Internal Auditing Around the World® Vol. XV

Accenture PLC Assessing Internal Audit’s Competencies of the Future Today

Kathy Perrott The bots can do the testing work in two to three minutes Managing Director, and be done with it. The savings in terms of time and effort Internal Audit Services are incredible once you get it set up properly, and we think there are many other opportunities to apply RPA.

Accenture PLC Accenture takes an innovation-led approach large workforce and global footprint. While to helping clients “imagine and invent” some additions to team size have been made their future. The global professional services in the past year, including establishing company’s 477,000 employees’ intense focus a small team in Japan in response to the on inventing, developing and delivering significant growth the company has notched disruptive innovations in recent years in the country, as well as increasing the has paid off. Today, more than 60% of the number of internal auditors on the IT audit company’s revenues, which have increased team, Perrott and her senior team seek to steadily in each of the past several years, leverage new technology — including robotic come from its digital, cloud and information process automation (RPA) and analytics, in security offerings. particular — to continually streamline the function’s work. Accenture’s end-to-end business architecture is aligned around distinct and Operating efficiently represents a primary highly focused businesses — Accenture objective of the internal audit function’s Strategy, Accenture Consulting, Accenture investment in next-generation technology Digital, Accenture Technology and Accenture and approaches. “We don’t have an unlimited Operations — through which it delivers budget,” Perrott says. “As Accenture services and solutions to clients in more than continues to grow, we have to make sure 40 industries, through 13 industry groups. we’re getting optimal coverage of the highest The company’s clients include 92 of the risk areas. I also want to operate as a good Fortune Global 100® and more than three- company citizen, which means contributing quarters of the Fortune Global 500®. to the bottom line by doing everything we can to operate cost-effectively.”

The function’s commitment to innovation and transformation serves another purpose. Accenture takes an innovation-led “The people we want to attract are those who approach to helping clients “imagine want to innovate and develop new ways of and invent” their future. doing things,” Perrott explains. “They’re less attracted to old-school auditing approaches. By continuously innovating, we are better “Innovation is the name of the game for our positioned to attract the level of talent we client-facing business, as well as almost want and need on our teams.” every other function within Accenture,” says Talent management qualifies as one of Managing Director, Internal Audit Services, Perrott’s professional passions. “Competency Kathy Perrott. “The entire company is assessment and training are close to my committed to exploring new ways of doing heart,” she says, while emphasizing that things by leveraging new technologies staffing the internal audit function of the and challenging ourselves to think and act future is a multifaceted challenge — and one creatively.” that she enjoys unraveling. “It’s become clear that if you want internal auditors who Drivers of Audit Innovation can transition to these new capabilities, you can’t look for people who have proven That mindset pervades the internal audit skills — because those skill sets are not yet function, which represents a relatively small fully formed,” Perrott continues. That’s team within Accenture, given the company’s

Internal Auditing Around the World® Vol. XV | 2 why Perrott has focused significant time properly, and we think there are many other and effort on competency assessments. opportunities to apply RPA. We’re now looking The idea, she says, is to identify which at other testing procedures that we perform characteristics (e.g., being comfortable with as well as working with other parts of the ambiguity, creativity, resiliency, a knack for business that either do the testing themselves strategic thinking) correlate with the ability or have a significant role in the process.” to deploy yet-to-emerge technology and approaches, manage rapid change, pivot on a dime, and address related aptitudes likely to become increasingly valuable as digital The internal audit function’s most transformation advances. recent innovations involve RPA, “It’s tricky, and I can’t say that I have all of digitized reporting and an extremely the answers,” Perrott notes. “But it’s an area valuable data-access upgrade. that we’re working on so that we can be clear on the competencies we know we’ll need and the types of training that will help our Internal audit is also working with the IT auditors develop new skills.” function to identify opportunities for IT to reconfigure or re-engineer certain processes RPA, NLP and Data Lakes and controls to make them more suitable for RPA-enabled testing. As her team looks The internal audit function’s most recent for additional RPA opportunities, Perrott innovations involve RPA, digitized reporting says it is important to have a comprehensive and an extremely valuable data-access upgrade. understanding of the process steps that After assessing the organization’s development bots execute (so that necessary auditing and use of RPA last summer, Perrott’s function evidence can be retained) and to establish developed a proof of concept for internal ongoing RPA oversight. “You have to monitor audit’s use of RPA to test Sarbanes-Oxley- any changes in the underlying application related service organization controls and infrastructure that could potentially render general controls in Accenture’s information the bot obsolete,” she asserts. “You can’t technology (IT) and internal controls develop them and then ignore them. You 1 functions. The team developed three bots that have to monitor and maintain them because performed the testing of those controls in an the different systems and applications that automated fashion. Internal auditors chose the bots are accessing often change.” those areas for the RPA applications because Accenture’s internal auditors also developed the internal controls there had been subject bots to automate reporting out the to highly repetitive manual tests for years department’s GRC application. This reporting and also because those controls had remained provides real-time status regarding audit highly stable during that time. performance metrics, status of open and “The bots can do the testing work in two to closed issues, and various trending data. three minutes and be done with it,” Perrott They are also currently working on digitizing reports. “The savings in terms of time and reporting out of a CRM tool that is used to effort are incredible once you get it set up schedule hundreds of risk discussions with

1 “Robotic Process Automation and Internal Audit — Are You Ready?” Protiviti webinar recording available at www.protiviti.com/US-en/ events/robotic-process-automation-and-internal-audit.

Internal Auditing Around the World® Vol. XV | 3 business leaders and management across Enterprise Insights group’s assistance, the company, as well as other key contacts, designed a self-service solution in which and store the notes from those discussions. internal audit could leverage the data from The function is also exploring how natural the enterprise data lake, curate, perform language processing (NLP) capabilities can be analytics and deliver results to audit teams applied to identify and tag key risks or other while ensuring proper security controls over important points captured in the discussion the data. The solution required a new suite of notes. Additionally, internal audit is working tools to speed up processing and significantly with the legal group to apply NLP to client improve visualization of results. Internal and vendor contracts to search for variances audit submitted a proposal to the company’s from standard contract clauses or required IT steering committee, which gave the project clauses that are missing altogether. a green light — a major win considering that hundreds of business case requests are Those advancements are similar to risk submitted each year to the same committee dashboards the internal audit function and only a fraction are approved for funding. has created by digitizing risk models the The solution has taken about a year to function previously developed. Until recently, complete, according to Perrott. updating the risk models with current data required a fair amount of manual work “The long and the short of it is that we’ve — data had to be downloaded, sorted and upgraded our analytics technology architecture integrated. “We might have performed that in a major way,” Perrott continues. “And work once a quarter,” Perrott says. Now, the that’s enabled us to tap into just about automated risk dashboards provide more everything that Accenture has overall from frequent and near real-time updates. The a data perspective.” dashboards also provide a more robust drill- These experiences show why Perrott places down capability that allows the audit teams such a great emphasis on identifying talent to perform more in-depth analyses. The who have the desire and wherewithal to take combination of more timely data access, as internal audit to the next level and thrive in well as robust drill-down, Perrott continues, the future. Perrott points out that leveraging has enabled the audit team to “improve the advanced technology requires auditors who quality of our audit selection, scoping and possess a blend of technical and interpersonal testing — it’s been truly incredible.” Yet, skills, including the ability to collaborate. she also emphasizes that this powerful new “Because we got out of the gate relatively early capability is the direct result of her function’s with both analytics and RPA, our business persuasive skills and convincing the business partners and stakeholders are interested in — trust that took time to build. learning from our experience,” she adds. Internal audit previously had plenty of data “When they’re highly receptive to finding assets, Perrott explains, but accessing and out how we can help them, that helps us as downloading the data was a time-consuming well because we can show them how to more and cumbersome endeavor that needed to effectively monitor and manage areas that fall be scheduled and frequently timed-out due under their responsibility, and it allows us to to scale and complexity. As internal audit place more reliance on their results.” sought to expand its analytic capabilities, the team looked to leverage an enterprise- level solution. Internal audit, with the CIO’s

Internal Auditing Around the World® Vol. XV | 4