Award Winning Use of DirectLink
Listed on the Australian Stock Exchange (ASX), Metcash Limited is Australia’s largest food and liquor wholesaler, turning over $12.6 billion annually with a market capitalization of $3.1 billion. Metcash Limited has 5000 employees and two major divisions: Metcash Food and Grocery, and Australian Liquor Marketers.
Operating in a mature market, Metcash competes against a duopoly of the major Australian grocery chains. There is limited opportunity to grow the business by increasing market share, and a complex regulatory environment that includes onerous food safety regulations and laws prohibiting anti-competitive behavior.
Each area of the Metcash business uses different data types, applications, manual processes and technical platforms, including a number of legacy systems. The business is diverse, and while some divisions maintain an effective control environment, others suffer from high staff turnover and experience occasional control breakdowns.
Metcash internal auditors work to provide financial and operational risk assurance, while adding value through consulting activities. The business is varied and geographically broad enough to minimise the impact of a single incident, but the inconsistent control environment increases exposure to cost (or revenue) leakage. For example, independent Metcash retailers maintain their own systems, which can be vulnerable to hacking and data theft, and limit the capture and aggregation of retail sales data. Maintaining a culture of compliance across the enterprise can be difficult for this diverse organisation.
Implementation and Planning
Over the past several years, the Metcash Internal Audit team has developed and implemented a robust controls analysis environment. A sophisticated ACL solution and DirectLink for SAP ERP provide an uninterrupted connection to SAP system data, while at least 70 standardized tests analyse full data files and deliver electronic results to end users. The complex Metcash computing environment includes a variety of different platforms, systems and data types, which the ACL solution can easily access and convert into a standard format. Current analysis categories include asset management, fraud detection, accounting, data integrity, logical security, compliance and consulting.
Currently, the IA team is focused on risk management analysis by developing automated tests that gather “risk indicator” data across the business for board-level review. Before implementing the ACL solution, auditors collected risk-related data manually – leading to quality and timeliness issues. Now, automated applications run overnight and deliver results by 7 a.m. the following day.
Metcash has used ACL technology for a wide range of test types including:
- duplicate testing
- non-trade procurement
- vendor master file management
- warehouse stock adjustments
The Metcash IA team runs at least 70 audit analytics on a daily or weekly basis. The tests have led to direct cost savings, fraud prevention and detection, and process improvements. Over three years data analytics have identified duplicate payments worth more than $8.4 million and uncovered key control issues.
Change records from the Metcash Finance ERP system are routed to management for further review – ensuring all security bypass actions are fully authorized. Analytics highlight Metcash purchases made from unauthorized suppliers, leading to significant cost savings and more fully realized contract benefits. The IA team also uses ACL to capture and present 90 hard-copy exception reports in a standard, modifiable digital form – lowering process costs and highlighting error trends. Analytic routines track deliveries and customer return rates on large plastic order boxes (called “totes”) worth $42 each. Fewer tote losses mean sizeable cost savings.
Using ACL Direct Link, Metcash auditors perform a daily vendor master file download to test for exceptions, regulatory issues, and unusual transactions. Automated tests identify data outliers, including stock record adjustments that fall outside standard deviations and potential data manipulation – providing an early warning system for process breakdowns.
The ACL solution works across the Metcash organisation to analyse complete data sets and highlight evidence of control breakdowns or heightened risk exposure. The benefits of ACL technology have been broadly disseminated across the entire Metcash business. Almost all IA reviews now include ACL analytics. As further evidence of the team’s success, the Chief Audit Executive recently flagged the routine analysis efforts for further development – improving the reach and scope of Internal Audit across the business.
Impact Award Winner
Metcash was named the ASIA recipient of the 2011 ACL Impact Award.