Old Wine, New Bottle - Learning to talk the Audit Language - Part 2 (Conclusion)

Introduction given in Part 1 ( Repeated for sake of continuity / reference ) :

It looked like just another day. Yet, it was a day which got me crystallizing my views and thoughts. The topic is a clichéd one – Role of internal check mechanisms. Nay, it is not about how and where. It is about some lovely concepts that came out the discussion. It was with a group of friends – all of us from the Audit / Compliance / Regulatory Check / Fraud Prevention background. It was fun, with a lot of new lessons making me feel humbled. Here are some of the expressions that caught my fancy !

We had seen 5 of these expressions / usages in PART 1. Now the balance :

6.      ECONOMIC VALUE ADD

During my times of UG / PG, we used a different expression – “ Oppurtunity Cost “. Measure of the current yield from investments made against what we could earn if the investments were made elsewhere in alternate opportunities.

 I guess the terminology “Oppurtunity Cost” must have seemed negative in perspective as compared to “ Economic Value Add “, which seemed more positive.

 Yet the additional info about “EVA”, as it is popularly known, is that it also defines a technique / method to assess. Well then, its more than a change of expression !!

7.      EMBEDDED AUDIT MODULE (EAM)

 EAM was more a term I seemed to relate to Nuclear Missile carrying submarines. The moment I heard the term I recollected a movie, Crimson Tide – with Denzel Washington and Gene Hackman. Emergency Action Message.

 Yet, I couldn’t avoid a smile when I heard the expansion of EAM here and what it meant … !!

We called it “Hindsighting” ! It was merely an audit chalked out on pre-determined criteria which could either be done on real time or “post mortem” basis… ! The activity was the same…

8.      FALSE NEGATIVE / FALSE POSITIVE

 This was neat .. !! I believe the term has its genesis from an IT connotation, and has an audit flavor. Misdiagnosing a normal activity / pattern as an attack on the system, would be FALSE – NEGATIVE. The vice versa of Misdiagnosing an actual attack on the system as normal activity, would be FALSE – POSITIVE . I guess one would be more concerned with FALSE – POSITIVE.

 Yet my colleague from the Fraud Prevention (IT & Cyber) had a different point of view. If an attempt at breaking a system – be it software / process, is done systematically, it is a method of “testing the fences”. So even a normal activity in his view would need to be diagnosed to its root cause to check the reason for the misdiagnosis. Interesting Perspective … !

9.      INTERNAL PENETRATORS

 I initially interpreted them to be an expression relating to hacking ! It simply referred to the employee who overstepped his / her legitimate powers / rights / Official capacity. These were people who were trusted to deliver and overstepped for some reason.

 Naturally, the next thought is – Does it mean – an issue of integrity ? Nay, the term limits itself to just highlighting who and where the penetration occurred. Whether Integrity or not is a completely different level of discussion.

The day was made …… I had learnt two things from this meet :

(A)  The student in me was terribly excited, getting to know interesting new concepts and

(B)  The old adage – What is learnt is only a handful, the world has a lot more of learning opportunities to offer – was experienced. A humbling experience indeed !