BWISE INTERNAL AUDIT

INTERNAL AUDIT IN CONTROL WITH STATE-OF-THE-ART GOVERNANCE,

RISK MANAGEMENT, AND COMPLIANCE SOFTWARE

WWW.BWISE.COM 1
 1Support
Over the last decade Internal Audit has undergone enormous change.
Changes have come as a result of new professional standards, technological
innovation, and new compliance and regulatory requirements. Navigating
these changes presents challenges but also spurs innovation. for the
Independent research firm Forrester cited BWise as a “Leader in GRC Platforms” in End-to-End Audit Process
their report, “The Forrester Wave™: Governance, Risk And Compliance Platforms, BWise® Internal Audit is a software solution that sup- ate using one common risk taxonomy and risk language
ports the end-to-end audit process and is part of the helps businesses to focus and enables Internal Audit
Q1 2014.” BWise integrated Governance, Risk management, and to speak the same language as its counterparts across
Compliance (GRC) platform. The inherent independence business units. BWise Internal Audit is available in two
of Internal Audit often mistakenly leads to creating silos. packages:
“BWise’s strategy is very strong in support of all GRC roles and continues to earn Internal Audit needlessly uses a separate risk language
compared to other departments. On a technology level, • BWise® Internal Audit Professional
exceptional customer satisfaction scores,” stated the report. independent is often interpreted as separate. BWise • BWise® Internal Audit Advanced
believes internal audit and businesses work best when
operating in a single integrated system to efficiently This brochure describes the BWise Internal Audit capa-
streamline the structure of their responsibilities. The bilities based on a day in the life of Ann Green, the Inter-
BWise® GRC Platform supports this methodology nal Auditor. The differences between the two packages
through a single integrated system. The ability to oper- are described in Sections Two and Three.

Gartner positioned BWise in the Leaders Quadrant of the Gartner Magic Quadrant
Maintain Audit
for Enterprise Governance, Risk and Compliance Platforms. Universe

“The GRC market is nine years old, and buyers have high expectations for the Yearly Audit
Follow-up finding &
performance of GRC solutions against a wide variety of use cases. Differentiation Recommendations Plan
today is about the ability to deliver against multiple use cases, and provide
advanced risk management functionality, with analysis of the impact of risks on
Audit Detailed Audit
DATABASES
strategic objectives and business performance, domain expertise in multiple Reporting Planning
highly regulated industries, ease of use — including mobile capabilities — and
configurability.”
Workpaper Audit
Management Preparation

Audit
Analytics
The Audit Cycle

Streamline the end-to-end audit process

The end-to-end audit process BWise supports is based on an annual so the business units to follow-up adequately. During the audit execu-
Gartner Research “Magic Quadrant for Enterprise Governance, Risk and Compliance Platforms” by French Caldwell risk assessment of the business; the audit universe is determined, and tion, advanced audit analytics can be used to collect and analyze data.
and John A. Wheeler, September 24, 2013. the annual audit plan is created and aligned with the audit committee. In addition, extensive authorization templates ensure the secure treat-
Then, based on the available audit frameworks, individual audits are ment of sensitive data. Audit files can be classified, and depending on
set-up and scheduled. The audit execution consists of several steps their workflow state certain access rights can be automatically granted
that include desktop research, fieldwork and finally reporting. Findings or denied. This ensures compliance with the strictest of regulations like
are shared with the business units and recommendations are provided the Bank Secrecy Act.
2 3
2 AGreen,
Day in the Life of Ann
Internal Auditor
BWise Internal Audit (BWise IA) offers the internal
audit department where Ann Green works compre-
hensive support of the end-to-end audit process.
This process makes use of BWise capabilities
such as documenting multiple dimensions of
Audit Dashboard
the organization, its business lines and risks for
documentation of the Audit universe, and risk and 2.2. Planning and Scheduling 2.6. BWise Internal Audit Professional
control frameworks at an enterprise level and in Ann can plan her work using web-based planning and All the described functions are available in the BWise
detail, at operational and transactional levels. A fully scheduling for both planning at a group level and for Internal Audit Professional package. BWise Internal Audit
detailed scheduling of various audit tasks for individual Professional ensures audit teams can conduct their
integrated document management system guaran- audits. Ann can also use the integrated time registration end-to-end audit process; everything can be managed
tees Ann and her managers secure data encrypted to log hours spent per project and to have her manager with one integrated solution, from the initial enterprise
storage. It also provides for easy file administra- approve those hours. This further enables budgeting, risk assessment, planning, scheduling and audit and
cost allocation, and tracking progress and status. auditor time-keeping, audit set-up, audit execution, to
tion related to documentation and individual audits. reporting and tracking findings.
BWise document management includes check-in/ 2.3. Audit vault: Online and Offline Work Papers
check-out capabilities, authorization, version man- BWise Internal Audit includes extensive and configurable 2.7. Key Benefits of BWise Internal Audit Professional
audit templates to automatically generate audit work include:
agement, approval workflows, retention policies, papers. When Ann has conducted an audit, she has the • Secure access to all audit information, anytime,
and more. ability to document her audit activities in predefined work anywhere; online and offline
papers directly in BWise. If Ann wants to, she can take • Protection of sensitive data against unauthorized
all or parts of the audit offline, and enter her information, access
her findings and electronic evidence, to the offline audit • Streamlined alignment with the audit committee on
in a secure manner – like a secure vault. Then she can the audit universe and the overall audit plan
upload the information back into BWise, as if the work • Transparency in audit planning, such as global
“Sending and tracking was conducted online, with similar audit trails. holidays or resource and skill availability
findings with BWise directly • Transparency in budgeting and cost allocation
from the audit to other 2.1. Yearly Assessment 2.4. Findings and Follow-up • Simplified time registration, skill alignment and
With BWise IA, Ann can automatically create multi-year If Ann discovers findings during the audits, she may reduced reporting efforts
business units is a great time- audit plans based on audit ratings, risk ratings, and want to communicate those to the business for further • Ease of communication between auditors, with
saver for me.” cyclical audit frequencies. She can care for the an- follow-up. Configurable rule-based workflows allow her notes, sign-off and reviews
nual planning at a managerial level. Separately she can to keep track of management responses and the prog- • Streamlined communication between auditors and
Ann Green, 8 years of work ex- then create detailed scheduling at a task level. Ann ress of the follow-up. Alerts on her BWise homepage auditees,
perience as an Internal Auditor and her colleagues have all the necessary capabilities will assure Ann of a timely follow-up. • Strict audit trail of all relevant audit activities and
available as they conduct risk assessments both for the evidencing of findings
total enterprise and for individual audits. This integrated 2.5. Reporting • Reduced efforts in follow-up of findings, ease of
risk-based approach enables them to perform an annual Finally, Ann can finalize the risk-based audit plan through use for auditees and transparency of detailed status
assessment to determine the audit universe and audit individual findings and their status. Integrated reporting for auditors
coverage, and report on the progress and risk status capabilities are available for Ann to review and monitor • Reduced effort for reporting, higher transparency
throughout the year to the audit committee. on a real time basis. • Compatibility with configurations for highly-specific
access management needs like those for the Bank
Secrecy Act

4 5
3 BWise Internal
Audit Advanced
4 BWise Academy
BWise Audit Analytics
BWise Audit Analytics enables the ability to
®
approach has many advantages over traditional tools:
securely take data from sources such as SAP • Centralized rules creation and decentralized rules
usage facilitates a broader use of advanced data
and Oracle, by exporting the data on a protected analysis capabilities
memory stick. No live connection is required to • Integrating it into work paper management reduces
gather and analyze data during the audit execution. audit efforts, eliminates the tedious processes
required to integrate changes via copying and
The data analysis performed and results document- pasting, and complications to produce reports
ed in audit work papers, can then be synchronized • Integrating broader risk management and
with the audit. BWise Audit Analytics enables users compliance facilitates audit rules that can be used in
continuous monitoring
to create rules that define how to analyze this data. • It simply becomes a technology applied in another
The true integration of risk and control frameworks way for users: ultimately, audit helps improve the
with rules, enables auditors like Ann to conduct business by assisting business owners to better
manage their processes
advanced data analysis on external data. BWise • In addition, business owners may help to reduce
delivers templates for SAP and Oracle analysis, audit efforts; continuously monitoring data may be
including Segregation of Duties (SoD) analysis for reused in audit programs

both. BWise also enables Ann to adapt existing 3.3. Additional Benefits of BWise Internal Audit Advanced are:
rules and define new rules. With the addition of the • Adapt and create new scripts
Audit Analytics component, the BWise Internal Audit • Pre-defined rule scripts for SAP and Oracle are
available
Advanced package is the most advanced audit • Intelligent data retrieval, based on scripts means only The BWise Academy delivers learning solutions 4.2. Software Training on the Job
platform globally. relevant data will be retrieved When Ann is asked by a lead auditor to schedule an
• Intelligent filtering mechanisms; for instance on data to illuminate the GRC process and successfully
audit, she can log into the BWise Learning Center and
3.1. Key Benefits of BWise Internal Audit Advanced include: ranges to allow subsets of data implement the BWise solution in your organiza- take a brief five minute tour of this topic. She will then
• Reduced efforts for data collection and analysis • Usable in audit analytics, by integration into audit tion. Through the Learning Center, customers be able to effectively perform her task in BWise.
• Higher coverage of analysis (full data analysis, rather programs
than sampling), and as a result more reliable findings • Usable in continuous monitoring, by integration into have access to a broad offering of cost-effective
4.3. Content Training and Regulations, IT Security, and
and lower risk profile other parts of the BWise GRC Platform and innovative learning experiences. Custom- More
• Precise analysis of actual (potential) problems, pro- • Ability to securely retrieve information from external ers can choose from different formats including: In case Ann has to discuss findings on IT security
viding more precise recommendations to auditees data sources on encrypted memory sticks with business management, she can prepare by tak-
• More focus on high risks because there is more • Tried and tested with large data sets eLearning courses, class room courses, and
ing a specialized course on IT security at the BWise
automation • Highly scalable data retrieval mechanism enabling tailor-made training programs. Learning Center. During her meeting, she can show
billions of records to be retrieved business management the course and recommend
3.2 Audit Analytics in more detail • Integration capabilities with any open data source 4.1. New Internal Audit Colleagues offering this course to the employees of the business
An important part of an Auditor’s work is to analyze data, • Historical trail of all analyses performed The BWise Academy can support Ann by introduc- unit. By improving their understanding of security risks,
find potential fraud and failing controls, and to gain a • Audit trail of all exceptions ing new colleagues to the audit method enabled by the at risk business unit can actively close the gap dis-
better understanding of the organization’s risk exposure. • Automated escalation, in case thresholds are BWise. Through the BWise Learning Center, her new covered by the findings. BWise offers expert training
Traditionally, the data analysis is seen as a separate surpassed, triggering standard workflows in BWise colleagues are provided with access to a comprehen- on a broad range of topics.
activity, conducted by highly trained audit professionals • Intelligent reporting with managerial views, drill- sive offering of eLearning courses, such as a Quick Visit www.bwise.com/academy for an overview.
with advanced toolsets. BWise believes current technol- downs into individual transactions, leveraging MS Start with BWise, and Understanding the Business
ogy should facilitate more efficient ways of working by Excel capabilities. Control Framework and Internal Audit. Ann can also
integrating data analysis technology into the audit solu- • Flexible reporting by non-expert users monitor progress and results of the training through a
tion, and even more broadly into the area of GRC. This web-based interface.

6 7
5 BWise GRC Platform ®
6 More information
BWise® Internal Audit is one of the six differ- Performance Management all work in the same To learn more about BWise’s vision on the Meet Ann’s colleagues, Jackie McLaren (Compli-
ent role-based solutions BWise offers within the solution. They all use the same risk taxonomy “Evolving role of Internal Audit,” you can request ance), Michael Bauer (Internal Control), Damian
a whitepaper on the subject here: Thomson (IT GRC), Kim Lee (SPM) and Gerard
GRC platform. Ann and her colleagues in Risk and speak the same language, improving trans- www.bwise.com/grc-library. Parker (Risk), to see how they each work with
Management, Compliance & Policy Manage- parency and efficiency, and creating common BWise, visit www.bwise.com.
ment, Internal Control, IT GRC and Sustainability ground.

Ann Green
Internal Auditor
Gerard Parker
(Internal Audit)
Chief Risk Officer (Risk Management)

Jackie McLaren
Compliance Officer
(Compliance & Policy Management)

Michael Bauer
Corporate Group Controller
(Internal Control over Financial
Reporting)

Damian Thomson
Chief Information Security
Officer (IT GRC)

Kim Lee
VP Corporate Sustainability
(Sustainability Performance Management)
8 9
7 Join us in the GRC
Journey Today
BWise provides for the GRC needs of hundreds of customers, worldwide, across all industries.

THE NETHERLANDS: INTERNATIONAL

RETAILER INTEGRATES INTERNAL
UNITED STATES: INTEGRITY CONTROLS, RISK MANAGEMENT AND
PROGRAM FOR MANUFACTURER INFORMATION SECURITY
FOR 200,000 EMPLOYEES

SAUDI ARABIA: LEADING CHEMICAL

UNITED KINGDOM: WORLD’S FIRM GLOBALLY MANAGES ITS RISK,
LEADING PHARMACEUTICAL IS COMPLIANCE AND AUDIT PROGRAM
SOX COMPLIANT WITH BWISE

UNITED STATES: LEADING FINANCIAL

SERVICES FIRM MANAGES ITS RISK
AND COMPLIANCE PROGRAM WITH FRANCE: 2000 USERS ENSURE GOOD
BWISE FINANCIAL REPORTS FOR TELECOM
GIANT TAIWAN: INSURER MANAGES
RISK MANAGEMENT AND
COMPLIANCE

SOUTH AFRICA: LARGEST GOLD MINE

HAS ITS ANTI-FRAUD AND COMPLIANCE
BRAZIL: A POWER COMPANY PROCESSES THROUGHOUT AFRICA AND
MANAGES RISK AND INTERNAL SOUTH AMERICA UNDER CONTROL
CONTROL PROCESSES

10 11
About BWise Contact Information
BWise has sales, service and support offices worldwide.
To contact us at our local offices in Asia, Australia, Europe,
BWise, a NASDAQ OMX company, is a South Africa and the United States, visit www.bwise.com/offices.

global leader in Enterprise Governance, Risk

Management and Compliance (GRC) software. BWise the Netherlands (HQ) BWise South Africa
Based on a strong heritage in business process Rietbeemdenborch14-18 2nd Floor, West Tower
5241 LG Rosmalen Maude Street
management, the BWise® GRC Platform provides The Netherlands Nelson Mandela Square
+31 73 646 4911 Johannesburg 2196
companies with highly-rated, proven software
South Africa
solutions for Risk Management, Internal Control, BWise North America +27 11 881 5436
195 Broadway, 9th Floor
Internal Audit, Compliance & Policy Management, New York, NY 10007 BWise Sweden
IT GRC and Sustainability Performance USA Tullvaktsvägen 15
+1 212-584-2260 105 78 Stockholm
Management. Sweden
BWise Australia +46 8 405 60 00
BWise’s end-to-end solutions support an Level 8, 155 George St
Sydney NSW 2000 BWise Thailand
organization’s ability to understand, track, measure,
Australia 36/F CRC Tower
and manage key organizational risks. BWise +61 2 8076 2600 All Seasons Place
helps companies truly be in control by balancing 87/2 Wireless Road,
performance with their financial and reputational BWise France Phatumwan
risks, improving corporate accountability, increasing 10 Boulevard Haussmann Bangkok, 10330
75009 Paris Thailand
financial, strategic and operating efficiencies. Using
France +66 2 625 3087
BWise, organizations are able to efficiently comply +33 1 85 34 13 00
with anti-corruption regulations like FCPA and the BWise United Kingdom
UK Bribery Act, the Sarbanes-Oxley Act, European BWise Germany Woolgate Exchange
Corporate Governance Codes, ISAE3402/SAS-70, Kaiserswerther Strasse 115 25 Basinghall Street
40880 Ratingen London EC2V 5HA
PCI-DSS, Solvency II, Basel II and III, Dodd-Frank,
Germany United Kingdom
ISO-standards, and many more. +49 2102 420663 +44 20 3753 2000

BWise sales, service and support offices around

the globe provide for the GRC needs of hundreds
of clients, including: adidas, AEGON, AG2R La
Mondiale, Ahold, AngloGold Ashanti, Carnegie,
Health Alliance Plan (HAP) of Michigan, Liebherr,
Marathon Oil, Southern Company, Swiss Life, and
Transcontinental. For more information,
visit www.bwise.com.

Customers

Legal Notice
This document may be part of a written agreement between BWise and its customer, in which case the terms and conditions of that agreement apply hereto. In the
event that this document was provided by BWise without any reference to a written agreement with BWise, to the maximum extent permitted by applicable law this
document and its contents are provided as general information ‘as-is’ only, which may not be accurate, correct and/or complete and BWise shall not be responsible
for any damage or loss of any nature related thereto. All rights are reserved. Unauthorized use, disclosure or copying of this document or any part thereof is prohibited.