Techniques for risk-based auditing

1. Techniques for risk-based auditing • DG INFSO-02 Freddy Dezeure - Charles Macmillan 21/1/2011 European Court of Auditors Chamber IV

2. Background DG INFSO • European Commission department • European Digital Agenda • Co-funding of cost of research projects: 1,5 bio€ per year • FP6, FP7, eTEN, CIP: > 7000 beneficiaries, >2000 projects • Financial audits - 200 per year

3. Selection of auditees

4. Assurance audits -> error 4%

5. P1 P1 Claimed salary cost not actual Excessive overheads Major sources of errors

6. Representative error rate

7. Risk-based auditing • Risk of intentional inflation of cost • Assessment of the organisation as a whole • Data mining – new tools and methods • Audit programme specific to the risk (ISA240 - ISA315)

8. CM

9. Data gathering Risk assessment Define approach Field work Assess next steps Finalise

10. Risk assessment Data gathering

11. Data Gathering phase • Scope from risk assessment – continually reassessed • Collect available information from internal and external sources • Check for indicators and inconsistencies • Outcomes define specific audit procedures • Use and find new Indicators • Feed into control systems

12. Internal Sources • Project documents: proposal, description of work, deliverables, reports, reviews, emails, cost claims • Experts Database • Organisations Database

13. Open Sources

14. Finding people • Find the right person • Find all the relevant information about the person • Avoid noise

19. “Fake” People - Examples • Non-existent people • Existing, but • not relevant • not employed • not aware of project • People in multiple roles / companies / projects

20. Neuron – partner in BRAIN

21. Neuron: Key staff • DoW Description • Computer Science degree • Experienced ICT researcher • etc

22. Neuron – Key staff

23. Neuron – Key staff

24. Indicators • Not found on internet • Top management of company • Always the same names • Listed for different companies in different projects • Listed in a different country from the company • CV on LinkedIn contradicts submission • Anonymous email address (gmail, ...) • GSM phone only

25. Finding companies • Find the right company • Find all the relevant information about the company • Avoid noise

26. Even simple tools can help

27. Earth Match – partner in SOLARSYS 34

28. www.emsoft.com

29. Earth Match – partner in SOLARSYS 34

30. www.earthmatch.com.mt

32. www.cabbage.com

33. ONION – partner in VEGETABLE

34. Company website • Does the website exist? • Does the project fit the company’s core activities? • Does the website give contact information - and does it match the official transmission documents? • Is the website registered by the partner? 32 32

35. Company registry, phone/fax • Company registration websites • http://www.rba.co.uk/sources/registers.htm • http://www.infobel.com/, http://www.ixquick.com/ • Cross-check the phone number with yellow/white pages • Reverse search on the phone number 33 33

36. Company website, history • Website registration • http://www.domaintools.com/ • http://www.robtex.com/dns/ • Archive • http://www.waybackmachine.org/ • http://www.archive.org/web/web.php 33 33

37. Tools - internet search • Search for company in Google • Not reassuring if nothing found • Translation tools • http://translate.google.com • http://babelfish.yahoo.com/ 44 44

38. 45

39. HOUR – partner in TIME

40. Indicators • Email address not <-> company domain • Phone number = fax number • Phone number = gsm number • Website registered by another company • Website or phone numbers in another country • Corporate website without contact coordinates, “under construction”

41. FD

42. Organisation Cannot (financially) Cannot (operationally) Can do / have not Staff Have not done Have done, cost inflated Have done, cost ineligible Data Gathering Outcomes

43. Outcome - Audit Procedures • Cannot (financial) • Find other income source • Check commercial agreements with others... • Cannot (operational) • Find who could have done the work • Verify working agreements / CVs / job descriptions...

44. Risk-based audits -> error 30%

45. Impact on DG INFSO • Huge effort in administrative follow-up • Litigation (EDPS, Ombudsman, TPI, ECJ) • Impossibility to recover funds • Waste of budget - impact on genuine participants • Reputation damage

46. Perception

47. Challenge • Detect problems early in the project life-cycle (PO) • Link data gathering/risk-assessment/audit programme • Manage exceptions well

48. Implementation of audits

49. Residual error Audited Error = 0 Untouched Error = representative Extrapolated Error = non-systematic

50. Selectiveness Detect Correct Prevent Facilitate Simplify Trust