1. Corvelle Drives Concepts to Completion 1

2. Case Study: Implementing a risk-based continuous compliance assessment program ISACA Fall Conference 25 November 2010 2

3. Corvelle Drives Concepts to Completion Yogi Schulz Biography  Partner of Corvelle Consulting  Information technology related management consulting  Microsoft Canada columnist & CBC Radio host  PPDM Association board member  Industry presenter: – Project World - 4 years – CIPS Informatics - 7 years – PMI - Information Systems SIG - 2 years – Convergence - 4 years – PPDM Association - several years 3

4. Corvelle Drives Concepts to Completion Presentation Outline  Business Context  Compliance Assessment System  Development description  Benefits  Conclusions  Recommendations  Discussion 4

5. Corvelle Drives Concepts to Completion Business Context  Regulator publishes requirements  Oil & gas industry expected to comply  Some requirements relate to measurement and reporting 5

6. Corvelle Drives Concepts to Completion Business Problem  Current situation: – Challenge maintaining compliance audit coverage – Suspicion of poor compliance  Goals to: – raise level of assurance over state of compliance – raise level of compliance  Approach: – Apply CSOX audit concepts to compliance audit – Improve monitoring through data analytics 6

7. Corvelle Drives Concepts to Completion Oil & Gas Industry High-Level Data Flow 7 Alberta Energy Field Production Operations Alberta’s oil & gas regulator Field Data Capture Production Accounting Revenue Accounting Financial Accounting Petroleum Registry Alberta

8. Corvelle Drives Concepts to Completion Compliance Audit Philosophy 8 TrustOperator Declaration VerifyCompliance Assessment Process “Trust, but verify” - Ronald Reagan

9. Corvelle Drives Concepts to Completion Continuous auditing  A method used by auditors to perform audit- related activities on a continuous basis  Changes the audit paradigm from periodic reviews of a sample of transactions to ongoing audit procedures that test 100 % of transactions resulting in timely and comprehensive insights into risk and control issues 9

10. Corvelle Drives Concepts to Completion Compliance Assessment System Overview 10 Data Extract Compliance Analytics Noncompliance Indicators Input Datastores

11. Corvelle Drives Concepts to Completion Compliance Assessment System Data Extract 11 Field Inspection System Data Extract Extract A - n Alberta’s oil & gas regulator

12. Corvelle Drives Concepts to Completion Compliance Assessment System Data Analytics 12 Compliance Analytics Extract A Noncompliance Indicators Extract B Compliance Analytics

13. Corvelle Drives Concepts to Completion Data Analytics Examples  High metering difference  Production rate trending up  Puzzling trends in gas flare, fuel, vent, meter difference  Gas production greater than oil production for an oil well  High or low fuel consumption 13

14. Corvelle Drives Concepts to Completion Compliance Assessment System Reporting 14 Noncompliance Indicators Reports Operator Reports Production Audit Team Reports

15. Corvelle Drives Concepts to Completion Compliance Assessment System Architecture 15 Transform Compliance Analytics Data Extract Reports Master

16. Corvelle Drives Concepts to Completion Compliance Assessment System Development  Building the system - a part-time effort  ACL dramatically reduces the amount of code  Significant architecture, design and testing effort 16

17. Corvelle Drives Concepts to Completion Benefits of ACL for system development  Cost-effective and rapid development  Adaptable to change as source datastores change  Adaptable to change ACL Compliance Analytics Routines  Encapsulates expert understanding of data relationships in complex datastores  Simple validation of candidate compliance assessment indicators 17

18. Corvelle Drives Concepts to Completion Benefits of ACL for system operation  Formal, fully auditable system  Fully automated operation  Scalable solution 18

19. Corvelle Drives Concepts to Completion Business benefits of this Compliance Assessment activity  Assurance over the state of compliance  Feedback to oil & gas operators  Improved data quality for all stakeholders  Comprehensive auditing  Greatly increased auditor productivity  Independent of skilled data analysts 19

20. Corvelle Drives Concepts to Completion Conclusions  Compliance Assessment addressed our business challenge  ACL enabled development and operation of our Compliance Assessment System 20

21. Corvelle Drives Concepts to Completion Recommendations  Investigate opportunities to employ Compliance Assessment within your organization  Consider ACL as the technology to implement Compliance Assessment  Consider ACL for batch Data Analytics applications 21

22. Corvelle Drives Concepts to Completion Next Steps  Identify datastores to examine  Experiment to identify potential data anomalies  Design, build and test a Compliance Assessment system  Collect dollars revealed 22

23. Corvelle Drives Concepts to Completion Questions & Discussion 23 Can you help us improve our audit work? Please fill out evaluation form

24. Corvelle Drives Concepts to Completion Monitor Compliance Risks Through Data Analytics Corvelle Consulting 300, 400 - 5 Ave. S. W. Calgary, Alberta T2P 0L6 Phone: (403) 249-5255 E-mail: YogiSchulz@corvelle.com Web: www.corvelle.com Yogi Schulz Partner of Corvelle Consulting Information technology related management consulting Microsoft Canada columnist & CBC Radio host Industry presenter PPDM Association board member 24

25. Corvelle Drives Concepts to Completion Bibliography  Continuous Auditing Continuous Auditing 25

26. Corvelle Drives Concepts to Completion Noncompliance Indicator File Record Layout  Noncompliance Indicator id  Production Year/Month  Operator BA id  Facility id  Noncompliance supporting data 26