Techniques for riskbased auditing DG INFSO02 Freddy Dezeure
Techniques for risk-based auditing DG INFSO-02 Freddy Dezeure - Charles Macmillan 21/1/2011 European Court of Auditors Chamber IV
Background DG INFSO ✤ European Commission department ✤ European Digital Agenda ✤ Co-funding of cost of research projects: 1, 5 bio€ per year ✤ FP 6, FP 7, e. TEN, CIP: > 7000 beneficiaries, >2000 projects ✤ Financial audits - 200 per year
Selection of auditees
Assurance audits -> error 4%
Major sources of errors P 1 Claimed salary cost not actual Excessive overheads
Representative error rate
Risk-based auditing ✤ Risk of intentional inflation of cost ✤ Assessment of the organisation as a whole ✤ Data mining – new tools and methods ✤ Audit programme specific to the risk (ISA 240 - ISA 315)
CM
Data gathering Risk assessment Define approach Field work Assess next steps Finalise
Risk assessment Data gathering
Data Gathering phase ✤ Scope from risk assessment – continually reassessed ✤ Collect available information from internal and external sources ✤ Check for indicators and inconsistencies ✤ Outcomes define specific audit procedures ✤ Use and find new Indicators ✤ Feed into control systems
Internal Sources ✤ Project documents: proposal, description of work, deliverables, reports, reviews, emails, cost claims ✤ Experts Database ✤ Organisations Database
Open Sources People Companies Communications Google, Bing Google Scholar, Microsoft Academic Microsoft Entity. Cube Linked. In, Zoominfo 123 People, Yasni, PIPL Google Magic Wheel, Timeline Google, Bing Company registries Google Maps Google Streetview Google, Bing Infobel Ixquick UKPhonebook Domaintools Domaincrawler Robtex Wayback Machine
Finding people ✤ Find the right person ✤ Find all the relevant information about the person ✤ Avoid noise
“Fake” People - Examples ✤ Non-existent people ✤ Existing, but ✤ ✤ not relevant ✤ not employed ✤ not aware of project People in multiple roles / companies / projects
Neuron – partner in BRAIN
Neuron: Key staff • Do. W Description • Computer Science degree • Experienced ICT researcher • etc
Neuron – Key staff
Neuron – Key staff
Indicators ✤ Not found on internet ✤ Top management of company ✤ Always the same names ✤ Listed for different companies in different projects ✤ Listed in a different country from the company ✤ CV on Linked. In contradicts submission ✤ Anonymous email address (gmail, . . . ) ✤ GSM phone only
Finding companies ✤ Find the right company ✤ Find all the relevant information about the company ✤ Avoid noise
Even simple tools can help
Earth Match – partner in SOLARSYS 34
www. emsoft. com
Earth Match – partner in SOLARSYS 34
www. earthmatch. com. mt
www. cabbage. com
ONION – partner in VEGETABLE
Company website • Does the website exist? • Does the project fit the company’s core activities? • • Does the website give contact information - and does it match the official transmission documents? Is the website registered by the partner? 32
Company registry, phone/fax • Company registration websites ✤ http: //www. rba. co. uk/sources/registers. htm • http: //www. infobel. com/, http: //www. ixquick. com/ – Cross-check the phone number with yellow/white pages – Reverse search on the phone number 33
Company website, history • Website registration ✤ http: //www. rba. co. uk/sources/registers. htm ✤ http: //www. robtex. com/dns/ • Archive http: //www. waybackmachine. org/ ✤ http: //www. archive. org/web. php ✤ 33
Tools - internet search • Search for company in Google – • Not reassuring if nothing found Translation tools – http: //translate. google. com – http: //babelfish. yahoo. com/ 44
45
HOUR – partner in TIME
Indicators • Email address not <-> company domain • Phone number = fax number • Phone number = gsm number • Website registered by another company • Website or phone numbers in another country • Corporate website without contact coordinates, “under construction”
FD
Data Gathering Outcomes ✤ Organisation ✤ Staff ✤ Cannot (financially) ✤ Have not done ✤ Cannot (operationally) ✤ Have done, cost inflated ✤ Can do / have not ✤ Have done, cost ineligible
Outcome - Audit Procedures ✤ Cannot (financial) ✤ Find other income source ✤ ✤ Check commercial agreements with others. . . Cannot (operational) ✤ Find who could have done the work ✤ Verify working agreements / CVs / job descriptions. . .
Risk-based audits -> error 30%
Impact on DG INFSO ✤ Huge effort in administrative follow-up ✤ Litigation (EDPS, Ombudsman, TPI, ECJ) ✤ Impossibility to recover funds ✤ Waste of budget - impact on genuine participants ✤ Reputation damage
Perception
Challenge ✤ Detect problems early in the project life-cycle (PO) ✤ Link data gathering/risk-assessment/audit programme ✤ Manage exceptions well
Implementation of audits
Residual error Audited Error = 0 Untouched Error = representative Extrapolated Error = non-systematic
Selectiveness Detect Correct Prevent Facilitate Simplify Trust
- Slides: 50