AUDITING THE
DIGITAL
ENTERPRISERAGHU RV , CISA, CRISC
4/3/2018
1AGENDA• Introduction• Audits then, now and tomorrow• The Digital enterprise• Change is coming• Reinvention• A model for the future• Conclusion2

4/3/2018® 2017 ISACA. All Rights Reserved.

LEARNING OBJECTIVES• Appreciate the nuances involved in auditing the digitalenterprises• Understand the areas of emphasis in this new digital age• Look at alternate approaches to auditing the digital enterprise• Tweak the audit lifecycle to suit the digital enterprise3

4/3/2018® 2017 ISACA. All Rights Reserved.

44/3/2018® 2017 ISACA. All Rights Reserved.

AUDIT THEN

Auditors?

54/3/2018® 2017 ISACA. All Rights Reserved.

THE AUDIT TRIANGLE

Auditor
Scopeof theaudit

Auditee

Auditprocess

TODAY’S ENTERPRISE

Business and business processes are going digital
Blurring of distinction between business process and technology

Separation of IT and business process difficult
Tech savvy customers demanding digitization
Business is real time
Increased used of robotic process automation, AI, Chatbots, machine learning, IoT etc.
Everything is digitalTHE ENTERPRISE OF TOMORROW
Digitalproductsandservices‘Digital’Employees

Tech driven
deliveryDigitalEnterprise‘Digital’Customers

Real timeprocesses

Information

Automatedprocesses
DigitalMoney/payment

DEFINING THE DIGITAL ENTERPRISE

Increasing/high use of technology to deliver outputs
Business processes driven/managed/operated by non-human entities

Customers interact with the business through non-human points of contact..
Customer is not always ‘human’
Digital metabolism
Increased used of technology that is near autonomous or autonomous!

We are all looking down the Digital rabbit hole

The Digital enterprisedemands disruption in“value” from audits

Ensure Resource optimization
Ensure Risk optimization
Enable Benefit realization

Evolve beyond the ‘third line ofdefense’AUDITS THEN AND NOW..

Traditional audit attributes• Point in time
• Looking backwards as part of the audit• Report findings• Action on findings

Audit

Business process

Evolving audit attributes• Moving to concurrent status• Looking ‘over the shoulder’ and in linewith the process• Report findings• Action on findings

AUDITS IN DIGITAL ENTERPRISE
Audit of the future• Concurrent to business process• Multi temporal PoV• Limited lag between reporting and action onfindings• Need for real time or near real time actions

Audit

Business process

EVOLVING ASPECTS OF AUDITS•••

Competency
Independence

Traditional scoping
may no longer apply

Auditor••

Scopeof theaudit•

Non-humanauditees

Auditee•

Audit
process

Scoping
Evidence collection& retention
Usage of tools

AUDIT IMPLICATIONS FROM THE DIGITAL ENTERPRISE• Audit is concurrent /real time
• Evidence management••

Approaches to obtaining evidence will change
Evidence analysis, retention will change• Corrective action time frames change dramatically - actions required real time-near real time
• Blurring of audits/reviews/monitoring• Increased integration between business and ‘audit’• Need for increased audit skepticism• Need for high quality audits /increased reliability• Contextual reporting v/s binary reporting“#ChangeAgents are leaders who ‘illuminate theway’ and manage friction of stepping outside thestatus quo. Anyone can be a change agent.”

We all need to be Change agents who ‘illuminate the way’ andmanage the friction of stepping outside the status quo.
David Bray, CIO of the FCC,REINVENTING AUDITS

Reinventing Agility

HighLow

Change agile

Judo Champion

Visually impaired

Legally Blind

Shockwave strength

Reinvention: accelerating results in the age of Disruption- Shane Cragun & Kate SweetmanHigh

FUTURECASTING…

• Audit of the digital enterprise will need to focus on :• Business process risk management• ‘Strength’ of controls• Change management• Configuration control• Increasing need to use analytics..
• Coalesced insights drawn from multiple sources• Ability to analyze larger sets of data rather than sampling• Audit ‘intelligence’IMPLICATIONS FOR THE AUDITPROFESSIONAL..
• Outsider to trusted, valued insider• Collaborate more /Share knowledge• Keeps abreast of changing technology• Possess high domain knowledge.
• Uses tools extensively.

• Be closely attached to the businessprocess..without impinging on independence• Engage before and during the course of businessrather than only post facto.
• Increasing need to involve in post audit actions

IMPLICATIONS FOR THE AUDITPROCESS

Increasing reliance on rules/parameterization
Embedding of audit routines into the businessprocess
On-going collection of evidence & analysis
Emphasis on evidence collection/analysis/retention
End-to- end audit life cycle management tools
Go with the flow of business process rather thanagainst the grain
Deep, wide and technical- all need to be tickedStrategic
goal aligned
partnership

Proactive
Reactive

Audit Maturity

Predictive

A MODEL FOR THE FUTURE

Improvement
focus

ComplianceapproachPhase 1

Phase 2
Alignment continuum

Phase 3Phase 1: External
understanding of thebusiness
Phase 2:Contextualalignment
Phase 3:Stratgeic goalaligned partnership

MODELED OUTCOMES

Audit strategy aligned with business strategyMove from a line of defense to a strategic value adding role
Improved audit productivity
Increased automation
Consistency across teams/businesses/geographies
Enhanced audit management ability
Analytics leveraged to identify trends
Predict areas of higher risk
Become force multipliers
Metrics to drive, deliver and demonstrate value

The most common way to deal with the future isto try to predict it. To be in the right place at theright time with the right skills or investments.
A far more successful and reliable approach is toinvent the future. Not all of it, just a little part. But
enough to make a difference.

Copyright © 2017 Information Systems Audit and Control Association, Inc. All rights reserved.

• ありがとうございました• Raghu• raghu@versatilistconsulting.com• @iyeraghu