In this one-on-one Steve Biskie of High Water Advisors sits down with Bruce Carpenter, VP of SAP Corporate Audit, to discuss the latest in audit technology.
Topics covered in the discussion include:
- The capabilities of SAP's new audit management application
- How collaboration tools can benefit audit processes
- A short demo of the latest features in SAP Audit Management on an iPad
- How SAP has delivered on the audit management value proposition
Steve: Hi, this is Steve Biskie with High Water Advisors, and I’m here with Bruce Carpenter, vice president of audit at SAP. Bruce and I had a chance to meet yesterday and spend some time together after the sessions and Bruce, it was interesting to me, I don’t find too many people that have been auditors longer than I have, so, 22 years on my side, a few more on your side. And I wanted to just have a conversation with you around some of the changes that we’re seeing in the audit profession these days. Maybe before we get into that, though, if you could step back and talk a little bit about your history within audit, and then some of the challenges you dealt with when running an audit team?
Bruce: Sure Steve, good to talk to you. So I started off my career with KPMG as an external auditor, shortly after that I got the opportunity to move to high-tech at Sybase, where I was chief audit executor for around 10 years. During that time it was really interesting because we had the flow from Sarbanes-Oxley through to enterprise risk management, and then later on the pressure for regulatory compliance and I became compliance officer as well.
So, in 2010, Sybase was acquired by SAP, and in 2012 I moved to the SAP corporate audit department.
Steve: Great, great. You know, in that time, I think back in the early days of audit, a few things have changed, but not a lot. I mean, we don’t use the colored pencils as much anymore that we had—
Bruce: No more red pen!
Steve: —we don’t have the 12-column green bar paper, we carry around laptops and computers but there are still a lot of things that haven’t been transformed by technology. When you were running your internal audit department, can you just talk a little bit about where you use technology and how that was used in your prior life?
Bruce: Sure. Yeah, so at Sybase the audit department was relatively small, about five permanent staff, and we had some rotating people from the finance organization who came in to help us with our Sarbanes-Oxley testing. But I think the interesting thing there was at that point I regarded our audit shop as being too small to really warrant any form of formalized audit management technology, and maybe at that point the technology wasn’t quite mature enough, and so what would have been great at that point would have been something more lightweight, in terms of the mobile capability to capture and retain audit evidence.
Steve: Sure, sure. And that’s something, I mean, it’s a little bit different in audit, what some people may not understand is while we’ve got a department of people all working together, it’s very common that there’s travel involved and we’re not all in the same spot. So you had team members that were all over performing these audits.
Bruce: Yes, I had team members located globally, in Europe and in Asia, performing audits. Sybase involves a lot of sales through channel partners and we’re always keen to be able to demonstrate the transparency of that work, so that was a really important component of the work that we did while we were at Sybase. So, lots of travel, lots of the need for people to be working in different time zones, and also the need to capture documents from third parties and retain those as appropriate audit evidence.
Steve: Sure, sure. So at this conference, you know, SAP announced the launch of the audit management application, which I’m pretty excited about. It’s the first release of software that SAP’s done that’s purely for someone like me, as an auditor, within here. And I’ve heard a lot of things from other people involved, but Bruce, since you’ve been an auditor, I’m really interested in your professional opinion—you’ve been the person on the ground, you’ve been the person who’s managed audit teams. What are the things, when you look at audit management today, are most exciting to you?
Bruce: So I think from my perspective, the most exciting thing about this tool is the ability to manage the audit process through the use of a mobile device. I mean, you know, I really like the idea of being able to take out my iPad to an audit to be shown a document, to be able to lift up the iPad, capture the document as a photo, and then file it immediately. And I think one of the things that’s been challenging for auditors is the use of audit management tools which may not offer this easy remote capability to instantly capture and instantly handle and upload documents.
Steve: Absolutely. That’s something I relate to, I travel extensively, I’m on airplanes almost every week and it can be frustrating sometimes having to haul around the things we’ve traditionally had to bring with us. But there’s something also interesting related to that document capture, and you were mentioning it. Initially when I heard this technology, I just thought we were storing electronic documents, but you were talking about the search capability on those electronic documents and the ability to find a word on the photograph you took. Tell us a little more about that.
Bruce: So, I think one of the very interesting things about this application is it is built on SAP HANA, and SAP HANA has a wide and diverse search capability, and that means both structured and unstructured data. So, imagine the benefits of being able to type in a single word, maybe the name of somebody who you’re interviewing in an investigation situation, and find out whether that name has ever appeared in the past, anywhere in the audit history that you’ve got. That’s the capability that’s being offered here. And I think, as you know Steve, you know, regrettably we don’t always retain staff, people move on for very good reasons as well, and as new people come on board the ability to search and look for this data is going to become increasingly important, and it’s going to add tremendous power to the quality of the work that we do for our stakeholders.
Steve: Absolutely, I mean that example alone kind of hits home for me, because a lot of the audit teams I’ve worked with are somewhat compartmentalized just by design, so you have the IT audit technology team, you’ve got the financial and operational audit, sometimes you might have an investigative team, but that ability to search on something that any of those team members had created, and possibly way back well before I even joined audit and had knowledge of that person or that type of activity, that’s pretty powerful.
Bruce: Yeah, and I think also if you consider the view of our stakeholders, I think it’s fair to say that if you spoke to some of our stakeholders and they were considering their external audit teams, one of the frustrating things that they find is when staff turns over and they have to re-explain a process, and I think the ability to do the search and to be able to locate easily, locate the relevant history is going to be something that’s going to improve our stakeholder relationships.
Steve: Absolutely. You know, I think back to an analogy in my own personal life, I’ve always been a very avid reader, and I always like to have the physical book with me, and I didn’t move into the e-reader piece early enough, but now I’ve been using an e-reader for three years, I can’t imagine not having every book in my library with me at every point in time because of that. Something comes up, I can search on that text, I can find it, it sounds very similar because a traditional paper-based audit, you can have binders of material that are pretty thick, but now we’re able to carry the entire audit history since we’ve moved onto this technology with us at any point in time, that’s pretty powerful.
Bruce: I think so, and I think also, in terms of audit efficiency the ability to handle documents only once is something that’s going to be a key thing in helping both improve auditor engagement—
Bruce: —and also improve the quality and the effectiveness of the work that we do.
Steve: Sure. Now tell me a little bit more about the collaboration side, because I know having led an audit department, you’re in that unique situation to be able to see the work across your entire team, but also disadvantage because your team could be anywhere in the world and you have to sleep at some point in time, so talk a little bit about how this technology can assist with that collaboration side.
Bruce: So I think from the collaboration perspective there are two things that are worthy to discuss. The first is that as part of this technology we have a tool called SAP Jam, which is SAP’s collaboration tool. And I know that, say for example as an audit manager, at various times I’ll have a thought about an audit, or a question, and I’m inclined to send off an email to one of the audit team to say you know, I’ve been thinking about this and I want you to investigate this particular aspect of an audit. Now with the collaboration tool, that note can be put immediately into the audit record. This does two things: it improves the quality of the work that we’re doing from a professional practice perspective, because people can review those notes and understand the thought process that was going into the audits, but also it keeps all of the information together so that at any point, we’re less likely to lose the trail of the audit process, and I think this is another really big advantage of the technology.
Steve: I know even in some of my early audits, where we were starting to use technology and automate and put things electronically, storing in the traditional file system on a network drive somewhere, we still lost a lot of things, so it sounds like that ability to tie things together is going to be a great way to improve.
Bruce: Yeah, and then I think the second thing is if I’m traveling, or if I’m in a different time zone, I can use my mobile device to review and approve documents, for example, a work program for an audit. And the benefit of this is that it’s going to make it much more efficient and easy to comply with the standards of professional practice. Say for example it’s critical for me—and time sensitive—for me to review and approve our work program and I’m in the middle of a long-haul flight. You know, during a layover, I can pull out my mobile device, I can open it up, I can review the work program, I can approve it, and I’m able to get on the next flight knowing that my team, in whatever location they are, can proceed with the work.
Steve: Wow, so basically allowing you to work 24 hours a day, that’s fantastic Bruce!
Bruce: Yeah, my company couldn’t be more pleased!
Steve: Let me ask another question because again, given your background and how long you’ve been in our profession, I know you’ve seen the same types of changes I’ve seen, and one of the big trends right now is for audit to provide more value, to be a better resource for the organization, to be able to provide more insight into what’s going on as to the hindsight. When you look back across the work that you’ve done in the past, and now you look at the technology that SAP’s delivering in the form of audit management, what are the one or two things that you see as the most exciting to you, to help deliver on that value proposition and raise audit’s overall value to the organization?
Bruce: So I think in this regard, the thing that really strikes a chord with me is that this technology is really going to help internal audit demonstrate the benefits of the use of technology to our stakeholders. One of the things that I worry about sometimes is that auditors are really good with technology, we do a lot of analytics, a lot of behind-the-scenes work. I’m not necessarily certain that our stakeholders, that the benefits of that work are immediately visible to our stakeholders. I think this is an example of an application of technology where its use will be extremely visible, it will help promote the image and the effectiveness of the audit function, because people from all areas of the organization will be able to see how effectively this technology can be used to support the work of audit.
Steve: Yeah, that seems pretty powerful to me, I remember an audit committee meeting at one point that I was in and the audit chair asked a question about something we weren’t ready to talk about during that meeting because we didn’t think it was going down that direction, and yet real-time, on my device, to be able to pull up that history that’s now in a centralized collaborative environment, we’d be able to answer that question, probably answer it even more fully than what was being asked at that point in time, so it sounds pretty exciting.
Bruce: Yeah, and I think the other thing too is very often if we’re engaged in conversation as we are now, if I had my laptop between us, this is kind of like a barrier to the communication and having a mobile device is certainly no barrier, in fact, generally the ability to share and show is something that’s going to enhance the quality of the communication that occurs during the process.
Steve: Bruce, all this sounds really interesting, and I know you had the chance to show me a few things yesterday, but our audience hasn’t had a chance to see audit management yet, could you show some of the things that excite you most about the application?
Bruce: Sure! Steve, this is the opening screen of the application, and you can see here it’s really easy that it’s all tile based on SAP’s Fiori, and it’s a really nice way to start looking and to be able to see at a shot and you can drill down through any of these tiles to understand the details.
Steve: That’s great.
Bruce: So Steve, another thing, if I’m traveling I can receive a work program from one of my team, I can review it on the fly, and then I get the opportunity to approve the work program, so I click and approve, and at that point the work can continue.
Steve: Well, I’m excited to see where this technology is going Bruce, I appreciate your time to talk with us about audit management and SAP, thank you very much!
Bruce: Ok great, I appreciate the opportunity!