“ACL technology has enabled us to reduce our internal audit costs and significantly increase the level of assurance we’re providing throughout the organization.”
Tobias Thibaut, Audit Manager & Davide Gava, Audit Lead Senior, Barcelona, Spain, Sara Lee International
Sara Lee International runs its business processes on a central SAP R/3 environment, but management and business process owners are decentralised. That means the 40-member internal audit team can physically visit only a portion of the 151 business entities in 25 countries – creating a low audit cost to assurance ratio. To overcome this challenge, the team created a comprehensive pilot project that automates multiple audit functions with ACL analytics. The project has already provided significant savings in the first year and considerably increased assurance over the control environment. The ACL analytics cover full data populations and test SAP configurations, master data and transactional data. The team has cut travel expenses, saved hours of manual effort, and provides management with valuable reports that support stronger business and financial processes across the organisation.
Sara Lee, is a global manufacturer of brand name products for consumers worldwide. In 2009, the company ranked 199 on the Fortune 500 with brands including Sara Lee, Ambi Pur, Ball Park, Douwe Egberts, Hillshire Farm, Jimmy Dean, Kiwi, Sanex, and Senseo. Sara Lee products are used in more than 190 countries, with production and sales operating units on all continents. The company has 41,000 employees and annual revenues of £7.9 billion.
Sara Lee International runs its business processes on a central SAP R/3 environment, which includes 151 companies in 25 countries. All operational, financial and transactional data is centrally stored, but management and business process owners are spread around the globe. In order to follow standard audit procedures, the Internal Audit (IA) team must travel to each local entity to ensure the control environment is effective and efficient.
Given the large number of international business entities, only a portion of the companies can be included in the annual audit plan. Some entities are visited only every 3-5 years based on a comprehensive quantitative risk model. Traditionally, controls testing has included time consuming manual sampling with limited analytical procedures.
Sara Lee first implemented ACL audit analytics several years ago and recently completed a 12-month pilot project called “Take the shortCAAT.” The project was intended to:
Each ACL test was planned in the roadmap and tracked through a customised user interface, then linked to a risk control framework that oversees the organisation’s main business processes and audit risks. In order to prioritise the development process, the ACL tests were also classified by automatisation, significance / added value, complexity, and extendibility, and were assigned a place in the roadmap. Development times varied from 16 to 80 hours per test, with a faster pace as the team became more familiar with the SAP system, underlying data structures and the modular approach of predefined scripts.
The tests are now available to all IA team members and can be performed without any prior ACL knowledge. The tests can also be run remotely on a shared drive or on an individual auditor’s PC, which is often the only feasible solution in countries with limited connectivity.
The Sara Lee IA pilot project applied defined metrics to quantify the test results. The team measured the benefits of using ACL audit analytics instead of standard manual audit procedures, according to the audit time reduction (manual vs. automated audit tests), work program enhancement, test usage times (forecasted vs. actual), and number and relevance of issues found using the analytics.
The ACL applications quickly reduced IA costs and increased the level of assurance over the control environment. Using ACL to test the SAP configuration settings, master data, transactional data and the SAP security environment also saves time, money, and provides assurance from full data populations, instead of samples from one or several entities. The team has cut travel expenses and the ACL tests can be run for all SAP entities at one time.
The tests are applied on a monthly basis and have led local and corporate management to request reports on an ongoing basis – improving business processes and accounting functions. The results have also created effective discussions among entities beyond the scope of these tests. Overall, the project has led to SAP configuration enhancements and significant cost savings.