Audit & Risk Presentation Overview of Risk
Description: Audit Risk Presentation Overview of Risk Management Internal Audit Framework KCPLs Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit
Related Topics
Download Presentation
"Audit & Risk Presentation Overview of Risk" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. Audit & Risk Presentation<br>
slide2. Overview of Risk Management & Internal Audit Framework<br>
slide3. KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls<br>
slide4. KCPL’s Risk Management Framework Information Security Management
Risk Based approach
Follows ISO 27001:2005 standard
Information security governance
Business continuity
Technology dimension
Operational risk management and Surveillance
Identify the critical operational processes and risks
associated with them.
Preparation of Risk register.
Document Controls ( Severity of control depends on the
risk appetite)
Compliance requirements and reports to the regulator
Fraud detection and control
Financial Risk Management
Accounting and financial controls and reporting.
Statutory and Regulatory requirements and fulfillment
Revenue and cost assurance
Fund Management/ Treasury operations Internal audit assurance
To ensure established controls to
mitigate identified risks, are actually
working.
To report non adherence to
established controls.
Suggest action plans for correction
Ensure the implementation of
suggested action plans<br>
slide5. KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls<br>
slide6. KCPL’s Information Security Management KCPL Information Security Management System Framework<br>
slide7. KCPL’s Information Security Management<br>
slide8. KCPL’s Information Security Management<br>
slide9. Information Security – Risk Assessment process<br>
slide10. Information Security – Internal audit execution Information security internal audit is – Risk based and is conducted by taking the following into consideration
Prepare the audit schedule.
Prepare the audit agenda with the controls to be tested
Conduct the internal audit as per the agreed scope and risk register
Prepare the working papers and submit the report for management comments.
Identify actions plans to improve Information security management<br>
slide11. Information Security management - Templates IF/ISMS/01.2/Ver. 1.1
Audit Report & Checklist Auditee Signature Auditor Signature<br>
slide12. Information Security management - Templates<br>
slide13. KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls<br>
slide14. KCPL’s Financial Risk Management Accounting of all financial transactions including accruals
- Billing to the client – Revenue accounting
- Accounting of financial commitments and liabilities
- Adherence to generally accepted accounting principals (GAAP)
- Monthly closing and reporting.
Statutory and Regulatory requirements and fulfillment
- Tax Payments and submission of related returns.
- Statutory and regulatory fees/ contributions payment.
- Intimation and submission of forms/ returns with statutory and regulatory authorities
Revenue and cost assurance
To ensure correct billing to clients as per contract.
To ensure all cost obligations are accounted
Fund Management
- Ensure collection from clients
- Ensure funds are invested in most profitable manner
- Ensure cash flow management, vendor payment<br>
slide15. KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls<br>
slide16. KCPL’s Operational Risk Management Document the processes
- Document the process flows.
Prepare the list of processes with the process owners
Document the process flows as they are
Identify the risks associated with the processes.
- Train the process owners on risk identification.
- List the points of failure or possible opportunities for defects
- Document the inherent risks.
Prepare a risk register with the process owners
Document the controls for mitigating the risks.
- Standardize the processes
- Identify the controls and implement the same for Accept/ Reduce/ Transfer.
- Prepare an audit assurance plan to monitor the controls.
- Identify the action plans for implementing the same.
- Update the Risk register periodically.<br>
slide17. Mitigation controls – Macro risks Area of Deployment Operations Lack of BCP/ DR
Information leakage Frauds
Lack of standard operating
procedures Mitigation Controls Concurrent Audit of CTs > Rs2 Lakh
Maker <> Checker Surveillance E-learning modules (SOPs) Approval for high value payouts Access rights ISO 27001 controls DR/BCP Area of improvement E-learning modules Corp registry<br>
slide18. Mitigation controls – Macro Risks Epidemics
Industrial accidents Referral checks
Access controls ISO 27001 controls Mitigation Controls Structured performance management system Employee engagement - Rewards Health watch Facilities far off from Industrial estates Area of improvement Background check of Employees including temps<br>
slide19. Mitigation Controls – Macro Risks Area of Deployment Administration Fire hazard
Attack by anti social elements Grid collapse
Wide spread social unrest Mitigation Controls Fire fighting equipment
Fire drills
Fire Insurance ISO 27001 controls DG sets with sufficient capacity Liaison with police Ability to lodge key resources in the facility 24x7 watch and ward<br>
slide20. Mitigation Controls - Macro Risks Area of Deployment Information Security Networks Loss/ Theft of data
Denial of service attacks Infrastructure failure
Software failure/damage Data network link failures
Device and software failures Denial of Service attacks
Sabotage Mitigation Controls ISO 27001 controls
Change Management Enterprise class infra Access controls Redundant data lines from different service providers 24X7, monitoring of NW traffic by NOC Restricted super admin rights Vulnerability assessments Area of improvement Change Management Operational Level Agreement – IT & Ops<br>
slide21. Mitigation controls – Macro risks- Business environment Area of Deployment Business risks Reduction of AUM
Client negotiations
Reputation risks
Collapse of economy Consolidation and consequent
attrition (Low Order Booking)
Investment risks
Regulatory risks Mitigation Controls Diversification into other business activities
Diversification into other emerging economies e.g. ME, East Asia To agree with minimum fee capping
Restrict to limited period and continuously engage with clients for restoration Internal controls, Check list approach and compliance adherence process Proactive client and media communication
Strong media relationship Pre investment due diligence of investment entity<br>
slide22. KCPL’s Risk Management Framework Audit assurance on Controls<br>
slide23. Internal Audit carried out in accordance with Auditing and Assurance Standards and Standards on Internal Audit issued by the Institute of Chartered Accountants of India
Risk based approach in addition to Transaction Audit
Understand the way the management operates and controls the business
Identify gaps in controls
Suggestions on additional control measures Scoping Audit Approach & Methodology<br>
slide24. Prevention:
To identify risk in process flow
To mitigate internal and external fraud risk
To place controls in the system to filter deviations
Detection:
To detect process lapses at operational level
Rule based transaction level, system detection Investigation
To investigate on cases with deviations
To establish legitimacy of transactions detected
Deterrence
To apply back rules to the system based on investigations
To analyze data and place controls on potential risk areas Surveillance SCOPE<br>
slide25. Detection methods adopted :
Control Environment:
Study of existing control policies to reinforce the procedures
Risk Assessment
Data Mining
Identification of Internal and External threat to control structure
Evaluation and Analysis
Control Activities
Procedural recommendations
Periodic procedural assessments
Monitoring
Daily transaction monitoring
Compliance of existing controls Transaction review methodology :
System based logics imbibed to detect transactions
Rule based system tracking
Manual transaction verification on queued up cases
Periodic review and analysis to identify trends
Reporting:
MIS on volume of transactions queued up and verified during the month
Daily reporting to the processing units on caution marked transactions
Monthly review on action taken on previous reports Surveillance-Detection & Review Methodology<br>
slide26. Risk Parameters – Surveillance Module To be discussed<br>
slide27. Internal audit being conducted on a concurrent basis by In- house Internal Audit team and External Chartered Accountant Firm
A Risk Assessment report prepared based on audit observations as part of monthly audit report
Review of existing internal control systems and processes to mitigate the risks
Review of Compliance requirements and Actual compliance
Review of Adherence to Generally Accepted Accounting Principles Audit Process<br>
slide28. All divisions are continuously audited based on key parameters, viz. in case of Transfers, key parameters are signature of transferor, stamp duty paid, validity of transfer deed, capturing of investor name and address etc., likewise for other areas
Key parameters are decided based on risk assessment
Others factors viz. Control environment, Regulatory requirements, Contractual Obligations etc. define Audit scope as given hereunder: Audit Universe/scope<br>
slide29. MFS – Commercial Transaction verification Audit Plan, Frequency and Extent of verification<br>
slide30. MFS – Non-Commercial Transaction verification Audit Plan, Frequency and Extent of verification<br>
slide31. MFS – Batch processes, Reports, MIS etc. Audit Plan, Frequency and Extent of verification<br>
slide32. Audit Plan, Frequency and Extent of verification Corporate Registry<br>
slide33. SURVEILLANCE DATA COLLECTION METHODS 100% verification of transactions falling under the following parameters Online application notifying the surveillance team with the transactions in the form of triggers in a PRE & POST-DATA processing scenarios. The module/application applies 15 basic parameters for instant data skimming and highlighting the ones requiring further scrutiny Surveillance Audit Plan, Frequency and Extent of verification<br>
slide34. In addition to audit of Operations, audit of Books of Account, Contractual obligations viz. Payroll and Bills and adherence to Statutory & Regulatory Compliances are also verified. Further, on requirement basis, review of various processes are also taken up to identify gaps, if any and to take remedial actions Audit Plan, Frequency and Extent of verification<br>
slide35. A Monthly report is shared with the clients, giving the :
Volume of transactions verified during the month
Deviations / errors noticed during the month
Comparative analysis on the month-on-month transactions verified and the deviations noticed
Various other aspects including TAT Compliance for regulatory and statutory reports, Tax deductions, Remittances etc. MFS - MIS reports to clients Audit Notification, Reporting and Follow ups<br>
slide36. Audit Notification
Notification for audits are done by sending emails to the concerned staff of the divisions subsequent to personal/ telecon interactions with them. Though no specified templates are used for notification, the background, objectives, scope and information requirements are stated in the email
Audit Reporting on Initial Audit Observation
Initial audit observations are sent to the auditee through emails for discussion and feedback
Audit Follow ups
Audit Follow ups for information or for reply/feedback to Initial Audit Observations are done by personal interaction/telecon/through emails
Final Audit Report
Final Audit Report after incorporation of Management Comments are shared with the Concerned Staff Audit Notification, Reporting and Follow ups<br>
slide2. Overview of Risk Management & Internal Audit Framework<br>
slide3. KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls<br>
slide4. KCPL’s Risk Management Framework Information Security Management
Risk Based approach
Follows ISO 27001:2005 standard
Information security governance
Business continuity
Technology dimension
Operational risk management and Surveillance
Identify the critical operational processes and risks
associated with them.
Preparation of Risk register.
Document Controls ( Severity of control depends on the
risk appetite)
Compliance requirements and reports to the regulator
Fraud detection and control
Financial Risk Management
Accounting and financial controls and reporting.
Statutory and Regulatory requirements and fulfillment
Revenue and cost assurance
Fund Management/ Treasury operations Internal audit assurance
To ensure established controls to
mitigate identified risks, are actually
working.
To report non adherence to
established controls.
Suggest action plans for correction
Ensure the implementation of
suggested action plans<br>
slide5. KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls<br>
slide6. KCPL’s Information Security Management KCPL Information Security Management System Framework<br>
slide7. KCPL’s Information Security Management<br>
slide8. KCPL’s Information Security Management<br>
slide9. Information Security – Risk Assessment process<br>
slide10. Information Security – Internal audit execution Information security internal audit is – Risk based and is conducted by taking the following into consideration
Prepare the audit schedule.
Prepare the audit agenda with the controls to be tested
Conduct the internal audit as per the agreed scope and risk register
Prepare the working papers and submit the report for management comments.
Identify actions plans to improve Information security management<br>
slide11. Information Security management - Templates IF/ISMS/01.2/Ver. 1.1
Audit Report & Checklist Auditee Signature Auditor Signature<br>
slide12. Information Security management - Templates<br>
slide13. KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls<br>
slide14. KCPL’s Financial Risk Management Accounting of all financial transactions including accruals
- Billing to the client – Revenue accounting
- Accounting of financial commitments and liabilities
- Adherence to generally accepted accounting principals (GAAP)
- Monthly closing and reporting.
Statutory and Regulatory requirements and fulfillment
- Tax Payments and submission of related returns.
- Statutory and regulatory fees/ contributions payment.
- Intimation and submission of forms/ returns with statutory and regulatory authorities
Revenue and cost assurance
To ensure correct billing to clients as per contract.
To ensure all cost obligations are accounted
Fund Management
- Ensure collection from clients
- Ensure funds are invested in most profitable manner
- Ensure cash flow management, vendor payment<br>
slide15. KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls<br>
slide16. KCPL’s Operational Risk Management Document the processes
- Document the process flows.
Prepare the list of processes with the process owners
Document the process flows as they are
Identify the risks associated with the processes.
- Train the process owners on risk identification.
- List the points of failure or possible opportunities for defects
- Document the inherent risks.
Prepare a risk register with the process owners
Document the controls for mitigating the risks.
- Standardize the processes
- Identify the controls and implement the same for Accept/ Reduce/ Transfer.
- Prepare an audit assurance plan to monitor the controls.
- Identify the action plans for implementing the same.
- Update the Risk register periodically.<br>
slide17. Mitigation controls – Macro risks Area of Deployment Operations Lack of BCP/ DR
Information leakage Frauds
Lack of standard operating
procedures Mitigation Controls Concurrent Audit of CTs > Rs2 Lakh
Maker <> Checker Surveillance E-learning modules (SOPs) Approval for high value payouts Access rights ISO 27001 controls DR/BCP Area of improvement E-learning modules Corp registry<br>
slide18. Mitigation controls – Macro Risks Epidemics
Industrial accidents Referral checks
Access controls ISO 27001 controls Mitigation Controls Structured performance management system Employee engagement - Rewards Health watch Facilities far off from Industrial estates Area of improvement Background check of Employees including temps<br>
slide19. Mitigation Controls – Macro Risks Area of Deployment Administration Fire hazard
Attack by anti social elements Grid collapse
Wide spread social unrest Mitigation Controls Fire fighting equipment
Fire drills
Fire Insurance ISO 27001 controls DG sets with sufficient capacity Liaison with police Ability to lodge key resources in the facility 24x7 watch and ward<br>
slide20. Mitigation Controls - Macro Risks Area of Deployment Information Security Networks Loss/ Theft of data
Denial of service attacks Infrastructure failure
Software failure/damage Data network link failures
Device and software failures Denial of Service attacks
Sabotage Mitigation Controls ISO 27001 controls
Change Management Enterprise class infra Access controls Redundant data lines from different service providers 24X7, monitoring of NW traffic by NOC Restricted super admin rights Vulnerability assessments Area of improvement Change Management Operational Level Agreement – IT & Ops<br>
slide21. Mitigation controls – Macro risks- Business environment Area of Deployment Business risks Reduction of AUM
Client negotiations
Reputation risks
Collapse of economy Consolidation and consequent
attrition (Low Order Booking)
Investment risks
Regulatory risks Mitigation Controls Diversification into other business activities
Diversification into other emerging economies e.g. ME, East Asia To agree with minimum fee capping
Restrict to limited period and continuously engage with clients for restoration Internal controls, Check list approach and compliance adherence process Proactive client and media communication
Strong media relationship Pre investment due diligence of investment entity<br>
slide22. KCPL’s Risk Management Framework Audit assurance on Controls<br>
slide23. Internal Audit carried out in accordance with Auditing and Assurance Standards and Standards on Internal Audit issued by the Institute of Chartered Accountants of India
Risk based approach in addition to Transaction Audit
Understand the way the management operates and controls the business
Identify gaps in controls
Suggestions on additional control measures Scoping Audit Approach & Methodology<br>
slide24. Prevention:
To identify risk in process flow
To mitigate internal and external fraud risk
To place controls in the system to filter deviations
Detection:
To detect process lapses at operational level
Rule based transaction level, system detection Investigation
To investigate on cases with deviations
To establish legitimacy of transactions detected
Deterrence
To apply back rules to the system based on investigations
To analyze data and place controls on potential risk areas Surveillance SCOPE<br>
slide25. Detection methods adopted :
Control Environment:
Study of existing control policies to reinforce the procedures
Risk Assessment
Data Mining
Identification of Internal and External threat to control structure
Evaluation and Analysis
Control Activities
Procedural recommendations
Periodic procedural assessments
Monitoring
Daily transaction monitoring
Compliance of existing controls Transaction review methodology :
System based logics imbibed to detect transactions
Rule based system tracking
Manual transaction verification on queued up cases
Periodic review and analysis to identify trends
Reporting:
MIS on volume of transactions queued up and verified during the month
Daily reporting to the processing units on caution marked transactions
Monthly review on action taken on previous reports Surveillance-Detection & Review Methodology<br>
slide26. Risk Parameters – Surveillance Module To be discussed<br>
slide27. Internal audit being conducted on a concurrent basis by In- house Internal Audit team and External Chartered Accountant Firm
A Risk Assessment report prepared based on audit observations as part of monthly audit report
Review of existing internal control systems and processes to mitigate the risks
Review of Compliance requirements and Actual compliance
Review of Adherence to Generally Accepted Accounting Principles Audit Process<br>
slide28. All divisions are continuously audited based on key parameters, viz. in case of Transfers, key parameters are signature of transferor, stamp duty paid, validity of transfer deed, capturing of investor name and address etc., likewise for other areas
Key parameters are decided based on risk assessment
Others factors viz. Control environment, Regulatory requirements, Contractual Obligations etc. define Audit scope as given hereunder: Audit Universe/scope<br>
slide29. MFS – Commercial Transaction verification Audit Plan, Frequency and Extent of verification<br>
slide30. MFS – Non-Commercial Transaction verification Audit Plan, Frequency and Extent of verification<br>
slide31. MFS – Batch processes, Reports, MIS etc. Audit Plan, Frequency and Extent of verification<br>
slide32. Audit Plan, Frequency and Extent of verification Corporate Registry<br>
slide33. SURVEILLANCE DATA COLLECTION METHODS 100% verification of transactions falling under the following parameters Online application notifying the surveillance team with the transactions in the form of triggers in a PRE & POST-DATA processing scenarios. The module/application applies 15 basic parameters for instant data skimming and highlighting the ones requiring further scrutiny Surveillance Audit Plan, Frequency and Extent of verification<br>
slide34. In addition to audit of Operations, audit of Books of Account, Contractual obligations viz. Payroll and Bills and adherence to Statutory & Regulatory Compliances are also verified. Further, on requirement basis, review of various processes are also taken up to identify gaps, if any and to take remedial actions Audit Plan, Frequency and Extent of verification<br>
slide35. A Monthly report is shared with the clients, giving the :
Volume of transactions verified during the month
Deviations / errors noticed during the month
Comparative analysis on the month-on-month transactions verified and the deviations noticed
Various other aspects including TAT Compliance for regulatory and statutory reports, Tax deductions, Remittances etc. MFS - MIS reports to clients Audit Notification, Reporting and Follow ups<br>
slide36. Audit Notification
Notification for audits are done by sending emails to the concerned staff of the divisions subsequent to personal/ telecon interactions with them. Though no specified templates are used for notification, the background, objectives, scope and information requirements are stated in the email
Audit Reporting on Initial Audit Observation
Initial audit observations are sent to the auditee through emails for discussion and feedback
Audit Follow ups
Audit Follow ups for information or for reply/feedback to Initial Audit Observations are done by personal interaction/telecon/through emails
Final Audit Report
Final Audit Report after incorporation of Management Comments are shared with the Concerned Staff Audit Notification, Reporting and Follow ups<br>