The internal audit function plays an important role within the organization to monitor the effectiveness of internal control on various topics. In the current data-driven era we are living in, it will be hard to argue that internal control testing can be done effectively and efficiently by manual control testing and process reviews. Data analytics seems to be the right answer to gain an integral insight into the effectiveness of internal controls, and spot any anomalies in the data that may need to be addressed. Implementing data analytics (audit analytics) within the internal audit function is however not easily done. Especially international organizations with decentralized IT face challenges to successfully implement audit analytics. At Randstad we have experienced this rollercoaster ride, and would like to share our insights on which drivers for success can be identified when implementing audit analytics. In the market we see a large focus on technological aspects, but in practice we have experienced that technology might be the least of our concerns.

Data Analytics within the internal audit

The key benefits in performing data analytics within the internal audit function are predominantly:

more efficiency in the audit execution;
cover more ground in the audit executions;
create more transparency and more basis for audit results/findings.

Figure 1. Classical internal audit control testing vs. control testing and data analytics. [Click on the image for a larger image]

Introduction: Audit Analytics, obvious benefits

As an example, we would like to ask you this question: what is the main topic during seminars, conferences concerning data analytics? What is most literature about? How is the education system (e.g. universities) responding?

Chances are your response will involve technology: you read about great tooling, data lakes, the need for you to recruit data analysts and, very important, you must do it all very quickly.

However, the biggest challenge is not technology. The IT component is obviously important, but it is ill-advised to consider the implementation of audit analytics to be just about technology.

Of course, we are not here to argue with the fact that technology is a very important driver to enhance the capabilities of the auditor. The benefits of being able to run effective data analytics within the internal audit function are obvious. The same seminars will usually underline these benefits as much as they can: data analytics in the audit will provide the auditor with more efficiency in his work, and will enable him to cover more ground in the audit executions. Moreover, the auditor will be able to create more transparency and basis for audit results towards the business.

Rightly so, the benefits are obvious, and it seems easy enough to implement. These benefits are well known within the audit community. The benefits are however usually based on the premise of having a good technological basis as the key to success. One could hire a good data analyst and build an advanced analytics platform, and just go live. In some cases, this could work, reality is, however, more challenging.

In most cases more complex factors play a pivotal role in the success of audit analytics, which are not easily bypassed by just having a good data analyst or a suitable analytics platform. Factors that most corporate enterprises must deal with are, for example:

a complex corporate organization (internationally oriented and therefore different laws, regulations and frameworks, decentralized IT environment and different core processes);
the human side of the digital transformation that comes with implementing audit analytics;
integrating the audit analytics within the internal audit process and way of working.

The success of really transforming the internal audit function to the internal audit of tomorrow is where data analytics is embedded in the audit approach, and a prerequisite of gaining insights into the level of control and the effectiveness thereof with the auditee’s organization.

This success we are talking about is currently perceived as a ‘technical’ black box. In our opinion this black box is not only of technological nature, but has a lot more complexities added to it. In this article, we tend to open this black box and offer some transparency based on the experiences we have gained in setting up the internal audit analytics function.

To do this, we will start to describe the experiences we have gained in setting up audit analytics. Based on our story, we will outline our key drivers for success, regarding the implementation of audit analytics. Furthermore, we will move in to detail on how these drivers influence each other, and the importance of a balancing act between the drivers.

Case study: how the Randstad journey on Audit Analytics evolved

In 2015, Randstad management articulated the ambition to further strengthen and mature the risk and audit function. The risk management, internal controls and audit capabilities were set up years before. Taking the function to the next level meant extending existing capabilities and perspectives, with the intent not only to ensure continuity, but also to increase impact and added value to the organization. Integrating data analytics into the way of working for the global risk and audit function was identified as one of the drivers for this.

To set up the audit analytics capability, several starting points were defined:

build analytics once, use often;
in line with the organization culture, the approach has to be pragmatic: it will be a ‘lean start-up’;
the analytics must be ‘IIA-proof’;
security and privacy have to be ensured;
a sustainable top down approach, rather than datamining and ad hoc analytics.

This meant that a structured approach had to be applied, combined with the willingness to fail fast and often. In the initial steps of the process, technical experts were insourced to support the initiative in combination with process experts. With a focus on enabling technical capabilities, projects were started to run analytics projects in several countries, and in parallel develop technical platforms, data models and analytics methodologies.

With successes and failures, lots of iterations, frustrations and, as a result, lessons learned, this evolved into a comprehensive vision and approach on audit analytics covering technology, audit methodology, learning & development and supporting tooling & templates. Yet at the same time, it resulted into an approach, which is in line with the organizational context, fit for its purpose, and general requirements, such as GDPR.

Yet at the same time, the results of the analytics projects and contribution to audits showed interesting and promising results: by the end of 2017 a framework of 120 analytics was defined, out of which 65 were made available through standard and validated scripts.

Drivers for successful Audit Analytics

Looking back at the journey and summarizing the central perspective, a model emerged identifying drivers for successful audit analytics. The journey the Randstad risk & audit function has gone through, addressed challenges in five categories: organizational fit, internal organization of the audit analytics, supporting technical tooling and structure, audit methodology alignment and integration and skills, capabilities and awareness.

At different times in the journey, different types of challenges emerged. For example, when Randstad started expanding methodologies and technologies, the next challenge became the fit and application within the organizational context. This in turn translated into developments in the audit analytics organization. Then, the human component became a point of attention, translating into addressing audit methodology alignment and related skills/capabilities. In turn, this was further supported by updating the technical structures. During our journey it became clear to us that these challenges where not individual of nature, but are interacting with each other, and form an interplay of success drivers.

Next, we will go through the five identified challenges in more detail, and illustrate what this means in the Randstad context. In the following chapter we will try to transform these challenges into an early model, that will be the starting point in understanding which drivers have an impact on the success of audit analytics.

Implementing Data Analytics: key drivers for success

In the previous chapter, we discussed how Randstad experienced the implementation of audit analytics and the challenges and learnings that have been gained over the years. In this chapter we will further dissect the identified challenges, and translate them into drivers for success in implementing audit analytics.

Organizational fit

The first question one might want to ask before setting up an analytics program is: ‘how does this fit within the organizational structure?’. The organizational structure is something that cannot be changed overnight, and yet it will greatly determine how your data analytics program must be set up. In case this isn’t thought through carefully in the setup phase of audit analytics, one might encounter an organizational misfit regarding choices that have been made concerning technology or analytics governance. We will outline the key factors that will have an impact on the way audit analytics has to be set up:

centrally organized versus decentralized organization;
diverse IT landscape regarding key systems versus a standardized IT infrastructure;
many audit topics versus a high focus on a few specific audit topics;
uniform processes among local entities versus divers processes among local entities;
similar law, regulations and culture versus a diverse landscape of law, regulations and culture;
aligned risk appetite versus locally defined risk appetite.

We do not perceive the organizational structure as a constant that cannot be changed, but as something that cannot be greatly influenced in order to set up the analytics organization. Therefore, one must consider how the analytics organization can best fit the overall organizational structure, rather than the other way around. The lessons learned regarding this challenge are that it is vital to assess how the organizational structure may impact your methodology and setup for audit analytics. This can have both huge technical as procedural implications on setting up your audit analytics organization.

Audit analytics organization

The way the audit analytics organization is set up, is also a key driver for success. There are a lot of choices one can make when setting up the organizational structure, and defining the roles and responsibilities within the analytics or audit team. The key decision is perhaps whether or not you want to carve out the analytics execution and delegate this to a specialized analytics team, or whether you want to assign the role of data analyst to the auditor himself. This decision will have a great impact on a lot of other things that have to be considered when setting up a data analytics program. Other key factors that we have identified in setting up the analytics organization:

central data analyst team versus analytic capability for the local auditor;
a central data analytics platform or a limited set of local tooling;
separate development, execution and presentation versus generic skillset.

Audit analytics technical structure

The third key driver we mention is the technical structure that will enable the auditors to execute the data analytics. As said in the introduction, this topic usually plays a central role at seminars, conferences and literature about data analytics. In our opinion it is one of many drivers for success, and not necessarily the most important one. Decisions that have been made earlier in the previous two drivers will have a big impact on what choices one should make in this area. Areas to consider are:

implementing a central platform or work with local tools;
implementing an advanced data analytics platform versus choosing low entry data analytics tooling;
using advanced data visualization tools or using low entry visualization tools.

Audit methodology alignment and integration

The fourth key driver is – in our experience – the one that is overlooked the most. People tend to see it as a given that auditors will embrace data analytics, once it is widely available to them. On the contrary however, we have seen that auditors are somewhat reluctant in changing their classical way of working in a more data-driven audit approach. The way that data analytics will be integrated within the audit program or audit methodology is a pivotal factor for success. The right decisions regarding the following topics need to be made:

integrate the analytics in the audit methodology through a technology-centered approach (technology push) versus an audit-centered approach (technology pull);
data analytics as a serviced add-on to the audit approach versus a fully integrated audit analytics approach;
data analytics as pre-audit work to determine focus and scope versus data analytics as integral control testing to substantiate audit findings (or both!).

Skills, capabilities and awareness

The last defined driver for success is the skillset of the auditor to fully leverage data analytics. The skillset does not only imply the execution of the analytics, but also how to present the analytic results, and explain its implication to the business and the auditee. It is vital that the message comes across clearly, and how the analytics support the audit findings. This requires both technical knowledge regarding the analytics process and generic audit know-how, but most importantly it requires in-depth knowledge on the data the analytics have been executed on. The following key choices need to be made:

relying on well-equipped data analysts to execute and deliver audit analytics versus training the auditor in order to equip him or her to execute audit analytics;
relying on data analysts to interpret and understand analytics results and its impact on the audit versus relying on the auditor to understand the data and the executed analytics and its impact on the audit.

The crucial choice that needs to be made, is whether you will rely on the auditor to further deal with the audit analytics, or will they be assisted by a data analyst to perform the technical part of the audit analytics? If you choose the latter, you will be faced with the challenge to create an effective synergy and collaboration between the two, where the analyst understands the data and the executed analytics (and visualizations), and the auditor can put the implications of the analytic results in place for the audit findings. To create such a synergy might not seem a major challenge at first. We have however experienced that data analytics is not part of the DNA of all auditors, and therefore it might be a bigger step to take then initially presumed.

Model: drivers for success

When we summarize our experiences in a visual overview, it would look like the model presented in Figure 2 below. The model shows the interconnection between all the five drivers that have an impact on the success of your data analytics implementation. A decision made regarding one of the key drivers will in the end influence the decisions that have been made regarding one or more other drivers. Each organization that is about to implement data analytics must find the right balance between the identified drivers for success.

Figure 2. Key drivers for success. [Click on the image for a larger image]

Implementing data analytics – a balancing act

Does having this model make audit analytics successful? For Randstad, it is not this model that made audit analytics where it is today. Assembling all the lessons learned and the root cause analyses of all the ‘failures’ the organization experienced, this model emerged. It is as such a reflection of what management has learned in the journey so far. At the same time, it is a means to an end: it facilitates discussions in evaluating where an organization stands today regarding analytics, and which key challenges need to be addressed next. It thereby supports management conversations and decision-making moving forward.

Ultimately, it is all about bringing the configuration of the different drivers in balance. In implementing audit analytics, Randstad has, so far, failed repeatedly. In most cases the lessons learned analyzed: where there is pain, there is growth. It identified that an unbalance in the configuration of the drivers was the root cause.

There are multiple factors to be addressed during the implementation. These factors can sometimes be opposites of each other, creating a ‘devilish elastic’. In the Randstad journey a big push was made to set a central solution, facilitate a technical platform and integrate analytics in the audit methodology. In the course of 2017 a lesson learned was picked up from this push: the projects that were run centrally yielded positive results. It did not translate however into the global risk and audit community to start running audit analytics throughout their internal audit projects.

Randstad has set the technology and methodology; the key is to now also bring the professionals to the same page in the journey. As audit analytics in its potential, fundamentally changes the way you run audits, it also means changing the auditor’s definition of how to do its work. Overwriting a line of thinking that has been there for a very long time is maybe one of the biggest challenges there is. Therefore, when the questions are asked on what Randstad is doing currently to implement audit analytics, and what the current status is, the answer is as follows: ‘To get audit analytics to the next level, we are currently going through a soft change process with our risk & audit professionals, to get them to not only embrace the technology, but also the change in the way we perform our audits as a result. Overall, we are at the end of the beginning implementing audit analytics. Ambitious to further develop and grow, we are looking forward to failing very often, very fast.’

Concluding remarks

In this article we summarized the importance of data analytics in the internal audit, the road that Randstad has taken to implement audit analytics, the challenges and lessons learned along the way, and how these lessons can be translated into a model of key drivers for success. The goal of this article is to codify our journey and corresponding lessons learned, and communicate the experiences to the audit community, so they can profit from them.

The important message that we want to communicate, is that implementing audit analytics is far from just a technological challenge. By implementing data analytics, a large change is brought to the internal audit organization. The auditors need to change their way of working, and make a paradigm shift towards a data-driven audit. One cannot underestimate the implications of such a change by focusing mainly on the technological success of data analytics.

Reflecting on these developments and audit analytics initiatives, one should really take this paradigm shift into account. What does audit analytics mean in the old world, but also in the new world?

Ultimately a key challenge is how to go through the paradigm change, and how to support (or not support) auditors in making the paradigm change? Understanding and embracing audit analytics might not be their biggest challenge! Something Randstad Global Business Risk & Audit is working on, daily!

(Data) science in financial audits

A data-driven audit where advanced modeling will be the core of the audit: we briefly discuss how cheaper computing power, academic research and open-source software development are important in realizing this future and what we should consider when we build models for the purpose of a financial audit.

(Data) science in financial audits

Auditor: “Hi Siri, I am looking at the financial report of Shell. What do you think?” – Siri: “I’ve used 60.000 public data sources and run 1.5 million simulations. The financial numbers of Shell are very likely to be a fair representation given the current economic circumstances. However, it seems that their margins have increased which cannot be explained by any other available data. I would recommend asking how they’ve achieved that.”

A financial audit invoked through Siri, will this be a crazy statement or the audit of the future? You might be wondering how we can build this future? In this article we will discuss three aspects that could help us realize this future:

Economics of computer models: why would modeling make sense from an economic perspective?
Academia and open-source development: how can audit innovation leverage advances made in other research areas? More specifically, how could we utilize the faster moving academic and open-source community better?
Data and modeling: how can we start building models that can be used in audits?

Economics

Siri used 60.000 data sources and performed 1.5 million simulations to assess if the financial numbers made sense. Storing that amount of data, designing and running those simulations is costly. Therefore, using simple economics, we must assess whether it is profitable to use computer simulations to assess the financial numbers.

In 1966-67, Benston [Bens66] and Jensen [Jens67], discussed the application of a regression model that could estimate financial positions. The cost of using this model is around 30 USD and it was considered to be an efficient tool ([Bens66]). If we compare these costs with computer models we use nowadays, we see an astonishing drop in costs. Take for example a Tesla Autopilot. To drive your car, it continuously collects sensor data and performs all kinds of computations to keep the Tesla on the road. The costs of the Tesla Autopilot would have been astronomical if the prices would have been at the same level of 1967. An economically viable Tesla Autopilot at that time would have less sensors and less computational power, making it challenging to keep your car on the road. We require a certain minimum amount of data and computational power for the algorithm to be useful.

Similar for the audit models, we need to know if it is possible to reach a level of accuracy that is satisfactory and even then, we need to consider the cost-benefit perspective. Given the recent pricing of computer power and storage, it is likely that running data hungry models is viable from an economic perspective. We could enhance the auditor by enriching the audit workflow with machine learning models where a simple question must be answered: “Is the machine prediction cheaper than human prediction?”. In scenarios where this answer is affirmative, we will start building models, often replacing mind numbing tasks for the auditor, so that the auditor can focus on the more challenging tasks at hand (e.g. account valuation). Even when the answer is affirmative, we need to consider the costs of developing such a solution. In the next section we will explain how audit innovation could benefit from academic research and open-source development to significantly speed up the development timeline.

Audits and technology

Most technical developments in audit research coincide with research developments in other fields. A good example is the application of time series models in audits. Researchers started to develop more advanced econometric analyses like time-series analysis ([Box70]). This research was applied to the audit by Kinney in 1978. And this is not unique, similarly, in the field of computer science and database technologies, we see applied research in audits ([McCa82], [Groo89]) which now can be related to the field of IT Auditing. Researchers in the audit field cleverly try to incorporate technological advances from other fields in audits. This raises the question of which research wave we can catch in order to take audits to the next level.

In the statement made by Siri, we see that numerous public datasets are cross-checked with advanced simulations in order to determine if the numbers make sense or not. Data and modeling are the key ingredients that enabled Siri to do this analysis. Before we discuss the models, we first discuss how scientific advances can be used in practice. Therefore, we must understand how an idea transfers from a paper to the open-source world. Furthermore, an interesting aspect is that these open-source communities are moving faster and are now more impactful than ever before. To show the connection between the academic world and the open-source world, we discuss a couple of open-source projects below.

In 2003, Ghemawat et al. [Ghem03] published the Google File System paper in the Association for Computing Machinery (ACM), describing a way to store big data on commodity hardware. Doug Cutting implemented this in 2006 ([JIRA06]) as an open-source project which is now known as Hadoop. Hadoop is currently widely used to store big data by many large organizations. Storing a lot of data naturally created the urgency to start performing calculations on this large data set. UC Berkeley’s AMPLab created Spark in 2009, which is a distributed processing framework. Spark has been open-sourced in 2010 and had nearly a thousand collaborators in 2015 ([Zaha10], [APAC14]). Another open-source project initiated by Google is Kubernetes, as a way of automated deployment and scaling of applications. Kubernetes, as an open-source project, started in 2014 and is based on fifteen years of experience of Google in scaling applications. In 2018, Kubernetes won the ‘Most Impact’ Award with nearly 20.000 contributors, almost a million comments in the code management platform ([KUBE18]).

From the above-mentioned examples, it becomes clear that research finds its way into open-source implementations and there is a rapidly growing community supporting and improving these products. By using these open-source products, we can leverage decades of research progress and implementations provided by some of the best engineers the world has to offer. And this is nearly impossible to reproduce by any one company in the world. This is the big wave we can ride to take audits to the next level and benefit from the collaboration of thousands of people around the globe. Although, this mainly tells us that we should use open-source software to speed up the development, it does not tell us how we should develop the models. In the next section we explain why modeling can be used to audit an organization, but more importantly how the designers of these models should therefore be aware of potential pitfalls.

Why are models useful?

A model, which can be anything from a machine-learning model, econometrics model up to a physics model, is a simplified description of reality in mathematical terms. Modeling and simulation is an extremely powerful tool to understand a system and answer questions about that system ([STAN18]). Recent research by MIT [MIT14] provides an excellent illustration of how powerful these concepts are in doing something that seems to be impossible.

Imagine a situation with two rooms separated by soundproof glass. In one room there is a radio and a plant, in the other room, a person. The person wants to listen to the radio through the soundproof glass. Sounds, pun intended, impossible right? With some simple tools and some mathematics, however, we can solve this problem. Recent research [MIT14] shows that with a camera and an object in the other room, e.g. a glass, a bag of potato chips or a plant, is enough to reconstruct the sound in the other room. They used the knowledge that sound travels through air and impacts the objects in the room. They measured this vibrational impact on the plant with a high-speed camera and used this video to reconstruct the sound signal. Various mathematical concepts are used in this scenario to approximate the information of interest. This means that the music sounds similar, but is not exactly the same. In some models we can increase the approximation quality by doing more computations and this nicely connects to the economics of modeling. As a general rule of thumb the more accurate the models are the more costly they become.

Simulation and modeling are used in many areas, ranging from physics, to biology and chemistry, but also in the banking industry to calculate the risk exposure of the investment portfolio. Modeling techniques from agent-based models up to deep neural networks are developed for this purpose. These models are used to make accurate predictions about the system or to simulate the system under various conditions and study the output. In a similar fashion we can consider a company as a system which we want to understand better, and having a model would enable us to ask questions so that we achieve this result. In an audit, we can use cleverly constructed models to recover information of interest in a creative way. So, let’s be creative, very creative! In this way we can think of truly new ways of obtaining the information of interest for audits. Before we continue with creative implementations of models in audits, we briefly discuss how these models relate to the current way an auditor operates. This is helpful in assessing which models are helpful and which are not.

Auditors study information obtained from the client, which helps them create an understanding of how the organization operates. This understanding is then used to audit the client and assess if their financial statements are a fair representation. Next, we have a look at the objective of models. One of the purposes of computer simulations of a model is to gain a better understanding of the data (information from the client) we already have. The models can be used to retrodict, that is, infer about past events using present information. This creates a deeper understanding about how these events occurred ([STAN18]). The application of models to retrodict is not very different from the objective of the auditor, only the means by which we explain the past year events are completely different. The understanding of the auditor is closely related to the mathematical model, both the understanding of the auditor and the model are used to create a deeper understanding of the subject, namely the financial statements.

However, there is one important element we need to keep in mind, that the objective is to understand. Most companies are sitting on a big pile of data and it is tempting to mine this data to uncover patterns and use these patterns to make predictions. Nevertheless, the prediction itself is not the objective, but understanding is. Professor Peter Sloot refers to this as ‘Big Nonsense’, and illustrates this with an excellent example ([Sloo16]):

“Astronomers of the Maya civilization and astronomers of the Babylonian civilization were brilliant in predicting astronomical events. For instance, from meticulous observations of the Sun, Moon, Venus and Jupiter they were able to predict the 584-day cycle of Venus or the details of the celestial track of Jupiter with astonishing accuracy. Yet they had no clue about our heliocentric solar system, they believed that the earth was flat, and they were completely ignorant of the real movement of stars and planets while being convinced that the sky was supported by four jaguars, each holding up a corner of the sky.”

This example illustrates one of the potential dangers of uncovering patterns from historical data which we now know as Data Science or Big Data ([Sloo16]). The patterns uncovered might trick you into believing something that is not true. Therefore, the models need to be enriched with computational predictive models such that we can falsify or confirm our interpretations ([Sloo16]).

To build a model for the purpose of an audit will be challenging. Nevertheless, if the model is constructed properly then the model can be used to understand the past year activity of an organization. Parts of the audit could be replaced by such models that collect audit evidence. Maybe it is possible to reuse these models between audits in the same industry and calibrate the model to the specific needs of that organization. In any case, these models can analyze countless data sources and perform endless simulations tirelessly which cannot be achieved with manual labor. A hybrid version of the audit workflow where the auditor and the model complement each other could greatly enrich the experience of the auditor. But in order to develop the models, we need to perform research that can falsify or confirm the models and an essential ingredient for this research is the availability of data. Therefore, the clients play a role in the development as well, sharing their data and providing feedback.

Conclusion

We started this article with an imaginary situation where we asked Siri to audit the financial statements. Although this scenario is not yet a reality, we do see that technological developments are moving faster than ever before. Leveraging the advances made by the academic and the open-source community can shorten the development timeline dramatically. Furthermore, modeling is in many areas an economically viable business model. Nevertheless, due to the nature of the audit, we must take precaution in what kind of models we want to use and how we want to use them. We do not want to fool ourselves into thinking something that is not true. However, we must realize that an important different step must be taken. Developing this future takes effort from academia, engineers, auditors and, finally, audit clients collaborating intensively. We need the data and feedback of the clients to build these models and falsify or confirm them. The auditee plays a crucial role in developing this future, so we are counting on them as well!

References

[APAC14] APACHE, The Apache Software Foundation Announces Apache™ Spark™ as a Top-Level Project, Apache.org, https://blogs.apache.org/foundation/entry/the_apache_software_foundation_announces50, 2014.

[Bens66] G.J. Benston, Multiple regression analysis of cost behavior, The Accounting Review, Vol. 41(4), pp. 657-672, 1966.

[Box70] G.E. Box and G.M. Jenkins, Time Series Analysis Forecasting and Control, Wisconsin University, Madison Department of Statistics, 1970.

[Ghem03] S. Ghemawat, H. Gobioff and S.T. Leung, The Google file system, ACM, Vol. 37, No. 5, pp. 29-43, 2003.

[Groo89] S.M. Groomer and U.S. Murthy, Continuous auditing of database applications: an embedded audit module approach, Journal of Information Systems, Vol. 3(2) pp. 53, 1989.

[Jens67] R.E. Jensen, A Multiple Regression Model for Cost Control – Assumptions and Limitations, The Accounting Review, Vol. 42(2), pp. 265-273, 1967.

[JIRA06] JIRA, Initial import of code from Nutch, Apache.org, https://issues.apache.org/jira/browse/HADOOP-1, 2006. Accessed on: 29-10-2018.

[Kinn78] W.R. Kinney Jr, ARIMA and regression in analytical review: an empirical test, Accounting Review, pp. 48-60, 1978.

[KUBE18] Kubernetes, Kubernetes Wins the 2018 OSCON Most Impact Award, Kubernetes.io, https://kubernetes.io/blog/2018/07/19/kubernetes-wins-2018-oscon-most-impact-award/, 2018.

[McCa82] W.E. McCarthy, The REA accounting model: a generalized framework for accounting systems in a shared data environment, Accounting Review, pp. 554-578, 1982.

[MIT14] Larry Hardesty, Extracting audio from visual information, MIT News, http://news.mit.edu/2014/algorithm-recovers-speech-from-vibrations-0804, 2014.

[Sloo16] Peter M.A. Sloot, Big Nonsense: the end of scientific thinking is near…, Peter-Sloot.com, http://www.peter-sloot.com/blog/big-nonsense-the-end-of-scientific-thinking-is-near, 2016.

[STAN13] Stanford Simulation, Computer Simulations in Science, Stanford Encyclopedia of Philosophy, https://plato.stanford.edu/entries/simulations-science/, 2013. Accessed on: 29-10-2018.

[Zaha10] M. Zaharia, M. Chowdhury, M.J. Franklin, S. Shenker and I. Stoica, Spark: cluster computing with working sets, HotCloud, Vol. 10 (10-10), pp. 95, 2010.

Horizontaal Toezicht als basis van vertrouwen in de zorgketen

De invoering van Horizontaal Toezicht in ziekenhuizen lijkt een additionele controlesystematiek te zijn, waardoor de ziekenhuizen nog meer tijd kwijt zijn aan controles, in plaats van aan patiëntenzorg. In dit artikel laten de auteurs een ander werkend perspectief zien. Niet de controles zouden leidend moeten zijn, maar uitgangspunten als de wil om te verbeteren, gemeenschappelijke verantwoordelijkheid en de evenwichtige balans tussen harde en zachte controles.

Inleiding

In 2017 publiceerde Compact een artikel over de invoering van Horizontaal Toezicht in Nederlandse ziekenhuizen [Uter17]. In dit artikel werd een pleidooi gehouden om IT een prominentere rol te laten spelen, zodat ook echt van de voordelen van Horizontaal Toezicht kan worden geprofiteerd. Een jaar later zijn vrijwel alle ziekenhuizen gestart met projecten op het gebied van Horizontaal Toezicht, sommige zullen op korte termijn hiermee starten. De stimuleringsregeling van de zorgverzekeraars heeft hier zeker aan bijgedragen. Ook instellingen in de geestelijke gezondheidszorg gaan vanaf komend jaar actief met Horizontaal Toezicht aan de slag.

De vraag die in dit artikel aan de orde komt, is op welke wijze Horizontaal Toezicht succesvol kan worden ingevoerd. Horizontaal Toezicht is geen opzichzelfstaand project, en niet gericht op nog meer controles. Dit artikel besteedt aandacht aan de keten van waaruit Horizontaal Toezicht moet worden bezien, alsmede de hiermee gepaard gaande risico’s. Vanuit deze keten en risico’s wordt duidelijk gemaakt hoe je risico’s kunt beheersen, zonder ‘nog meer’ controles te implementeren om Horizontaal Toezicht in te voeren. Ten slotte kijken we vooruit en presenteren we drie principes die gehanteerd kunnen worden bij de implementatie van Horizontaal Toezicht.

Horizontaal Toezicht in de keten

Een belangrijke succesfactor voor het slagen van een dergelijk project is dat een ziekenhuis niet alleen verantwoordelijk is voor de succesvolle implementatie van Horizontaal Toezicht, maar dat de gehele keten waarin Horizontaal Toezicht plaatsvindt, hierbij moet worden betrokken. In elk deel van de keten kunnen processen die bijdragen aan Horizontaal Toezicht uitbesteed zijn. In dit artikel maken we inzichtelijk hoe deze keten eruitziet, welke processen er waar in de keten worden uitgevoerd, welke risico’s er zijn, maar vooral ook hoe je de bijkomende risico’s kunt beheersen.

Het uitbesteden van processen, en daarmee het creëren van een keten, heeft een directe impact op de inrichting van het risicomanagement van een organisatie. Voor het management of bestuur is een directe controle op de uitbestede processen niet mogelijk; er zal dus een andere vorm van beheersing moeten worden ingericht om zekerheid te krijgen over de betrouwbare werking van de uitbestede processen.

Kijkend naar de keten binnen Horizontaal Toezicht, dan begint het vaak bij de zorgverzekeraar. Deze partij voert doorgaans een groot aantal controles uit van de gefactureerde zorg. De ontwikkeling in het Nederlandse zorglandschap is dat deze controles van de geleverde en gefactureerde zorg door ziekenhuizen in toenemende mate worden uitgevoerd door de zorgaanbieder, waarna de zorgverzekeraar hierop moet vertrouwen. Hiermee is de zorgverzekeraar de eerste schakel in de keten.

Op het moment dat de zorgverzekeraars beter kunnen vertrouwen op de betrouwbaarheid van de registratie en facturatie van de zorginstelling, kan worden afgesproken dat de instelling verantwoording aflegt over deze betrouwbaarheid, door middel van een ‘serviceorganisatiecontrole’-rapport (hierna: assurance-rapport). Een dergelijk rapport is toegesneden op de risico’s van de zorgverzekeraar, en richt zich op de beheersingsmaatregelen die de instelling heeft ingericht.

Omdat zorginstellingen hun (IT-)processen steeds vaker hebben uitbesteed, wordt een deel van de door de zorginstellingen uitgevoerde controles daarmee ook uitbesteed. De zorginstelling heeft daardoor een aantal risico’s niet in eigen beheer. Vaak heeft men daar beperkte ‘servicelevel’-afspraken over gemaakt met de leveranciers. Als de risico’s, die zich buiten de muren van de zorginstelling bevinden, worden meegenomen in het totale risicomanagement van een zorginstelling, zien wij dat de volwassenheid en beheersing van de interne organisatie groeit. Hierdoor kunnen de doelen van Horizontaal Toezicht beter worden bereikt. Horizontaal Toezicht is daarom niet alleen de verantwoordelijkheid van de zorginstelling en zorgverzekeraar, maar van de hele keten. De schakels in de keten moeten, net als de zorginstellingen, verantwoording afleggen. Ook dit kan middels een assurance-rapport, waardoor er een keten van assurance ontstaat.

Horizontaal Toezicht Zorg

Zorgverzekeraars controleren in een hoge mate van detail de zorgdeclaraties van zorginstellingen. Veel van deze zorgdeclaraties worden ter correctie teruggestuurd naar de instellingen. Dit leidt tot veel correctiewerkzaamheden bij de zorginstellingen, en zorgt daarmee voor een hoge administratieve lastendruk. Op dit moment is er daardoor binnen de instellingen behoefte aan meer controle aan de voorkant, en moet er worden gewerkt aan het vertrouwen tussen de zorgverzekeraar en zorginstellingen.

Horizontaal Toezicht Zorg is opgezet om die relatie te verbeteren. Het concept, naar analogie van Horizontaal Toezicht bij de Belastingdienst, is voor het eerst geïntroduceerd in de zorgsector in 2016, primair in de medisch specialistische zorg (MSZ). In 2018 is Horizontaal Toezicht ook in de Geestelijke Gezondheidszorg (GGZ) gelanceerd. Het is een initiatief van drie partijen: de Nederlandse Vereniging van Ziekenhuizen (NVZ), Zorgverzekeraars Nederland (ZN) en de Nederlandse Federatie van Universitair Medische Centra (NFU).

Door Horizontaal Toezicht Zorg worden de zorginstellingen uitgedaagd om ‘first time right’ correct te registreren en declareren. Het beoogde voordeel is dat de zorgverzekeraar zo minder hoeft te controleren, en de zorginstellingen dus minder hoeven te corrigeren.

Risicomanagement in de keten

Een keten ontstaat wanneer een zorginstelling voor de registratie, facturatie van de geleverde zorg en de controle hiervan, diensten afneemt bij een serviceorganisatie (een leverancier van diensten). Een vergelijkbaar voorbeeld is de cateraar van het ziekenhuis die het bereiden van de warme maaltijden laat uitvoeren door een andere organisatie. De keten bestaat dan uit het ziekenhuis, dat formeel gezien het leveren van een warme maaltijd voor de patiënten heeft uitbesteed aan een cateraar, en de cateraar zelf, die op haar beurt het bereiden van de warme maaltijd ook weer heeft uitbesteed.

In het proces van het registreren en factureren van geleverde zorg werkt dit op dezelfde wijze. Zoals in de inleiding is geschetst, kan een zorginstelling gezien worden als een serviceorganisatie door de zorgverzekeraar, voor wat betreft het uitvoeren van de zorg, en de controles van correcte registratie en facturatie hiervan. De zorginstelling heeft vaak op haar beurt IT-processen uitbesteed aan leveranciers. Je kunt hierbij denken aan het hosten en onderhouden van het ZIS (Ziekenhuis Informatie Systeem) en het EPD (Elektronisch Patiënten Dossier), of de toepassing van tools om controles uit te voeren van onjuistheden in de registratie. Vervolgens kan het zo zijn dat de IT-leverancier de servers en dataopslag heeft uitbesteed aan een externe provider. De Horizontaal Toezichtketen ziet er dan uit zoals afgebeeld in Figuur 1.

Figuur 1. Horizontaal Toezichtketen. [Klik op de afbeelding voor een grotere afbeelding]

Waar processen worden uitbesteed, neemt de risicodeling toe. De zorginstelling blijft als organisatie echter eindverantwoordelijk. Het management of bestuur van de zorginstelling moet bepalen hoe de risico’s in de keten zich tot elkaar verhouden, en in welke mate deze risico’s worden beheerst. Naast het identificeren en inschatten van deze risico’s is een andere belangrijke stap het bepalen van de ‘risk appetite’. Dit is de afweging tussen de risico’s die de instelling wil afdekken en de (rest)risico’s waarvan de instelling bereid is om deze te accepteren. Hierbij dient de instelling rekening te houden met de uiteindelijke gebruiker/afnemer.

De risico’s die de instelling onderkent en wil (laten) afdekken, dienen te worden gecommuniceerd binnen de keten. De serviceorganisaties gaan dan aan de slag met maatregelen omtrent deze risico’s, en vervolgens communiceren zij in welke mate het betreffende risico is afgedekt binnen de keten. Risk appetite is daarbij niet alleen van belang voor de mate van diepgang van de interne beheersing, maar speelt ook een belangrijke rol in het evalueren van het restrisico, of het risico dat ontstaat wanneer de interne beheersing onvoldoende effectief is.

Concreet betekent dit, wanneer een risico en de bijbehorende risk appetite tussen ketenpartijen onvoldoende wordt afgestemd, dat:

de mate van beheersing door de uitbestedingspartijen niet aansluit op de verwachtingen van de gebruiker, waardoor risico’s niet of onvoldoende worden afgedekt (effectiviteit), of juist te diepgaand worden afgedekt (inefficiënt);
het restrisico, of het risico uit bevindingen van ineffectieve beheersing, onjuist wordt geëvalueerd. Hierdoor wordt het verwachte risico verderop in de keten groter, en daarmee bestaat de kans dat de beheersingsmaatregelen onvoldoende aansluiten bij het te verwachten risico.

In de keten zijn zogenaamde ‘hand-over’-momenten aanwezig. Hierbij zijn vooral de afspraken en afstemmingen van belang. Zo kan het zijn dat de ene partij denkt dat de ander het risico afdekt, en vice versa. Wie neemt waarvoor verantwoordelijkheid en wie dekt welk risico af? Het overzien van de risico’s en het controleraamwerk binnen de gehele keten is daarbij van belang. In service-level-agreements (SLA’s) kunnen hier concrete afspraken over worden gemaakt.

Begrippen

Serviceorganisatie: de organisatie die de diensten levert.
Gebruiker: de organisatie die de diensten afneemt, en daarmee de organisatie die gebaat is bij het assurance-rapport.
Assurance-provider: de externe auditor.
Assurance-rapport: het eindproduct van de assurance-provider, na het uitvoeren van een assurance-onderzoek; hierin staat het onafhankelijke oordeel van de assurance-provider beschreven, met betrekking tot de beheersingsmaatregelen en -doelstellingen van de serviceorganisatie.

Figuur 2. Risicobeheersing binnen de gehele Horizontaal Toezichtketen. [Klik op de afbeelding voor een grotere afbeelding]

Daarnaast kan het zijn dat bepaalde risico’s niet in hun geheel door een van de organisaties in de keten kan worden afgedekt, maar dat de serviceorganisatie beschrijft welke maatregelen de eindgebruikersorganisatie moet nemen om het risico af te dekken. Deze maatregelen worden de zogeheten ‘complementary user entity controls’ (CUEC’s) genoemd, en maken onderdeel uit van de assurance-rapportage. In het Nederlands zijn deze maatregelen beter bekend als de ‘aanvullende beheersingsmaatregelen’ voor de gebruikersorganisatie. Dit zijn beheersingsmaatregelen die de eindgebruiker moet inrichten om de beoogde beheersingsdoelstellingen, die in het assurance-rapport zijn opgenomen, te bereiken.

Het is belangrijk dat je als gebruiker gedegen kennis neemt van een assurance-rapportage, en daarbij let op de volgende aspecten: het type assurance-rapport, de mate van zekerheid, verslagperiode, scope van het rapport, de doelgroep, service-auditor, eventuele bevindingen over de beheersingsdoelstellingen, de opinie, eventuele afwijkingen omtrent de beheersingsmaatregelen, en eventuele CEUC’s.

In het voorbeeld van de cateraar en bereider van de warme maaltijden is de beheersingsdoelstelling van de bereider dat de maaltijden hygiënisch worden bereid, volgens de geldende hygiënenormen in de horeca. Op het moment dat de bereider de maaltijden overdraagt aan de cateraar (het ‘hand-over’-moment) kan deze echter niet meer verantwoordelijk zijn voor de hygiëne. De cateraar zal dan een ‘CUEC’ moeten inrichten, om zo te borgen dat de bereider alle maaltijden hygiënisch verwarmt en uitserveert. De patiënt in het ziekenhuis, die de maaltijd uiteindelijk opeet, vertrouwt er immers op dat de maaltijd bijdraagt aan het proces van aansterken en herstel. Ook hier geldt dat honderd procent zekerheid niet te garanderen is, maar de patiënt heeft wel een redelijke mate van zekerheid dat de warme maaltijd voldoet aan de hygiëne-eisen. In [Beek17] is aangegeven op welke wijze de gebruikersorganisatie invulling kan geven aan het interpreteren en opvolgen van de CEUC’s uit een assurance-rapport.

Met assurance-rapporten kunnen partijen in de keten elkaar inzicht geven in de mate waarin ze de interne beheersing van de overeengekomen risico’s hebben ingericht en uitgevoerd. Door onafhankelijke assurance wordt vertrouwen gecreëerd op basis van ‘aantoonbaarheid’. Een assurance-rapport over de interne beheersing, getoetst door een onafhankelijke auditor of accountant, levert een onafhankelijke evaluatie op over de mate waarin de beheersingsmaatregelen worden uitgevoerd, en de beheersingsdoelstellingen (omgekeerd geformuleerde risico’s) die daarmee worden behaald.

Interne beheersing en de externe toetsing daarvan kunnen geen volledige zekerheid geven. Zowel bij de uitvoering van de interne beheersing als het toetsen ervan worden toleranties gehanteerd, en er wordt gewerkt met deelwaarnemingen als afweging van de betrouwbaarheid en kosten die samenhangen met het inrichten van de interne beheersing en externe controle hiervan. Een assurance-rapport van een onafhankelijke auditor levert daarom een redelijke mate van zekerheid op. Voor het vertrouwen tussen de zorgverzekeraar en zorginstelling (en haar uitbestedingspartijen) is daarom meer nodig.

Vertrouwen heeft de overhand

Om als zorginstelling ‘in control’ te zijn en de risico’s in de keten te beheersen, is het noodzakelijk om ‘harde’ beheersingsmaatregelen te nemen en hierover verantwoording af te leggen via assurance-rapportages. Uiteindelijk zorgen meer regels en richtlijnen echter voor een kleiner verantwoordelijkheidsgevoel bij individuen. Dit resulteert in een minder effectieve beheersing, door middel van de ‘harde controles’ ([KPMG09]).

Echt effectief worden deze ‘harde’ maatregelen pas in een omgeving waar ook aandacht is voor ‘zachte’ elementen, zoals de onderlinge relaties, afspraken, vertrouwen en het credo ‘fouten maken mag’. Daarom is er steeds meer aandacht voor zachte beheersingsmaatregelen (‘soft controls’). Deze zachte kant kan ondersteund worden door het toepassen van de negen ‘Trust Rules’ ([KPMG09]).

In Figuur 3 zijn deze ‘regels’ gevisualiseerd. Een succesvolle implementatie van Horizontaal Toezicht binnen een zorginstelling bestaat dus niet alleen uit het implementeren van ‘harde’ beheersingsmaatregelen. Expliciete aandacht voor de ‘zachte’ kant is onontbeerlijk.

Figuur 3. De negen Trust Rules ([KPMG09]). [Klik op de afbeelding voor een grotere afbeelding]

Ziekenhuizen vinden aandacht voor relaties, afspraken en onderling vertrouwen ook belangrijk, en laten bijvoorbeeld steeds vaker een zogenaamde ‘soft control-scan’ uitvoeren. Hierdoor wordt inzicht verkregen over de ‘zachte’ kant van de risicobeheersing. Het is van belang dat hierbij niet alleen de administratieve afdeling van een ziekenhuis wordt betrokken, maar juist ook de medisch specialisten, verzekeraar en softwareleverancier.

Voor het implementeren van de negen ‘Trust Rules’ adviseren wij de zorginstellingen om met de ketenpartijen in gesprek te gaan, en gezamenlijk concrete soft controls te definiëren. Openlijk communiceren over de soft controls leidt tot begrip en bewustzijn bij elke ketenpartij, en daarmee tot een grotere kans dat de Trust Rules in de gehele keten worden nageleefd.

Concrete voorbeelden die bij de implementatie van Horizontaal Toezicht naar voren komen, zijn:

Er is ruimte om fouten te maken, en deze worden met de zorgverzekeraar besproken (trust rule: durf te experimenteren en leer van ervaringen).
Het maken van afspraken met de EPD-leveranciers over de beheersingsdoelstellingen, en deze concreet maken in een Service Level Agreement (trust rule: definieer gezamenlijke doelstellingen en bouw vertrouwen op met goede regels).
In Service Level Rapportages wordt informatie opgenomen over de afgenomen diensten en kwaliteit van de uitvoering (trust rule: zet in op geïnformeerd vertrouwen, niet op blind vertrouwen). Dit is een gezamenlijk initiatief van de zorginstelling en softwareleverancier.
De zorgverzekeraar en zorginstelling komen periodiek bij elkaar (trust rule: maak contact persoonlijk), zodat de geconstateerde fouten en tekortkomingen worden besproken (trust rule: geef elkaar verantwoordelijkheid en vertrouwen), met als doel transparantie en verbetering.

Toekomst voor assurance in de keten van Horizontaal Toezicht?

Samenvattend is een keten van partijen gezamenlijk verantwoordelijk voor het realiseren van een betrouwbare registratie en facturatie (rechtmatigheid). De zorginstellingen staan aan het begin van een tijdperk, waarbij het aan de ene kant ‘normaal’ is dat alleen rechtmatige zorg wordt gefactureerd, en dit aan de andere kant een gemeenschappelijke verantwoordelijkheid is van alle ketenpartijen. De keten in beeld brengen, risico’s onderkennen en goede afspraken maken over wie deze risico’s afdekt, maken daar onderdeel van uit. In combinatie met de zogenaamde ‘trust rules’ leidt dit tot het vertrouwen dat die rechtmatigheid van de zorg ook wordt gerealiseerd, zonder dat dit leidt tot een wedloop aan risico’s, maatregelen en controles.

Het succesvol invoeren van Horizontaal Toezicht binnen een zorginstelling is wat ons betreft geen opzichzelfstaand project met als doel om meer harde controles in te voeren. Horizontaal Toezicht is een manier om een organisatie te besturen, en gestoeld op drie belangrijke principes:

de wil van de organisatie om de administratieve processen te verbeteren;
het besef dat dit alleen kan door binnen de keten samen te werken met de zorginstelling, zorgverzekeraar en bijvoorbeeld softwareleverancier;
een goede balans tussen de harde en zachte kant van controlemaatregelen, gebaseerd op de ‘Trust Rules’.

In de ideale situatie waarin Horizontaal Toezicht optimaal is gerealiseerd, worden hierdoor de administratieve lasten en controledruk, waar zorginstellingen nu mee te maken hebben, ook echt verlicht.

Het is zinvol om vanuit deze drie principes Horizontaal Toezicht op te zetten en te borgen, waarbij alle partijen in de keten verantwoordelijkheid nemen, waardoor duidelijk wordt wie waarvoor verantwoordelijk is en het totale vertrouwen in de gehele keten toeneemt. We vinden het belangrijk om juist bij de start van het implementatieproces van Horizontaal Toezicht te kiezen voor een balans van harde en zachte maatregelen, in het kader van de rechtmatigheid. Inmiddels wordt er nagedacht over fase 2 en 3 van Horizontaal Toezicht, namelijk het ‘gepast gebruik’ en de ‘doelmatigheid’ van zorg. Op het moment dat er voor fase 1 een fundament ligt van vertrouwen, zal Horizontaal Toezicht uiteindelijk ook bijdragen aan de uitbreiding naar ‘gepast gebruik’ en ‘doelmatigheid’.

Literatuur

[Beek17] Drs. J.J. van Beek RE RA en ir. R.P.A.C. van Vught, User control considerations voor ISAE3402-assurancerapportages. Ruimte en noodzaak voor verbetering, Compact 2017/3, https://www.compact.nl/articles/user-control-considerations-voor-isae3402-assurancerapportages/.

[KPMG09] KPMG, Trust Rules. Nine principles for a better balance between rules and trust, KPMG Audit Tax Advisory, http://www.ethicsmanagement.info/content/Whitepaper%20Trust%20Rules%20ENG.pdf, 2009.

[Uter17] Ing. D.R. Utermark RE and E. Tsjapanova MSc, Horizontal Monitoring. The future of medical invoicing, we are getting there, Compact 2017/3, https://www.compact.nl/articles/horizontal-monitoring/.

Dynamic Risk Assessment

The traditional risk assessment models, which assess risks based on their individual impact or likelihood have been widely applied by many organizations. The existing models, however, fail to recognize the interconnections among the risks which may reveal enhanced assessment dimensions and more pertinent risk mitigating actions. In response to this, the Dynamic Risk Assessment (DRA) has been developed based on proven scientific modeling, expert elicitation, and advanced data analytics. DRA enables organizations to gain a deeper understanding into how risks impact the different parts of the firm and, subsequently, to design more effective and efficient risk mitigating measures.

Introduction

One of the main things learned in risk management since the new millennium is the previously unobserved levels of correlation. We have since learnt that volatility itself is volatile, an attribute for which most financial mathematical models make insufficient allowance. It re-introduced the question of whether structural breaks in the system exist and how to allow for their presence in modeling, impairment assessments and other financial valuation techniques.

The above developments pose ominous warnings for risk and financial managers alike as they infer that risk assessments and asset valuations can drift to levels that, in certain cases, grossly underestimate risks and can cause valuations to gyrate violently.

Unless business, academic institutions and regulators get better at managing these cycles and corrections, businesses will be subjected to ever increasing public scrutiny, more intrusive regulation and regulators, new-found antagonistic behavior from the public, reduced market capitalization and greater friction costs in doing business.

Whilst this plays to a populist agenda, it does little to improve economic growth, which we have now seen constitutes the tide that most lifts most personal wealth boats. Risk management has a crucial role to fulfill: not only within the business, but also for its immediate and wider stakeholders.

The Dynamic Risk Assessment Approach

In response KPMG has developed an innovative approach referred to as ‘Dynamic Risk Assessment’ (DRA). DRA is based on the science of expert elicitation, invented by the US military in the 1950s. At the time it faced the challenge of remaining ahead of Soviet military developments that were taking place behind an impenetrable iron curtain. The military, similar to risk managers today, faced a future that could not be credibly modeled by traditional means. They quickly learned that expert elicitation is a helpful alternative, to the point where it aided the US military not only to match covert Soviet developments, but to stay abreast throughout the Cold War and thereafter.

More specifically, the US military discovered that, by (1) identifying experts scientifically and (2) conducting scientifically structured individual and group interviews, a credible future threat/risk landscape could be generated. DRA capitalizes on these insights and extends them into a third and fourth dimension: the experts are requested to provide their individual perspectives on how the risks can be expected to trigger or exacerbate each other, and the velocity with which they can affect the organization. With these risk perspectives an organization-specific risk network can be constructed to obtain key insights into the organization’s systemic risk landscape.

These insights are presented back to the experts to obtain their views on the consequences and the opportunities available to the organization, whereupon it is circulated to Those Charged With Governance to enrich their risk mitigation decision-making.

Figure 1. The four steps of Dynamic Risk Assessment. [Click on the image for a larger image]

Dynamic Risk Assessment explained

Clustering of risks

Traditional risk models assess the prioritization of risks on individual impact or likelihood. Although these assessments are useful, the traditional model (Figure 2) fails to recognize the interconnections between risks (Figure 3) or the effect of clustering risks. As illustrated in Figure 4, a seemingly low ‘risk of failure to attract talent’ could potentially form part of a high severity risk cluster, that of operational risks.

Figure 2. Traditional depiction of risks (illustrative). [Click on the image for a larger image]

Figure 3. Individual risks in a risk neural network, with clusters (illustrative). [Click on the image for a larger image]

Figure 4. Aggregated likelihood and severity of a cluster of risks (illustrative). [Click on the image for a larger image]

Risk Influences

DRA also calculates influences between risks, i.e. to what extent will the occurrence of one risk trigger the occurrence of other risks, and vice versa. In this manner the three most influential risks can be identified (Figure 5). These are the risks that, when they occur, will trigger most of the other risks – across the network.

Figure 5. The systemically most influential risks in the network (illustrative). [Click on the image for a larger image]

Similarly, the three most vulnerable risks can be identified (Figure 6). These risks are the risks most likely to occur following the occurrence of any other risks in the network.

Figure 6. The systemically most vulnerable risks in the network (illustrative). [Click on the image for a larger image]

Knowing the contagion forces between risks is important in a) selecting the key risks to focus on, and b) selecting the appropriate controls (in type and strength) to mitigate them. For example, since the most influential risks can trigger other risks, mitigation of the organization’s systemic risks should commence with these risks. For the most vulnerable risks, preventive controls should be preferred over detective controls.

Figure 7 depicts a consolidated view of individual risks, risk clusters, most influential and most vulnerable risks. Based on this view, we can design risk mitigating activities and assign related governance responsibilities.

Figure 7. Putting it together (illustrative). [Click on the image for a larger image]

Risk mitigation

Risk mitigation is aimed at addressing how a particular risk should be optimally responded to. Within DRA, mitigation is accomplished through the application of bow ties. The first step for risk mitigation therefore begins with determining the clusters and calculating their aggregate severities (Figure 4). This process is followed by the identification of the most influential and most vulnerable risks, and thereafter the black swans – risks that display weak links to other risks yet, in aggregate, have catastrophic outcomes. DRA’s mitigation phase identifies the most vulnerable risks as well as risks that could form part of a black swan chain, and assigns these to the CRO as these risks have the gravest systemic consequences.

In identifying the most influential risks, responsibility for monitoring is allocated to the CEO since these risks have the widest systemic reach. The CEO can then be challenged to invert them into competitive advantages. Risks that are individually insignificant and not connected to any significant outcomes are delegated to subordinates.

Data security, for instance, is classified in Figure 7 as a risk that carries a high severity individually, and forms an Operational Risk Cluster with significant aggregate outcomes together with profitability, conduct risk, and failure to attract talent. The risk mitigating measures for data security can subsequently be designed as shown in Figure 8. The diagram shows various related (external and internal) threats, key controls (preventive, detective, and recovery, with their current status of effectiveness) and the risk consequences. For each key control responsibilities can be allocated across the three lines of defense – ownership lies with the first line, supervisory roles with the second line, and evaluations on the third line. The frequency of reporting back to Those Charged With Governance is determined based on the criticality of control and significance of risk.

Figure 8. Data security bow tie (illustrative). [Click on the image for a larger image]