Case study - Poste Italiane: Advanced BPE methods create value for internal control auditing

Transcript

1 Case study - Poste Italiane: Advanced BPE methods create value for internal control auditing Paolo Casati Poste Italiane S.p.A. Internal Auditing Director

2 Company profile 8 June 2011 ProcessWorld

3 Company profile: Poste Italiane Poste Italiane is the Italian leading operator in the postal services area and ensure public service with an important social role: the Global Postal Service. It is an innovative, competitive operator in the area of financial and payment services. Poste Italiane Group offers integrated communications, logistic and financial products and service throughout Italy: Main income, financial and operational figures Post Offices 200 Parcels and mail sorting centres postmen and postwomen ATMs POS 17 cargo and passenger charter services by day Vehicles Employees * Total Group revenue of which: 5.000* from Postal Services 4.700* from Financial Services 9.500* from Insurance Service (Insurance Premiums) * Euro/millions, Financial Year June 2011 ProcessWorld

4 8 June 2011 ProcessWorld Company profile: organization Posteitaliane S.p.A. BOARD OF DIRECTORS CHAIRMAN, CEO, DIRECTORS INSTITUTIONAL AFFAIRS CHIEF EXECUTIVE OFFICER AND MANAGING DIRECTOR INFORMATION TECHNOLOGY Corporate Areas EXTERNAL RELATIONS LEGAL AFFAIRS HUMAN RESOURCES AND ORGANISATION STRATEGIC PLANNING PURCHASING REAL ESTATE CORPORATE AFFAIRS ADMINISTRATION AND CONTROL SECURITY & SAFETY INTERNAL AUDITING INTERNET FINANCE Business Areas PRIVATE CUSTOMER POSTAL SERVICES EXPRESS COURIER AND PARCEL SERVICES LARGE COMPANIES AND THE PUBLIC ADMINISTRATION PHILATELY BANCOPOSTA

5 8 June 2011 ProcessWorld Company profile: the Group Posteitaliane Group Postel Poste Vita PosteMobile SDA Express Courier BancoPosta Fondi SGR Postecom Poste Tutela Poste Energia Mistral Air Europa Gestioni Immobiliari PosteShop n. 16 Subsidiaries

6 Processes Adoption of Company Business Process Model as Audit universe The Business Process Model consisting of four tiers processes. Business Process Model (First Tier) BPM - Nr. of processes First Tier Second Tier Third Tier Fourth Tier Governance [E] Planning [F] Internal Auditing [G] Quality [H] Budget and Control [A] Marketing management [B] Sales [C] Customer care Business [D] Operations [I] Human resources Main regulatory constraints Poste Italiane is subject to many laws and regulations issued by UE, Italian Parliament and authorities (Postal Services, Bank, Insurance, Finance authorities, etc) that disciplines the various sector in which the Company operates. Support [J] Real estate and infrastructures [K] Business Communication [L] Information & Communication Technology [M] Purchase and Supply Chain [N] Legal Affairs [O] Affari societari [P] Security [Q] Finance [R] Administration and reporting 8 June 2011 ProcessWorld

7 Starting point of project 8 June 2011 ProcessWorld

8 Starting point of project: Control Bodies and Internal Control System Players Compliance BancoPosta Technology Committee Strategic Committee Human Resources and Organization Italian Court of Auditors Security & Safety (Security) Board of Statutory Auditors Operational Risks Committee Administration and Control Board of Directors Internal Auditing Internal Audit BancoPosta Manager responsible for financial reporting Operational Committee Security & Safety (Safety) Compliance Officer (Legislative Decree 231/01) Risk Management Bancoposta Privacy law supervisors Finance Committee External Audit Firm Quality Security & Safety (ERM) ICT Security Committee Business Unit/ Operations Management Governance Control Levels 3 rd 2 nd 1 st 8 June 2011 ProcessWorld

9 8 June 2011 ProcessWorld Starting point of project: Internal auditing organization Chief Audit Executive Planning & System Ethics governance Quality Assurance and Improvement Group Companies Audit Audit Areas Coordination Corporate and Integrated Process Audit Audit staff and Central processes auditors: 98 North Audit Area North- Center Audit Area Peripheral processes auditor: 318 Center Audit Area Key Factors: Number of auditors/audit scopes South Audit Area Internal Auditing : 416

10 8 June 2011 ProcessWorld Starting point of project: project objectives Provide a positive assurance on a large and spread Internal Control System integrating controls carried on by various players Objectives collect and integrate relevant information in an efficient and timely manner, to understand and evaluate the ICS; adopt an approach to allow the implementation of the complete evaluation of ICS, not dependent by obsolescence and generalization problems connected to assessment approaches limited to testing provide assessment results on business and governance controls of organization to various internal clients (governance, compliance, managerial, etc.)

11 Solution Strategy 8 June 2011 ProcessWorld

12 8 June 2011 ProcessWorld Solution Strategy: integrated methodology approach Focus on control design and system reliability requirement as the key to go beyond the limits of approach based on testing Internal Control System Evaluation Control Design Operating effectiveness Integrated Process Audit Continuous Compliance Audit

13 8 June 2011 ProcessWorld Solution Strategy: ICS Evaluation Model Development and adoption of ICS Evaluation Model helpful to meet overall organization requirements Characteristics: Applicability On single control or whole ICS General (not dependent by business sectors, risks particularity, etc) Compliance with ICS international practices and standards (CoSo, ERM, Cobit, etc) Integrability related to model development Relevanc e Risk Tolerance Control Design Solidity Effectiveness/ Efficiency Reactivit y Business objectives Operating effectiveness Resources availability Control objectives Adequacy Governance objectives Residual Risk test Risk Acceptance Cost Effectiveness Cost of control Damage/ penalty Solution cost

14 8 June 2011 ProcessWorld Finding the right information system tool A flexible tool to implement the developing methodology Upgradable to allow the involvement of an increasing number of activities and players Versatile to meet requirements of various company players

15 8 June 2011 ProcessWorld Solution Strategy: pilot project Preliminary Assessment Data acquisition to determine the scope of the audit engagement Testing Audit program definition Execution of tests to measure the operating effectiveness of controls Reporting Communication the results of audit engagement Process standardization of Internal Audit activities by pilot project Preliminary Assessment Data acquisition to determine the scope of the audit engagement Control Design Description of process activities and controls mapping Identification of strengths and weaknesses of controls identified Testing Audit program definition; execution of tests to measure the operating effectiveness of controls Reporting Communication the results of audit engagement

16 8 June 2011 ProcessWorld Solution Strategy: industrialization of approach Process industrialization of Internal Audit activities through the use of new methodology for all audit activities Control Objectives Identification Identification of control objectives that allow to reach process objectives Interviews Meeting with process owners to identify activities and control process Process mapping Description of process activities and controls mapping ( as is ) ICS Evaluation Evaluation of Internal Control System architecture based on predefined criteria and standards

17 O... FASE 1 - Gestione operazioni e registrazioni Carries out & Supports Carries out & Supports Carries out & Supports Carries out & Supports Carries out & Supports Carries out & Supports Carries out & Supports FASE 1 - Gestione operazioni e registrazioni Cliente Operazione / apertura rapporto registrazione non corretta Controllo Anagrafe negativa Nominativo non presente in Anagrafe negativa Valutazione operazione Operazione non sospetta Registrazione operazione Chiusura giornaliera Accettazione operazione Accettazione operazione Verifica informatica soglie antiriciclaggio T01 Soglie non superate Gestione rettifiche registrazioni di giornata Annullo contabile e correzione Archivio provvisorio UP T01 T02 C Nominativo presente in Anagrafe negativa Adeguata verifica cliente warning su nominativo T17 Operazione sospetta Adeguata verifica cliente operazione sospetta Soglie superate Adeguata verifica cliente e registrazione dati Ricezione comunicazioni Correzione registrazioni Ricezione comunicazioni Rifiuto operazione Rifiuto operazione Gestione rettifiche registrazioni non di giornata rettifiche C T14 T17 Ricezione e inoltro warning su nominativi Operazioni non sospette Registrazioni Predisposizione e invio richiesta modifica / cancellazione DUP Ricezione comunicazioni Valutazione operazioni T17 T07 T08 Fax Operazioni sospette operazioni sospette Raccomandata interna Controllo giornaliero registrazioni Ricezione richiesta T09 Registrazioni non registrazioni non Ricezione e inoltro comunicazioni Modulo AN/M FASE 2 Ricezione richieste ed inoltro FILIALI Ricezione richiesta e inoltro Ricezione e inoltro comunicazioni Fax Nominnativi esistenti DIANA Richieste accolte Modifica / cancellazione operazioni Ricezione ed elaborazione dati Invio dati BBP - Antiriciclaggio Consultazione documenti Controllo nominativi in Anagrafe negativa T01 T02 T13 Registrazioni T07 T08 RIcezione richieste Controllo richieste Nuovi nominativi Aggiornamento Anagrafe negativa Verifica informatica registrazioni non T09 T08 Registrazioni non File.mdb con registrazioni non Elaborazione e riclassificazione dati registrazioni non File.xls con registrazioni non Richieste non accolte Richiesta revisione File.xls T09 richieste modifica / canclellazione CNS Ricezione e inoltro comunicazioni Ricezione dati Anagrafe negativa Importazione automatica dati AUI File.txt CIO Archivio generale Estrazione ed invio dati su utilizzo funzioni di sportello Archivio provvisorio T01 T02 T14 8 June 2011 ProcessWorld Solution Strategy: diffusion of results To put audit results and information gathered at internal clients disposal Control Objectives Identification Identification of control objectives that allow to reach process objectives Interviews Meeting with process owners to identify activities and control process Process mapping Description of process activities and controls mapping ( as is ) ICS Evaluation Evaluation of Internal Control System architecture based on predefined criteria and standards Control Objectives Process Controls Map GESTIONE ADEMPIMENTI NORMATIVI ANTIRICICLAGGIO FASE 1 - Gestione operazioni e registrazioni FASE 2 - Gestione segnalazioni FASE 3 - Gestione rapporti con Autorità T01 T02 T07 T01 T02 T17 T01 T02 T08 T09 T13 T21 T14 T17 Documenti del cliente Elenco nominativi collegati... Anagrafe negativa Confronto tra documenti del cliente e dati in Anagrafe negativa GESTIONE ADEMPIMENTI FORMATIVI UP warning su nominativo T17 FASE 4 - Pianificazione attività formativa T01 T02 T24 T25 T26 T29 FASE 5 - Programmazione dettagliata corsi T21 T24 T26 T29 T36 FASE 6 - Erogazione corsi T01 T02 T08 T09 T21 FASE 7 - Consuntivazione attività formativa T21 T26

18 O... FASE 1 - Gestione operazioni e registrazioni Carries out & Supports Carries out & Supports Carries out & Supports Carries out & Supports Carries out & Supports Carries out & Supports Carries out & Supports FASE 1 - Gestione operazioni e registrazioni Cliente Operazione / apertura rapporto registrazione non corretta Controllo Anagrafe negativa Nominativo non presente in Anagrafe negativa Valutazione operazione Operazione non sospetta Registrazione operazione Chiusura giornaliera Accettazione operazione Accettazione operazione Verifica informatica soglie antiriciclaggio T01 Soglie non superate Gestione rettifiche registrazioni di giornata Annullo contabile e correzione Archivio provvisorio UP T01 T02 C Nominativo presente in Anagrafe negativa Adeguata verifica cliente warning su nominativo T17 Operazione sospetta Adeguata verifica cliente operazione sospetta Soglie superate Adeguata verifica cliente e registrazione dati Ricezione comunicazioni Correzione registrazioni Ricezione comunicazioni Rifiuto operazione Rifiuto operazione Gestione rettifiche registrazioni non di giornata rettifiche C T14 T17 Ricezione e inoltro warning su nominativi Operazioni non sospette Registrazioni Predisposizione e invio richiesta modifica / cancellazione DUP Ricezione comunicazioni Valutazione operazioni T17 T07 T08 Fax Operazioni sospette operazioni sospette Raccomandata interna Controllo giornaliero registrazioni Ricezione richiesta T09 Registrazioni non registrazioni non Ricezione e inoltro comunicazioni Modulo AN/M FASE 2 Ricezione richieste ed inoltro FILIALI Ricezione richiesta e inoltro Ricezione e inoltro comunicazioni Fax Nominnativi esistenti DIANA Richieste accolte Modifica / cancellazione operazioni Ricezione ed elaborazione dati Invio dati BBP - Antiriciclaggio Consultazione documenti Controllo nominativi in Anagrafe negativa T01 T02 T13 Registrazioni T07 T08 RIcezione richieste Controllo richieste Nuovi nominativi Aggiornamento Anagrafe negativa Verifica informatica registrazioni non T09 T08 Registrazioni non File.mdb con registrazioni non Elaborazione e riclassificazione dati registrazioni non File.xls con registrazioni non Richieste non accolte Richiesta revisione File.xls T09 richieste modifica / canclellazione CNS Ricezione e inoltro comunicazioni Ricezione dati Anagrafe negativa Importazione automatica dati AUI File.txt CIO Archivio generale Estrazione ed invio dati su utilizzo funzioni di sportello Archivio provvisorio T01 T02 T14 8 June 2011 ProcessWorld Solution Strategy: take on board the organization Return management of specific information to actual process owners Control Objectives Process Controls Map GESTIONE ADEMPIMENTI NORMATIVI ANTIRICICLAGGIO FASE 1 - Gestione operazioni e registrazioni FASE 2 - Gestione segnalazioni FASE 3 - Gestione rapporti con Autorità T01 T02 T07 T01 T02 T17 T01 T02 T08 T09 T13 T21 T14 T17 Documenti del cliente Elenco nominativi collegati... Anagrafe negativa Confronto tra documenti del cliente e dati in Anagrafe negativa GESTIONE ADEMPIMENTI FORMATIVI UP warning su nominativo T17 FASE 4 - Pianificazione attività formativa T01 T02 T24 T25 T26 T29 FASE 5 - Programmazione dettagliata corsi T21 T24 T26 T29 T36 FASE 6 - Erogazione corsi T01 T02 T08 T09 T21 Organizational units charts Processes charts Lists of Powers Risks maps and evaluations FASE 7 - Consuntivazione attività formativa T21 T26

19 Conclusion and next steps 8 June 2011 ProcessWorld

20 8 June 2011 ProcessWorld Conclusion The winning solution: Vision of final purpose Gradual and flexible methodological and operative approach (bottom up) Selection of the right IS support tool Early understanding of the needs of different players and develop of audit activities accordingly

21 8 June 2011 ProcessWorld Benefits for the company gained by our approach Improving efficiency in the information management: Before -> processes mapped by various organizational units Now -> processes mapped by only one process owner (HRO) Administrative processes mapped by Administration and Control Function, useful for other organizational units Univocal vision of risks/adequacy of Internal Control System Swiftest decisions Common language and culture

22 8 June 2011 ProcessWorld Benefits for the company gained by our approach Elimination of redundant information systems tools

23 8 June 2011 ProcessWorld Next steps Development of methodology: Going back to risks (not yet integrated into the approach) to complete the model Use of control processes simulation and performance management tools to proceed from assessment to ICS proactive management with an effective and efficient perspective

24 Thank you! Case study - Poste Italiane: Advanced BPE methods create value for internal control auditing Paolo Casati - Poste Italiane S.p.A.