Risk Management Databases

• Consolidate and manage company risk and control information.
• Allow for improved company risk-management reporting.
• Track control-remediation efforts.
• Alert company employees to risk-management actions.
• Ensure legal and regulatory compliance.
• Capture employee risk and control assessments.

The database consolidates spreadsheets, word processing documents, flowcharts and emails into one cohesive database. Once stored, the information is better organized, making it easier to generate reports and search risk managmenet data. “Risk management databases provide information that can be instantly accessed to verify a company’s internal controls. And you can trend the risk management efforts across different departments or time periods,” says Stephen Hyams of software vendor, Kilclare. 

Database Functionality 

• Risks, Control, Testing and Remediation Documentation — Documents risks, risk-related losses, controls, recommendations and risk-mitigation action plans.
• Risk Management Alerts — Notifies interested stakeholders in the risk management process, depending on new environmental conditions within a business. For example, email alerts may be sent to a department manager if a control issue has been identified but not yet resolved.
• Issue Management Workflow — Manages action-plan development and completion for control issues raised in a process review. 
• Control Self Assessment — Helps a company assess its current controls, through online survey tools, to mitigate organizational risks and help receive approval of company policies.

Controls Testing Software

• Automates control-activity testing.
• Identifies errors, fraud and cash recoveries in company information.
• Automates manual audit procedures.
• Focuses risk-management efforts on suspicious transactions.
• Analyzes financial statement data more efficiently while identifying new data trends.

Rather than first manually testing controls, CPAs should consider what may go wrong with the process under review, and then develop a report to identify related issues. For one firm, client interviews pointed to issues with the reconciliation of vendor wire transfers, and the staff believed vendors owed money but couldn’t be certain without a full reconciliation. With this knowledge, a CPA can obtain an accounts payable trial balance for all open invoices and debits (vendor receivables). CPAs can then review the positive and negative amounts to determine the age of open vendor payables and receivables. Thus, the CPA is better able to gauge the testing and risk level in this area. Therefore, by using data analysis to understand the underlying system information, auditors can identify specific controls more easily and better assess what is really happening versus what was told to them.

Controls testing software analyzes the databases that support a company’s accounting system. Data is first imported using utilities designed to pull data directly from the database into data analysis software. One example is XBRL (eXtensible Business Reporting Language) which has helped many CPAs analyze financial statement information more effectively. Since most accounting systems are already XBRL compliant, importing their financial statement information becomes a one-click process.

Data-Analysis Test Summary

• Query Tools — Enables users to ask questions of their data.
• Financial Statement Analysis — Processes ratio, horizontal and vertical trend analysis on financial statement data.
• Data Mining Products — Looks for trends or anomalies without any preconceived data knowledge.
• Dashboard Reporting — Provides users with a customized data summary.
• Automated Routines — Processes predefined scripts of query and data-mining reports.
• Excel Validation Testing Tools — Analyzes Excel spreadsheets for formula and calculation errors and changes to spreadsheets, and provides an improved filter for viewing spreadsheet data flows.