Sony Internal Audit - ISACA

1 Internal AuditSony Internal AuditPresentation toISACA Tokyo ChapterTuesday, March 12, 2013 Internal Audit DepartmentSony CorporationInternal AuditAgendaCase Study: Auditable Risks and Procedures 3 Advertising and Promotion, Data Analytics, Logistics, BPOO verview of sony Corporation Overview of sony Corporation and Highlights of Financial ResultsSony Internal Audit Department2IA Structure, global Auditable Risks, Resource Allocation, Offshore Support 21 Internal Audit3 Overview of sony CorporationInternal Audit4 Corporate DataCompany Name: sony CorporationHeadquarters:1 7 1 Konan, Minato ku, TokyoFounded: May 7, 1946 Consolidated Sales and Operating Revenue:6,493,200 million yen (FY2011)Headcount:162,700 (as of March 31, 2012)Consolidated Subsidiaries:1,267 (as of March 31, 2012)OverviewInternal Audit5 sony Corporate HistoryOverview1946 MayTokyo Tsushin Kogyo (Tokyo Telecommunications Engineering Corporation), also known as Totsuko, established in Nihonbashi, January1961 JuneCompany name changed to sony became the first Japanese company to offer shares in the United States in the form of American Depositary Receipts (ADRs) on the OTC market of the New York Stock AugustSony Prudential Life Insurance Co.

2 Ltd., a 50 50 joint venture with Prudential Insurance Co. of America, established. It was renamed sony Life Insurance Co. Ltd. in April JanuaryCBS Records Inc. the records group of CBS, acquired. It was renamed sony Music Entertainment NovemberColumbia Pictures Entertainment, Inc. acquired. It was renamed sony Pictures Entertainment NovemberSony Computer Entertainment Inc. NovemberSony Communication Network Corporation established. It was renamed So net Entertainment AprilSony Bank established in June2004 AprilCorporate shift to committee based organizational Financial Holdings Inc. September2010 JuneSony Group unveils new brand message " . sony launches NEX series , the world's smallest and lightest interchangeable lens digital still camera series.

3 Internal Audit6 sony Business Segments OverviewSource: Annual Report 2012 (Year Ended March 31, 2012) Internal Audit7 sony Group Consolidated ResultsOverviewInternal Audit8 sony Internal Audit DepartmentInternal Audit9 Internal Audit OrganizationIA DepartmentIn 2003, sony adopted the Company with Committees corporate governance system under the Companies Act of Japan. Internal Audit10 Internal Audit OrganizationIA DepartmentOrganizational independence through dotted reporting line to Audit Committee, and direct line to EVP. global Planning OfficeAuditCommitteeTopManagementCorpora te Executive Officer, Executive Vice President and General CounselCorporate Executive Officer, Executive Vice President and General CounselSenior General Manager, Head of global Internal AuditSenior General Manager, Head of global Internal AuditSoMCSFH GroupGeneral Manager and Head of Regional Internal Audit OfficesGlobal Internal Audit Management TeamGeneral Manager and Head of Regional Internal Audit OfficesLatin AmericaCAD (SCA)ElectronicsMusicPicturesGAO (SCE)SCEISCEASCEEJ apanIADE uropeAsia PacificChinaInternal Audit11 Purpose of Internal AuditIA DepartmentIdentify critical issuesEscalateto senior managementMake recommendationsfor improvementStrategyExecutionAuditAbility to.

4 IAD sMission:IdentifyGapsBetweenStrategyandE xecution The Internal Audit Department (IAD) establishes and maintains the Internal Audit organization and Internal Audit activitiesand formulates Internal Audit policies for the sony group. IAD plans and executes its activities utilizing a risk based approach for the purpose of providing an objective and independentassessment on governance, risk management and control processes for the sony AuditRisk AssessmentAuditStakeholdersGlobal Key RisksRegional RisksPlanningFieldworkReportingConsolida ted ReportingBenchmarkingGood PracticeIssuesHQRegionReportingConcernRe quest Standard Audit Program CAAT Tool External Resources12 Internal Audit ProcessIA DepartmentInternal Audit13 History of sony Internal Audit DepartmentIA Department1997 global Internal Audit1999 Risk based Audits sony Group global Key Auditable Risk Areas global Internal Audit Charter global Issue Tracking global Audit Summary Reporting Renamed the Internal Audit Department (IAD) Audit Committee established in sony Corporation Internal Audit Office established in Latin America (IALA)

5 Internal Audit Office established in China (IAC) Renamed the global Audit Department Started Knowledge Sharing First Risk Assessment for sony group Institute of Internal Auditors Japan Chairman's Award global Internal Audit Policy Developed Internal Audit Office established in Singapore (IAAP) Internal Audit Office established in Europe (IAE) First sony Internal Audit Newsletter Issued Internal Audit Function separated from Accounting Internal Audit Office established in America (SCA) Internal Audit Function established in Accounting1968 1987 1993 1996 98 99 2000 2002 2003 2004 05 09 2011 Internal Audit14 global Coordination global Internal Audit Structure: How to focus on better coordination i) among IA offices and ii) with other Audit activities?

6 Audit CollaborationCollaboration with Regional Internal AuditRegional Meeting / global Internal Audit Leaders MeetingCentral Support Team (CST)Joint Audit team with diversified experts from regional Internal Audit offices: Collaboration with regional Internal auditors in Audit activities, Scheduling Risk/scope assessment Internal knowledge-sharingRegional meeting held to share knowledge and experience among Internal Audit offices, and conduct Audit planning workshops Quarterly Regional Meeting Annual Internal Audit Leaders MeetingEstablished CST team in India, consisting of 6 members with professional backgrounds, centrally support the global Audit activities in terms of: Data analysis by CAAT tool Information Security System controls and IT projects managementIA DepartmentInternal Audit15 Resource sharing is essential to share expertise and knowledge of the Audit process inrealityAuditResourcesNordicEurope, JapanIndiaAsia Pacific, Japan, EuropeJapanJapan, EuropeSouth ChinaJapan, Asia Pacific, EuropeHong KongJapan, Europe, Asia PacificPan AsiaJapan, Europe, Central Support TeamJapanJapan, Europe, Central Support TeamJapanJapan, Europe, Central Support TeamJapanJapan, Europe, Central Support TeamVietnamAsia Pacific, JapanGulfAsia Pacific, Europe.

7 Central Support TeamAudit CollaborationIA Department EuropeChinaJapanAsia PacificAmericasInternal Audit16 Regional MeetingsLearn from ManagementTeam SharingBenchmark Results Enjoy the management presentations and participate Continuously share between regional teams Domain depth .. credibility built from experience Continuously develops self .. loves learning Utilize the Audit Workshops to discuss and benchmarkUpdate Internal Audit team members on Business results/management direction, Internal Audit projects andvarious Audit planning topics. Provide an opportunity to listen to sony / Internal Audit management s voice andalso, have common understanding of Internal Audit projects/ Audit planning status and discuss next DepartmentInternal Audit17 Team Building Activities sony Futsal CupIA DepartmentInternal Audit18 Central Support Team (CST)IA DepartmentEstablish a Central Support Team in India:Provide Internal Audit services, such as data analytics, data mining, continuous monitoring, etc.

8 To all Internal Audit regional regional Internal Audit offices greater flexibility to meet business changes. Supply talented and experienced resources to all IA resources minimise regional Internal Audit costs while maintaining a high standard of audits. Provide additional support to each regional Internal Audit Audit19 Central Support Team BenefitsIA DepartmentCSTD uring AuditPost AuditAd hocPre AuditIncreased Flexibility Scale up and downReduces Costs Minimise regional Internal Audit costs while maintaining a high standard of auditsMore Benchmarking Opportunities Overview of issues that cross borders Share best practices amongst Internal Audit offices Risk Assessment Audit Planning Audit Notice/ Request for Information (RFI) Auditors access to ERP and other systems Audit Programs Audit Fieldwork Audit Work papers IT Audit Use of CAATsCommunicationand Reporting Tracking of Audit Issues that span geographies Process of sharing Leading PracticesEstablished the sony Internal Audit Central Support Team (CST) in Bangalore, India.

9 The cost advantages of utilizing India Off Shore model are as follows:CultureTolerant of misunderstandingsPatientCheerfulInternal Audit20 Case Study: Advertising and PromotionInternal Audit21 Case Study: Data AnalyticsInternal Audit22 Why Data Analytics? BackgroundData Analytics Increased Audit Coverage Test 100% of transactions Improved compliance with CAP Improved Audit Efficiency Analytics tests supplement traditional Audit work steps Audit tests focused on exception analysis Quantifiable Audit Results Fraud Detection Increasing the focus on fraud detection and monitoring Provides a basis for Continuous Monitoring Well designed analytics can evolve into continuous monitoring tools Broader Audit Coverage Audit results are based on a significantly larger population than sample based approach is used Able to draw on multiple data sources and systems Define a repeatable approach for integrating analytics into a cycle Analysis of data to identify anomalies.

10 Trends and risk indicators Analysis based on large population of transactions instead of sample Used to supplement or replace other procedures inspection, inquiry, observation, and re performanceInternal Audit23 Data Analytics Usage of ACL It is essential to define the roles within the IA teamDecide who does what!Work together :IA TeamworkData Analytics Hybrid approach: ACL experts and non experts understand both the tool and Audit process. Since field auditors understand the background of the analysis, they can investigate potential issues Audit24 Data Analytics Introducing the ACL CMMData AnalyticsInternal Audit Pre training. ACL and CAAT tools not used or 0 Non existent ACL not used or implemented. Can leverage experience from other CAAT 1 Basic / Ad hoc ACL training provided to all team members.