01 AAM 22852 Template D Covid-19 Insight Analytic PDF

Preview

Summary

APM...

Description

Deloitte & Touche LLP - Audit Tool Template D: Compliance with U.S. AAM 22852 and U.S. PCAOB AAM 22852 When Using Audit Tools Developed by or Customized to a Particular Engagement (7-16)

AUDIT TOOL TEMPLATE D: COMPLIANCE WITH U.S. AAM 22852 AND U.S. PCAOB AAM 22852 WHEN USING AUDIT TOOLS DEVELOPED BY OR CUSTOMIZED TO A PARTICULAR ENGAGEMENT This template may be used to document the procedures performed by an engagement team when using an audit tool developed by or customized to a particular audit engagement. In this scenario, the engagement team is required to obtain reasonable assurance that the tools have performed as intended. Such assurance may be obtained by evaluating whether the quality and audit control objectives related to program design, program functions, user specifications, input data, confidentiality of entity data, the audit tool technology environment, learning, audit tool operations support, and audit tool end user support are achieved, as appropriate, considering the nature and technology underlying the engagement team specific custom tool. Professional judgement is used to determine whether the tool requires such procedures (e.g., this is not necessary for simple Excel spreadsheets) and the nature and extent of documentation needed. Documentation of procedures performed is required to be retained in the audit documentation.

Audit Tool Procedures

1. Describe the Tool: Document a description of the tool and the technical infrastructure supporting it.

Results

The COVID-19 Insight Analytic was developed for audit teams to use on audit engagements. The tool allows audit teams to view historical, regularly updated data that relates to the impact COVID19 has had on global and national economies. The tool visualizes data that is collected from public sources and presents this across three dashboards in PowerBI which is a tool that has been centrally reviewed in accordance with AAM 22852 to be utilized on engagements. Power BI is a software used directly on a practitioner's laptop, which is supported by each member firm's information technology practice. Since each program executed using Power BI can be updated by the engagement team, this analytic is considered an engagement team specific tool. The data is obtained through public data sources, can be downloaded online from source, are available without subscription,

Engagement Team Residual Responsibilities None

Deloitte & Touche LLP - Audit Tool Template D: Compliance with U.S. AAM 22852 When Using Audit Tools Developed by or Customized to a Particular Engagement (7-16)

and therefore can be downloaded regularly. They relate to data which is updated either daily or weekly: COVID-19 data (cases and deaths by country), financial data (indices value and volatility, interest rates and bond yields) and consumer & industrial activity data (Opentable restaurant booking data, global air quality data and global education status - school closures). Each dashboard can only be manipulated by audit teams by changing the country filters to return their required output. The dashboard is uploaded into a dedicated Knowledge Exchange (KX) Asset page within Deloitte Resources and is accessible for audit teams to download as a static dashboard. Audit teams are directed to access the dashboard via a link to KX Asset page from Cognia. The UK Corporate Audit & Assurance Analytics & Modelling team, (or “CAAM Team”) have built a process to download updated source data, perform formatting and error checks to ensure consistency and completeness, and to update the tool on a daily basis to ensure the version available to download on Knowledge Exchange has up to date data. 2. Evaluate Program Design: Summarize the process of developing and approving the design to meet the program objectives, including: a.

b.

Procedures performed to evaluate whether the intended use of the program is consistent with the purpose for which the program was designed Individual(s) who approved the design of

The tool has been developed by the UK CAAM team. This included sourcing various public data, cleansing and reformatting the data in PowerBI. All of the data is manually downloaded from online, public sources. The visualization was then built in PowerBI to present the available data in a suitable interactive format. This PowerBI visualization is then uploaded to the dedicated COVID-19 Insight Analytic KX Asset page. The reliability of the external data sources has been assessed by the A&M team together with UK National Accounting & Audit (NAA) in line with the ISA 500 requirements. ISA 500 on Audit Evidence includes considerations when assessing the source of audit evidence. Paragraph 7 notes when designing and performing audit procedures, the auditor shall consider the relevance and reliability of the information to be used as audit evidence, including information obtained from an external information source. (Ref:

2

[Engagement teams to consider whether the information is suitable for use in the manner in which it is being used and document the rationale here]

Deloitte & Touche LLP - Audit Tool Template D: Compliance with U.S. AAM 22852 When Using Audit Tools Developed by or Customized to a Particular Engagement (7-16)

the program updates and assessment of their qualifications.

Para. A26–A33g). We have considered the factors set out in paragraphs A26-A33g for each data set included. No concerns were noted with the sources of data, however for the COVID-19 data it was noted that there will be constant revisions due to the nature of the data collection. The design of the tool has been reviewed within the UK CAAM team and UK NAA to ensure that the visualisations are displaying the data as intended. This review included the consistency between the description and content of the visualisations, the consistency between the dashboard components, and the clarity and usability of the dashboard. Individuals who have approved the design of the analytic are Prepared by Charley Gale, and reviewed by Henry Benson & Dwaine Burley (Managed by Adam Page) Adam Page Adam is a Director in the UK A&M team and has been with Deloitte for over 19 years. Adam has extensive experience in the analytics and modelling space and is an approved Technical Quality Manager for modelling engagements. We therefore deem that he is an appropriately qualified person to have carried out this review.

3. Evaluate Program Functions: Summarize the process of testing and approving the program functions. a.

Procedures performed to evaluate whether the logic, calculations, and other key program functions embodied in the program and in any supplemental programs result in the program functioning as intended

After the initial sourcing of data and building of the PowerBI tool, it was reviewed and tested within the UK CAAM team and signed off by Adam Page. Power BI is a centrally certified commercial off the shelf tool which contains functionality provided by the vendor (e.g., filters, parameters, and calculation functions) and therefore the engagement team is not responsible for testing the vendor provided functionality. Testing included a run through of the visualization alongside performance checks of the dashboard in order to ensure that the audit teams would not experience technical issues relating to the loading time of data into the visuals. The updating, filtering and presentation functionality of the dashboard was also tested along with tests of different release version of PowerBI, allowing for users to be using legacy versions of PowerBI.

3

[If the engagement team did not modify the analytic, include the following: The engagement team obtained the most recent version of the analytic and only made changes to incorporate client specific inputs.

If the engagement team did modify the analytic, include the following and document the changes

Deloitte & Touche LLP - Audit Tool Template D: Compliance with U.S. AAM 22852 When Using Audit Tools Developed by or Customized to a Particular Engagement (7-16)

including the nature and extent of testing. b.

c.

Documentation of qualifications of the individual(s) who performed testing of the program and assessment of their qualifications. Description of version controls that are in place to prevent engagement teams from using the wrong version of the program.

The tool has a version number reference and date at the bottom of the “overview” page within the visualization. This will ensure that audit teams can keep a track of any updates (excluding updates to the data) made to the tool. Updates to the data are tracked through a separate box on the overview page recording the last refresh of the underlying data. The values used in the calculation of the metrics have been checked to assure accuracy of totals and geographic presentation.

herein as well as the procedures performed to address the risk that the analytic no longer functions as intended: The engagement team obtained the analytic and tailored the analytic as follows: XXXXXXXX]

The scaling used on graphs has been checked that it has a fair and consistent appearance. We have blocked the potential for the tool changing by deactivating the data refresh buttons for the version uploaded to the KX Asset site. It is also recommended that once audit teams have used the tool, that they take screenshots of the visualizations they wish to reference in audit documents. Review team as above.

4. Evaluate User Specifications: Determine whether the user specifications (e.g., date ranges, search parameters, selection criteria) are appropriate to perform the intended function(s) of the audit tool for the audit engagement. 5. Evaluate Input Data: Determine whether the appropriate data (e.g., correct version/period of

As the tool is analyzing the impact of COVID-19 the date range of the tool is focused on 2020. The dashboard has various filters that are able to be adapted by the audit team in order to return their required output. This includes selecting the country where the client might have significant operations. This enables the dashboard to then be tailored to the client and audit teams preference rather than the initial global view.

The tool uses publicly available data that is manually downloaded before feeding into the dashboard. The data sources have been determined to be reliable and from reputable sources as set out above. Links to each data source can

4

[Audit teams to set how/what filters were used and why the filters were appropriate for the intended function]

None

Deloitte & Touche LLP - Audit Tool Template D: Compliance with U.S. AAM 22852 When Using Audit Tools Developed by or Customized to a Particular Engagement (7-16)

input data) was used as input to the audit tool. Determine whether the input data is accurately and completely entered/loaded into the tool (e.g., reconcile the data to the general ledger or other authoritative source). 6. Evaluate Confidentiality of Entity Data: Determine whether the confidentiality of entity data is preserved by the engagement team from data acquisition to processing [U.S. DPM 10240].

be found on the overview page of the visualization. Once downloaded, the data is directly inputted into the tool in PowerBI. The process of the data being added to PowerBI has been reviewed in order to ensure the input data is accurate.

The tool uses standard software and processes as deployed across Deloitte, namely PowerBI and Alteryx and which therefore comply with relevant Deloitte policies. All data storage through KX Assets (Deloitte Resources) is hosted within Deloitte IT infrastructure and policies.

None

The global tool does not contain any entity data as the sole inputs are data that is publicly available and does not infringe on any restrictions placed upon the use of each dataset. The data in use does not contain any fields relating to personal information or entity-specific information.

7. Evaluate the Audit Tool Technology Environment: Document or refer to the procedures the project team completed to document and test relevant general IT controls (e.g., security, change control, operations) over the audit tool's technology environment (all layers — application, database, and operating system), as appropriate.

This tool uses standard software and processes as deployed across Deloitte, namely PowerBI and Alteryx, and which therefore are hosted on Deloitte IT infrastructure, and comply with relevant Deloitte IT policies. Future versions of the tool will be made and released by the UK CAAM team. New versions will be appropriately named and provided to the audit team via the KX Asset page.

5

None

Deloitte & Touche LLP - Audit Tool Template D: Compliance with U.S. AAM 22852 When Using Audit Tools Developed by or Customized to a Particular Engagement (7-16)

8. Learning Materials: Summarize or refer to learning course(s) prepared and required to be taken by individuals utilizing the audit tool on audit engagements.

9. Audit Tool Operations Support: Summarize or refer to technology operations protocols and resources (e.g., job scheduling, backup and retention requirements) to ensure appropriate operation of the tool. 10. Audit Tool End User Support: Summarize or refer to technology end user support protocols and resources established to ensure the appropriate investigation and response to issues arising during audit tool usage. 11. Evaluate Entity’s Impact on the Audit Tool:1

There is no separate user guide due to the simplicity of the PowerBI dashboard. Within the visualization there are aides in order to direct the user alongside a ‘reset’ button which can reset the dashboard to the original view, resetting any filters that may have been adapted. We distributed to all audit teams the location of the dashboard via communications email and featured it on the Global A&A COVID-19 technical delivery resource center. Understanding of the content and the purpose of the tool was confirmed with Global A&A Quality. Guidance on all the above will be included in a brief user guide found on the KX Asset page (accessible from the Cognia site). The tool is run and updated using PowerBI with data being stored by the UK CAAM team. This data is updated daily from online sources, downloaded and then input into the dashboard in order to ensure the visualization is up-to-date. The updates will be run by a member of the UK CAAM team and shared with Global A&A to upload to the global KX Asset page. No audit team member will run the update and they will only be able to download the most up to date tool from KX Asset (Deloitte Resources).

Should the audit team have any technical issues related to understanding or interpreting the data in the analytic tool, teams can contact the UK CAAM team central mailbox ([email protected]). Any technical issues related to PowerBI should be directed to local IT support.

Audit clients will have no interaction with the tool. The operation of the tool will be handled by the individual audit teams and the

6

Deloitte & Touche LLP - Audit Tool Template D: Compliance with U.S. AAM 22852 When Using Audit Tools Developed by or Customized to a Particular Engagement (7-16)

Determine whether the use of the audit tool was not adversely affected, either directly or indirectly, by entity personnel. 1

visualization will be updated on a daily basis by the UK CAAM team to ensure that current data is presented.

This step may not be relevant when the audit tool is running in a Deloitte data center or independent hosting location.

7...