lease
payments usingArbutus
First sort the payments byVendor and Amount
Use ArbutusAnalytics to identify suspect groupings
We identified some exact payments
Similar payments were of significant extra value
Create Tableau Data Extract with Arbutus  import
intoTableau
Step 1
Step 2
Step 3
Step 4
Step 5
37
38

20. 6/11/2019
20
39
Use Arbutus Analytics to identify suspect groupings
…then createTableau Data Extract with Arbutus  import intoTableau
40
First, we identified some exact payments
39
40

21. 6/11/2019
21
41
Then, similar payments were of significant extra value
42
Key Takeaways
• Repeatable methodology
• Diverse Skills are Needed – consider a mentor to build capabilities and get things done
• More time on Exploratory Analytics, less on Confirmatory Analytics
• Demonstrate quick wins through knowledge of the business and data
• Visual Reporting is an important new skill for Audit Analytics
• 1+1=3: Analyzer and Tableau work great together!
41
42

22. 6/11/2019
22
43
Call to Actionilization
• Review body of knowledge – what are your strengths? Are there areas where you
should supplement your (team’s) skills?
o All (IA and stakeholder business) team members should participate in Brainstorming. This is
not an IT exercise
o Be quick to find a mentor (guest auditor, consultant, intern, etc.)
o More time on exploratory analysis than confirmatory
o Data quality / control totals
o Focus on simple, achievable tests
• Early Success – clouds self assessment
o Too internally focused, get bad habits. Get outside perspective.
Questions?
Brad Thiessen
Director of Client Services
Arbutus Analytics
www.ArbutusAnalytics.com
bthiessen@arbutussoftware.com
604.456.6336
877.333.6336 x336
Joe Oringel
Managing Director
Visual Risk IQ
Joe.Oringel@VisualRiskIQ.com
Twitter @VisualRiskIQ
704.353.7000
THANK YOU!
43
44