1. Copyright © KPMG 2002. All rights reserved kpmg KOLA KPMG On Line Auditing : Practical experiences from piloting on line continuous audit tools Kevin Handscombe, Assurance Support & Innovation Kevin.handscombe@kpmg.co.uk

2. Copyright © KPMG 2002. All rights reserved kpmg Kola (Pron. Kholá) n. [Lakhota - Native American Sioux] - trusted friend, a fellow warrior, a brother in arms. Most often used in combination as greeting (eg Hau Kola). “The Elders say you are lucky to have one kola in your lifetime. To acknowledge another man as a kola is to commit to that individual for the rest of your life. Kola commitments are just between the two people involved. These terms allow two people to share confidential information, and no one will pry into their personal matters. A kola will not reveal information about the other person, especially if it endangers the other.” - From Reading and Writing the Lakota Language by Albert White Hat Sr.

3. 3 kpmg Tool selection criteria Extracting and transferring data to analyse – Diversity of systems is a technical & economic barrier – Technical hurdles include encryption, firewall settings, data storage, formatting – Data Protection Act is also a complication Audit controls as well as transactions – Important to achieve fit to the audit process – Could offer advance over traditional approaches such as using log files Low client impact – High sensitivity to risks & impact of pervasive connectivity Low technical threshold for user – Seeking solution for specialist & non-specialist users

4. 4 kpmg KOLA model 1 2 4 5 3 6

5. 5 kpmg Key features of the model The KPMG PC is left with the client, with read only access to relevant databases, running behind the company firewall No software is loaded on the company’s system Data need not routinely leave the client, avoiding security issues –The company’s email system is used to carry program instructions and report test outcomes –Outcomes can trigger pre-programmed responses for automatic escalation or prompt a manual response with new programming conducted either remotely or in person –Data can be sent as file attachment for further analysis. No workload on client to provide regular data downloads Databases are monitored using automated routines to notify the auditor when audit events occur

6. 6 kpmg Investigating potential benefits Efficiency We react when controls stop working Automated data extraction Spread workload over the year Quality of opinion Focus upon system reliability matches Sarbanes Oxley concerns Prepared for demand for more regular reporting Quality of service Faster reaction times, Proactive approach to solve problems as they occur For Auditor: Focus Focus on key issues Deal with issues when they are fresh Quality of reporting Integrate disparate databases Develop KPIs and CRM approach Strategic Market confidence Raise profile of internal audit System efficiency gains For Client:

7. 7 kpmg Case studies – pilot experiences Case study 1 – Worldwide group of 150 companies –Monthly KPI extract into spreadsheet –On-demand KPI extract –Alerts for masterfile changes Case study 2 – internal audit –Alerts for accounts payable standing data changes –Alerts for price masterlist changes, credit limit changes –Alerts for sales order entry errors Case study 3 – legacy system –Alerts for stock interface differences –Alerts for standard cost changes Case study 4 (Germany) – internal audit –Controls improvements

8. 8 kpmg Main points KOLA will work with any database and is platform independent No software is loaded onto the company’s system KOLA has the capability to audit controls on-line, not just transactions, it is more than computer audit Problems can be identified early and resolved before they worsen, proactive audit KOLA is an addition to the audit support toolkit, not a replacement

9. Copyright © KPMG 2002. All rights reserved kpmg KOLA KPMG On-Line Auditing : Overview of the concept Kevin Handscombe, Assurance Support & Innovation Kevin.handscombe@kpmg.co.uk