Transformation in Action Toolkit

1

Transformation in Action Toolkit

© 2019. For information, contact Deloitte Touche Tohmatsu Limited. 2

Action Plan - Planning

Action Plan - Interim

Action Plan - Final

Resources

Purpose


Purpose

This Transformation in Action Toolkit will help you to think about elements of what you need to do, to execute a high quality, transformed audit. Remember, an audit is an iterative process, and as always, you should aim to enhance quality and efficiency every year.

As well as providing you with the areas to think about, it includes links to relevant resources that will help you actually do things differently on your engagements.

What is in this toolkit?

Action Plans are provided for the Debrief, Preliminary, Planning, Interim and Final stages of the audit. These action plans set out the key activities for transforming your audit approach.

Links to further learning and implementation guidance are included under Resources and also throughout this toolkit.

How am I meant to use the toolkit?

With your engagement team, work through this toolkit to understand the expectations for each stage of the audit. Identify team members to take responsibility for specific actions and mark as complete in the space proved, as you move through the audit. This toolkit should not be included in your engagement file.

Action Plan – Preliminary

Action Plan - Debrief


Debrief the prior year audit

It is important to reflect on lessons learned in the prior year. Continuous improvement is a part of our cultureas we look to continue raising the bar for quality and value.

Actions Status

Schedule your prior year engagement debrief meeting as soon as possible (ideally within 1 month ofyour audit report date). All members of the engagement team should be involved in this discussionand be encouraged to share their feedback and ideas for improvement.

Consider the following1:

1. The Deloitte Way

• Did you get the most out of all available Deloitte Way Workflows?

• How could you use Guided Risk Assessment more effectively, including data analytics and visualizations?

• Did you use Regional Audit Delivery Centers to complete the standardized working papers?

• Did you make full use of Deloitte Connect?

2. Ways of Working

• How did you manage against your project plan and meet Audit Quality Milestones?

• Could you better use Stand-up Meetings and Kanban Boards to help with project management?

• How did you work with the Regional Audit Delivery Centers – are there areas for improvement?

• What else can be done to support team wellbeing?

• How did you do in tracking overruns and have you billed them?

1 This reflects discussion points related to audit transformation only and does not encompass all audit activities.



Action Plan - Final

Resources

Purpose





Click on each preliminary activity for further guidance and then click on Action Plan - Preliminary on the left to return to this page.

Deloitte Way

Workflows

Plan the use of

Tools & Applications

Plan the use of

RADCs

Determine PBE

requirements

Determine

engagement team

mix and budget

Preliminary Activities1

Plan for Risk

Assessment Data

Analytics

1 This action plan reflects key activities related to audit transformation only and does not encompass all audit activities

for this phase. This does not supersede or replace the requirements of the Audit Approach Manual.

Prepare the Project

Plan

Team Planning

Meeting



Action Plan - Final

Resources

Purpose





Click on each planning activity for further guidance and then click on Action Plan - Planning on the left to return to this page

Planning Activities1



Perform Risk Assessment

Data Analytics

Perform Guided Risk

Assessment



Action Plan - Final

Resources

Purpose







Status

Interim is an important phase of the audit. The actions below will help you to assess progress against the overall audit strategy and audit plan; ensuring there are no surprises at Final, and also ensuring you have appropriate resources in place to complete the audit.

Review work that has been performed by either specialists or the RADC as early as possible andassess the impact of any findings on your audit strategy and audit plan.

Assess the impact of any findings from your interim control and substantive procedures on yourinitial Guided Risk Assessment conclusions and update your risks, controls and procedures asnecessary. Also assess the impact on your overall audit strategy and audit plan.

Review and update your PBE list, and make a note of any delays. Discuss these with the client andidentify changes that are needed to the process for the Final audit.

Assess whether changes to scope or timelines impact the RADC and, if so, communicate with themand update your RADC Portal tickets.

Ensure that you hold a retrospective meeting after each sprint and update the project plan andtimeline.



Action Plan - Final

Resources

Purpose



Interim Activities1



Final Activities1 Status

The actions below will help you complete your risk-focused audit, ensuring that reviews are completed on time and that resources are being utilized effectively.

Assess the impact of any findings from your control and substantive procedures on your initialGuided Risk Assessment conclusions and update your risks, controls and procedures as necessary.Also assess the impact on your overall audit strategy and audit plan.

Ensure that work performed by specialists and/or the RADC is reviewed and any outstanding pointsare appropriately addressed by the onsite team.

Continue to schedule regular Stand-Up Meetings and update your agile project plan.

Update your RADC Portal requests to confirm that all processes and tasks are complete.

For non-account balance Deloitte Way Workflows, ensure that you complete any final proceduresand update your conclusions within Audit Online and EMS (as is appropriate).

Provide feedback to both the onsite and RADC teams.



Schedule a meeting with the client to review your Final PBE list and identify changes andimprovements for next year. Remember - delays should be communicated and discussed with theclient throughout the audit.



Action Plan - Final

Resources

Purpose




Deloitte Way Workflows

Non-Account Balance

DWWs - Quick Reference

Guide

An Overview of a DWW -

Brainshark

Your journey to Reimagine Audit begins with the Deloitte Way Workflows. You will need to identify whichDeloitte Way Workflows (and associated task enablers) are going to be implemented on your engagement.Remember, these are applicable for material-significant ABCOTDs on Tier 1, Tier 2 and Tier 3 engagements, forwhich you have not yet started the planning. The steps below will set you up for success.

Actions Status

Visit the Transformation section of the Deloitte Technical Library to review the available account balance, non-account balance, and industry-specific Deloitte Way workflows (DWWs).

Confirm expectations/requirements from [MF to include local Transformation team contact details] regarding which DWWs you should adopt.

For material-significant account balances for which you have already commenced planning and will not be using the DWWs, it is recommended that you still use the standardized templates and RADC for your substantive testing.

If you are a component auditor, liaise with your group engagement team to determine the requirements to adopt DWWs on your engagement.

Communicate your DWW implementation plan to all members of the engagement team.



Action Plan - Final

Purpose



https://audit.deloitteresources.com/learning/Documents/Non-Account%20Balance%20Deloitte%20Way%20Workflows%20QRG.pdf

https://www.brainshark.com/deloittegl/vu?pi=zH7zGivL0zIbSPz0

https://techlib.deloitteresources.com/?link=content/0901ff8181c59f36


Plan the use of Tools & Applications

Tools & Applications-

Guidance and Resources

- Cognia

The Deloitte Way Workflows are supported by a suite of tools and applications to help you perform a more efficient and effective audit. The successful implementation of these tools and applications requires careful planning. Perform the steps below as early as possible.

Actions Status

For each Deloitte Way Workflow that you are implementing, review the ‘Innovation’ column in the‘Task Enablers’ section to identify the applications that are available to you, and the context for theiruse. Use the table below to summarize your decisions.

For each relevant application, consider the information that is required for the use of the tool, andinclude this on your PBE.

Communicate your implementation plan to all members of the engagement team.

ApplicationEngagement Utilization

Yes/NoRationale

Excel Analytics Toolbar

Deloitte Connect

Iconfirm

Icount

Power BI

RADC Portal

Reveal

Scribe

Signal (for SEC registrants)

Spotlight



Action Plan - Final

Purpose



For each relevant application, evaluate whether modifications need to be made to your engagementletter e.g. Storing or processing data outside the country.

https://cognia.deloitteresources.com/#/app/allSolutions/title


Plan the use of Regional Audit Delivery Centers (RADCs)

RADC Wills, Wonts, Dos

and Don'ts - Quick

Reference Guide

RADC Portal

Demonstration -

Brainshark

RADCs improve quality through better standardization and consistency of work, and increase the time availablefor onsite teams to focus on the most complex areas and client interactions. Early planning is critical.Implement the actions below to set yourself up for success in this area.

Actions Status

For each Deloitte Way Workflow that you are implementing, review the ‘People’ column in the ‘Task Enablers’ section to identify the tasks and procedures that are required to be completed by the RADC.

The RADC may also be able to assist you with planning and concluding tasks that are not listed in the Deloitte Way Workflows. Discuss these opportunities with your RADC contact.

Have a discussion with your client regarding the use of the RADC. The use of RADCs is permitted under our standard engagement terms but ensure that your client is aware of the process and answer any data protection and/or audit quality questions that may arise.

Submit your booking request via the RADC Portal as early as possible (ideally 3 months in advance of when you require the work back). Ensure that this is accurate and reflects the specific work that you want the RADC to complete.

Update your engagement staffing plan and budget to reflect the assignment of tasks to the RADCs.

RADC Conversations with

Clients

Confirm the process for the secure transfer of information between the onsite team and the RADC. Use Deloitte Connect.

Review your PBE list, and ensure that PBE information required by the RADC is included.

Nominate a member of your engagement team (field senior or above) to be the primary contact for the RADC and update the RADC Portal to reflect this. It is important that the RADC is able to reach this person to resolve issues early.

Review the standard testing templates and understand exactly which steps will be completed by the RADC. Remember, the onsite team will need to work through exceptions identified with the client.

Have a conversation with the RADC to discuss the matters above and ensure there is a clear understanding of expectations for both the onsite and RADC teams.



Action Plan - Final

Purpose



https://audit.deloitteresources.com/learning/Documents/Guidance%20Card%20for%20Onsite%20teams%20%E2%80%93%20Wills,%20Won%E2%80%99ts,%20Dos%20and%20Don%E2%80%99ts.pdf

https://www.brainshark.com/deloittegl/vu?pi=zIJz14h74uzStnWz0

https://audit.deloitteresources.com/learning/Documents/RADC%20Conversations%20with%20Clients.pdf


Prepare the Project Plan

In our transforming audit environment, it is critical to approach our work differently in order to be successful.The appropriate use of agile ways of working, including daily stand-up meetings, breaking audit work downinto sprints, and the use of a Kanban board, will improve the audit engagement experience. The improvementshould be felt by everyone involved in the audit, from the most junior member to the most senior member ofthe team.

Actions Status

Prepare a project plan divided into short sprints, then agree on what 'done' means for the purposesof each sprint – remember this includes reviewing (including Engagement Partner reviews).

Ensure that the timing of activities and deadlines is in compliance with the Audit Quality Milestones.

Ensure that your project plan incorporates the use of RADCs and specialists (as applicable).

Incorporate engagement quality, and other applicable consultations/reviews into your project plan.

Schedule your daily stand-up meetings. The recommended duration for these is 15 minutes.

Discuss and agree on the use of a Kanban Board to increase visibility of progress and encourageownership.

Agree the project plan with your client. Agree which member of the engagement team will beresponsible for tracking overruns – plan to use Deloitte Connect for this purpose.

The Agile Project Plan -

Brainshark

Audit Project Management

Toolkit

Kanban Board Template

Further Reading – Ways of Working



Action Plan - Final

Purpose



https://techlib.deloitteresources.com/?link=content/0901ff8181d02bcd

https://www.brainshark.com/deloittegl/vu?pi=zI7zvKFu2zKjQyz0

https://cognia.deloitteresources.com/#/app/solution/0901ff818126180c

https://audit.deloitteresources.com/learning/Documents/Kanban%20Board%20Template.xlsx


Determine engagement team mix and budget

Our people are critical for the success of our engagements. Once you have determined the plan fortransforming your audit approach, you will need to revisit your staff bookings to ensure staff mix and timing isappropriate.

Actions Status

Ensure there is a direct link between the project plan, the engagement team mix, the engagementbudget, and when engagement teams are booked to perform the work.

Identify opportunities arising from the allocation of tasks to RADCs (in line with the DWWs) to drivemore efficient use of onsite time and adjust the staff mix/hours accordingly.

Understand the full RADC service capabilities and engage them to deliver all of the service offeringsapplicable to your engagement For example, EMS file setup, rollforward of prior year workingpapers, drafting confirmation letters, etc.

Ensure that entity management is aware of the impact of delays and agree on the approach forover-runs.

Evaluate whether the allocation of responsibilities supports the engagement team’s wellbeing. Ifneeded, hold discussions with individual team members to discuss this.



Action Plan - Final

Purpose




Determine Prepared by Entity (PBE) requirements

Deloitte Connect

Resources - Cognia

At the earliest possible stage of the audit engagement, we need to establish and reach agreement on thescope and level of assistance required from the entity in the preparation of schedules and related informationand in meeting applicable deadlines. This mutual understanding is important to facilitate planning andexecution of the Audit Engagement.

. Actions Status

Review the items below to identify the information that you will need to request from the entity:• Deloitte Way Workflow pdf documents• PBE List for each Deloitte Way Workflow• Risk Assessment Data Analytics Data Request Forms• Standardized substantive testing templates• RADC Portal

Determine when you will need this information; consider your engagement sprints.

Discuss the PBE list with entity management, including the format of the data/information, andmake them aware of the impact of any delays (on both the onsite team and RADCs).

Confirm the process for the secure transfer of information between the client and the engagementteam. Use Deloitte Connect.

Discuss the process for tracking and updating PBE items with both the client and the engagementteam, including the process for identifying, communicating and tracking delays. This will ensurethere is full transparency regarding any delays and their impact, and that there are no surprises atthe end of the audit.



Action Plan - Final

Purpose



https://cognia.deloitteresources.com/#/app/solution/0901ff81816af4ea


Plan for Risk Assessment Data Analytics

Using data analytics can enhance our risk assessment process by providing fact-based evidence and revealingpatterns, outliers, and insights that we can provide to entity management. With more clients now usinganalytics in their work we need to keep up with the change. We need to continue to transform our audit, andharnessing the power of data analytics is a critical component of this journey.

Actions Status

Find out what data you will need. Review the individual DWW Analytics tiles on Cognia for detailsand request this data from the client.

Hold a meeting with the entity to specifically discuss the requirements for data analytics.Recommend to the entity that employees from outside the finance team (e.g., IT personnel)participate in the meeting.

Perform trial data extracts and uploads into Spotlight/Power BI if possible.

Data Analytics – Overcoming

common challenges and

pitfalls - Brainshark

Analytics On Demand

Learning

Illumia Analytics Solutions

Decide whether Power BI or Spotlight will be used for Risk Assessment Data Analytics.

Key Reminders – Risk Assessment Data Analytics

If you are using Spotlight – ensure that you create a ticket with the Spotlight Delivery Center asearly as possible. This should not be left to the week when you need the work to be performed.Tickets should be created as soon as the need for them is identified and 3-6 months ahead of thedate of request.



Action Plan - Final

Purpose



https://cognia.deloitteresources.com/#/app/dashboard

https://www.brainshark.com/deloittegl/vu?pi=zGLzx8tMz7kEiz0

https://audit.deloitteresources.com/learning/Pages/reimagine_audit_playlist.aspx?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSTabPersistence&webpart=analytics#jump

https://cognia.deloitteresources.com/#/app/allAnalyticsSolutions/title

15© 2019. For information, contact Deloitte Touche Tohmatsu Limited.

Team Planning Meeting

1. The Deloitte Way

• Which Deloitte Way Workflows will we adopt?

• Are we anticipating any significant changes to our audit plan, as a result of adopting the Deloitte WayWorkflows?

• What is our strategy for performing and reviewing the Guided Risk Assessment?

2. Regional Audit Delivery Centers

• How do we plan to use the Regional Audit Delivery Center?

• Who will be responsible for liaising with the RADC (incl. updating the requests on the RADC portal)?

• What is the strategy for getting the PBE information to the RADC (e.g. ensuring data provided by theclient is complete)

• What is the review strategy for the work performed by the RADC?

3. Risk Assessment Analytics

• Which analytics tools are we using?

• How are we managing the data requests for the entity?

• What is the strategy for checking the data received from the entity?

4. Ways of Working

• How will we incorporate agile working concepts (sprints, stand-up meetings, Kanban board)?

• How will we support team wellbeing?

• How will we track overruns?



Action Plan - Final

Purpose



It is important for all team members to understand the ‘what’, ‘who’ and ‘how’ of transforming your audit.

Actions Status

Schedule your partner-led planning meeting as soon as possible. Include the items below on your agenda.


Perform Risk Assessment Data Analytics

Using data analytics can enhance our risk assessment process by providing fact-based evidence and revealingpatterns, outliers, and insights that we can provide to entity management. With more clients now usinganalytics in their work we need to keep up with the change. We need to continue to transform our audit, andharnessing the power of data analytics is a critical component of this journey.

Actions Status

Include relevant screenshots from your risk assessment data analytics within your analytics workingpaper, and remember to document your findings as part of your audit planning procedures.

Data Analytics – Overcoming

common challenges and

pitfalls - Brainshark

Analytics On Demand

Learning

Illumia Analytics Solutions

Ask precise questions when inquiring about visualizations and critically consider the appropriatenessof responses from management.

Further Reading – Risk Assessment Data Analytics

For Power BI, store appropriate data (outside the audit file - following data storage policies) for usein future audits where applicable for prior period comparatives.

Document the process you went through once you get the right data (i.e. who you spoke to, whatreports/data files were received, etc.).

Check the completeness and accuracy of the data received. If using the Spotlight Delivery Centermake appropriate checks before sending data on.

Perform data manipulation and import the data into PowerBI. If using Spotlight, the SpotlightDelivery Center will complete this for you.

Run the visualizations and use the output to help complete the Guided Risk Assessment.

If using Spotlight, provide feedback on the analytic to the Spotlight Delivery Center



Action Plan - Final

Purpose



https://audit.deloitteresources.com/learning/Pages/reimagine_audit_playlist.aspx?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSTabPersistence&webpart=analytics

https://audit.deloitteresources.com/learning/Pages/reimagine_audit_playlist.aspx?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSTabPersistence&webpart=analytics#jump

https://cognia.deloitteresources.com/#/app/allAnalyticsSolutions/title


Perform Guided Risk Assessment

The GRA is a critical DWW task enabler, that will improve your risk assessment process. Well-executed Guided Risk Assessment will assist you with pinpointing, assessing and responding to the risks on your audit engagement and increase the quality of fact-based documentation.

Actions Status

Work in Audit Online and use the GRA Tickmarks and Working Paper References to support yourresponses to Tailoring and Risk Assessment Questions.

Document your Analysis & Rationale when prompted for an Expanded Response.

Ensure that non-GRA RoMMs that are similar to prescriptive RoMMs generated by the GRA aredeleted.

After all reviews have been completed and cleared ensure that you ‘Save to EMS’.

GRA Key Reminders &

Considerations -

Brainshark

Diagnostic Dashboards in

Audit Online

GRA Audit Online

Walkthrough

If you have a Deliberative RoMM ensure that you tailor both the RoMM AND your response.

Consider performing/reviewing Guided Risk Assessment as a team (incl. engagement leadership).

Further Reading – Guided Risk Assessment

Use the Diagnostics Dashboards to assist with the preparation and review of the Guided RiskAssessment.



Action Plan - Final

Purpose



https://www.brainshark.com/deloittegl/vu?pi=zHozffvS6z7kEiz0

https://www.brainshark.com/deloittegl/vu?pi=zGpzG4Gcjz7kEiz0

https://americas.internal.deloitteonline.com/sites/CanadaAuditLC/OA/Documents/eLU/GRA_EMS_Online_3_0_Walkthrough/story.html


Further Reading – Ways of Working

• Take the client on the agile journey by implementing an appropriate client communication plan throughout the audit engagement.

• Working in sprints brings a range of benefits, including better control of the flow of the audit and regular opportunities for improvements. Sprints also enable better delegation with a shorter and more frequent feedback loop. Sprints set a deadline to get things done by, promoting responsibility and accountability to get tasks done by the end of the sprint.

• Ensure that you hold a retrospective meeting after each sprint and update the project plan and timeline.

• Use a Kanban Board to track tasks in a sprint by allocating each task to a team member, identifying issues, and clearly seeing who is working on what work every day.

• Maintain daily stand-up meetings which are under 15 minutes and focus on these three questions:o What did you achieve yesterday?o What are you working on today? o Is there anything blocking you from completing your work?

• In the changing environment of transformation, past delegation practices need to be revisited due to the changing nature of the work performed by the client facing team. Effective delegation and on the job coaching saves engagement leadership time, and for more junior audit team members, provides more interesting tasks and empowerment to drive task to completion during sprints. Effective delegation skills are more relevant than ever, as audit team members are expected to provide clear instructions when working with an RADC.

• Each member of the team has a key role in the agile journey. Engagement managers are expected to take ownership of the overall project plan. Field seniors are encouraged to lead the daily stand-up and retrospective sprint meetings.

• Ensure timely review of work, sometimes before all the work is finished (to ensure timely review of progress and validation of the approach).



Action Plan - Final

Purpose



Prepare the Project

Plan


Further Reading – Risk Assessment Data Analytics

• Understand the type of analytics visuals to be generated and the corresponding data required. This will helpus in our conversations with entity management (and the Spotlight Delivery Center, where appropriate).

• Understand that the quality of data, and consequently the visualizations, may impact whether you cananswer the GRA questions appropriately.

• Engage entity management early and work closely with them to get the right data. You can run some sampledata extractions to check that the client is on the right track in providing you with the required data.

• Agree data due dates with the client. If applicable, book time with the Spotlight Delivery Center to format thedata. Raise your ticket as early as possible. This should not be left to the week that you need the analyticsperformed.

• Check completeness and accuracy of the data received. If using the Spotlight Delivery Center, makeappropriate checks before sending data on. If reconciliations are required, resolve them with the client first.

• Document the process you went through once you got the right data (i.e., who you spoke to, whatreports/data files were received, etc.). This is good documentation and will help in future audits too.

• Take screen prints of the analytics visualizations used to perform risk assessment and include them in theaudit documentation within the 13300 ‘Assess risks and plan audit responses’ section of the EMS file.

• Document the commentary of your observations for the analytics visualizations and the results of any followup discussions we had with the client.

• Keep only the necessary analytics visualizations in the EMS file and not the data files.

• For Power BI, store appropriate data (following data storage policies) for use in future audits, whereapplicable, for prior period comparatives. This should not be saved in the audit file, but in a secure location.



Action Plan - Final

Purpose



Perform Risk

Assessment Data

Analytics

Plan for Risk

Assessment Data

Analytics


Further Reading – Guided Risk Assessment

• Ensure that you tailor your GRA for the facts and circumstances that apply to your engagement.

• Use the GRA Tickmarks and Working Paper References to support your responses to Tailoring and RiskAssessment Questions.

• Ensure that you document your Analysis & Rationale when prompted for an Expanded Response.

• Remember, there is no need to re-document information that has already been included in another sectionof the GRA.

• Include relevant screenshots from your risk assessment data analytics within your analytics working paperin your engagement file, to support your analysis and conclusions.

• There is no need to retain non-GRA RoMMs that are similar to prescriptive RoMMs generated by the GRA.

• For Deliberative RoMMs ensure that you tailor both the RoMM AND your response. Remember you need toensure that every assertion for the deliberative RoMM is addressed.

• Use the Diagnostics Dashboards to assist with your preparation and review of the GRA.

• Make sure to get your tasks for RADC booked in early, but if there are changes in the scope, these shouldbe corrected immediately.



Action Plan - Final

Purpose



Perform Guided

Risk Assessment


Resources

Cognia

Reimagine Audit: The Deloitte Way Playlist

Deloitte Technical Library - Transformation

• There are a range of resources available to support you as you continue on your journey to ReimagineAudit. Make sure to visit the pages below:

• If you have further questions, contact [MF to include contact details] who will be happy to assist you.



Action Plan - Final

Resources

Purpose



https://cognia.deloitteresources.com/#/app/dashboard

https://audit.deloitteresources.com/learning/Pages/reimagine_audit_playlist.aspx?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSTabPersistence&webpart=ems

https://techlib.deloitteresources.com/#/toc?docid=0901ff8181c59f36

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited (“DTTL”), its global network of member firms, and their related entities. DTTL (also referred to as “Deloitte Global”) and each of its member firms are legally separate and independent entities. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.

This communication is for internal distribution and use only among personnel of Deloitte Touche Tohmatsu Limited, its member firms and their related entities (collectively, the “Deloitte network”). None of the Deloitte network shall be responsible for any loss whatsoever sustained by any person who relies on this communication.

© 2019. For information, contact Deloitte Touche Tohmatsu Limited.

http://www.deloitte.com/about

Transformation in Action Toolkit

Documents

Transcript of Transformation in Action Toolkit