Technology Applications in the Age of Integrity Integrity Forum 2006 Tony Murphy Vice President, Worldwide Sales ACL Services Ltd.

© 2006 ACL Services Ltd. 2 About ACL Founded1987 – Global leader in audit, controls testing, and compliance technology solutions Corp HeadquartersVancouver, BC Clients170,000 users in 130 countries 70% of Fortune 500 Big 4 Accounting Firms State & federal governments ProductsData Analytics ACL Desktop/Network Edition ACL Server Editions – AIX, Linux, OS390/400, Windows Direct Link for SAP Continuous Controls Monitoring Purchase-to-Payment T&E Expenses Payroll Purchasing Cards Order-to-Cash General Ledger ServicesTechnical Support, Implementation Services, Training

© 2006 ACL Services Ltd. 3 Today’s Agenda Spotlight on Internal Controls Continuous Auditing and Continuous Monitoring  Definitions  Responsibilities  Impact ACL Solutions Summary

© 2006 ACL Services Ltd. 4 Internal Controls: What’s at Stake? Compliance Issues Cost-effectively sustaining compliance Market perception/share value Negative impact on credit rating Business Performance Issues Operational inefficiency Revenue leakage Fraud Technology is seen as one way companies can successfully manage these issues

© 2006 ACL Services Ltd. 5 Compliance Confusion There’s a great deal of confusion in the market about “Compliance” Following slides  Let’s have some plain talk about what compliance is, why it’s important to a business and what ACL is doing to help companies address a critically important slice of their compliance requirements

© 2006 ACL Services Ltd. 6 Sustainable Compliance Regulatory environment now driving the need to  Efficiently and cost-effectively sustain controls assessment and testing efforts  Determine on a timely basis when control deficiencies occur  Quantify the impact of control deficiencies  Improve effectiveness of controls  Gain assurance over effectiveness of controls Need to make compliance attainable, sustainable, and cost-effective Additional goal: improve overall business performance How can audit departments assist? Build compliance processes into the foundation of the business

© 2006 ACL Services Ltd. 7 Gaining Clarity: Some Definitions Continuous Auditing  Method used to perform audit activities on a continual basis – includes control and risk assessment  Performed by Internal Audit Continuous Monitoring  Processes to ensure policies/processes are operating effectively and to assess adequacy/effectiveness of controls  Performed by operational/financial management Continuous Assurance  Combination of continuous auditing and audit oversight of continuous monitoring

© 2006 ACL Services Ltd. 8 Continuous Auditing vs. Continuous Controls Monitoring A Question of Responsibility: Management is responsible for establishing and monitoring the effectiveness of internal controls Audit is responsible for determining whether management has been successful in its responsibility Continuous Auditing and Continuous Controls Monitoring frameworks are vital parts of the controls environment

© 2006 ACL Services Ltd. 9 Relationship of Continuous Auditing/Monitoring/Assurance Role of continuous auditing dependent on management’s role in continuous monitoring of controls  Inverse relationship: the greater the role of management, the less of a direct role of internal audit True continuous assurance  Depends on effective monitoring by management of internal controls and Audit’s independent assessment of that function

© 2006 ACL Services Ltd. 10 Continuous Auditing Compliance requirements now driving the need to  Efficiently and cost-effectively sustain controls assessment and testing efforts  Determine on a timely basis when control deficiencies occur  Quantify the impact of control deficiencies  Improve effectiveness of controls  Gain assurance over effectiveness of controls Continuous Auditing  Shift from traditional approach of periodic cyclical audit processes  Method used to automatically perform control and risk assessments on an ongoing basis  Allows audit to provide ongoing risk and control assessments  Technology is key

© 2006 ACL Services Ltd. 11 Continuous Controls Monitoring Process performed by management to determine whether policies and controls are operating effectively Establishes control objectives and assurance assertions – and uses automated tests to identify activities and transactions that fail to comply with controls Embedded in key business processes Allows management to fix control problems on a timely basis – improves controls and improves operational performance Technology is key

© 2006 ACL Services Ltd. 12 CA & CCM: An Integrated Approach

© 2006 ACL Services Ltd. 13 ACL’s Approach to Enterprise Financial Transaction Monitoring Review 100% of transactions across all systems & platforms Apply automated tests to critical control points Present quantified control exceptions Provide visibility into controls health to all stakeholders Internal & external

© 2006 ACL Services Ltd. 14 ACL’s Complementary Solutions Financial Transaction Monitoring Audit Tools DISCOVER & DETECT… ACL Audit Analytics MONITOR …. Continuous Controls Monitoring (CCM)

© 2006 ACL Services Ltd. 15 ACL’s Complementary Solutions Financial Transaction Monitoring ACL Data Analytics DISCOVER & DETECT…  Interactive analysis built for Audit  Analyze every transaction, across system boundaries  Automate audit best practices  Auditable results  Desktop/Network, Server Editions, Direct Link for SAP Audit Tools

© 2006 ACL Services Ltd. 16 ACL’s Complementary Solutions Continuous Controls Monitoring (CCM) MONITOR ….  Core business processes, end-to-end  Key controls, across system boundaries  Based on COSO framework  CCM applications:  General Ledger  Order-to-Cash Cycle  Payroll  Purchase-to-Payment Cycle  Purchasing Cards  Travel & Entertainment Expenses Financial Transaction Monitoring Audit Tools Financial Transaction Monitoring

© 2006 ACL Services Ltd. 17 Benefits and Outcomes Near-term – Revenue recovery & compliance  Return on investment, early warning system, regulatory compliance  Example: Recovery of duplicate payments and vendor overcharges Mid-term – Operational improvement  Example: Modifications made to system design and controls such as change to vendor master entry Long-term – Enhanced control environment  Improved external audit results  Tangible, demonstrable evidence of effort

© 2006 ACL Services Ltd. 18 Summary Compliance requirements and business process improvement are not optional A sustainable approach is needed Audit has options:  Expand technology investment to apply continuous auditing techniques  Advanced use of data analytics, i.e. script development and automation  Sponsor comprehensive technology solutions to automate controls monitoring within business processes  Implement continuous monitoring technology

© 2006 ACL Services Ltd. 19 Cost savings Business Performance Optimization Cost-effective risk mitigation Bottom-line results Operational efficiencies Fraud reduction Summary Connected compliance across the business supports compliance with the benefit of enhanced business performance. Streamlined internal & external audit Sustainable process for compliance Compliance Requirements Internal Controls Effectiveness Reduced time for reporting/signoff

© 2006 ACL Services Ltd. 20