SonyInternalAudit

Presentationto ISACATokyoChapter Tuesday,March12,2013

InternalAuditDepartment SonyCorporation
InternalAudit

Agenda
1
OverviewofSonyCorporation OverviewofSonyCorporationandHighlightsofFinancialResults

SonyInternalAuditDepartment

IAStructure,GlobalAuditableRisks,ResourceAllocation,OffshoreSupport

CaseStudy:AuditableRisksandProcedures

AdvertisingandPromotion,DataAnalytics,Logistics,BPO

InternalAudit

OverviewofSonyCorporation

InternalAudit

CorporateData
CompanyName: Headquarters: Founded: ConsolidatedSalesandOperatingRevenue: Headcount: ConsolidatedSubsidiaries: SonyCorporation 171Konan,Minatoku,Tokyo May7,1946 6,493,200millionyen(FY2011) 162,700(asofMarch31,2012) 1,267(asofMarch31,2012)

Overview

InternalAudit

SonyCorporateHistory
1946May 1958January 1961June

Overview

TokyoTsushinKogyoK.K.(TokyoTelecommunicationsEngineeringCorporation),alsoknownasTotsuko,establishedin Nihonbashi,Tokyo. CompanynamechangedtoSonyCorporation. SonybecamethefirstJapanesecompanytooffersharesintheUnitedStatesintheformofAmericanDepositaryReceipts (ADRs)ontheOTCmarketoftheNewYorkStockExchange. SonyPrudentialLifeInsuranceCo.Ltd.,a5050jointventurewithPrudentialInsuranceCo.ofAmerica,established.Itwas renamedSonyLifeInsuranceCo.Ltd.inApril1991. CBSRecordsInc.therecordsgroupofCBS,acquired.ItwasrenamedSonyMusicEntertainmentInc. ColumbiaPicturesEntertainment,Inc.acquired.ItwasrenamedSonyPicturesEntertainmentInc. SonyComputerEntertainmentInc.established. SonyCommunicationNetworkCorporationestablished.ItwasrenamedSonetEntertainmentCorporation. SonyBankestablishedinJapan. Corporateshifttocommitteebasedorganizationalmodel. SonyFinancialHoldingsInc.established. SonyGroupunveilsnewbrandmessage"make.believe. SonylaunchesNEXseries,theworld'ssmallestandlightestinterchangeablelensdigitalstillcameraseries.

1979August 1988January 1989November 1993November 1995November 2001April 2003June 2004April 2009September 2010June

InternalAudit

SonyBusinessSegments

Overview

Source:AnnualReport 2012(YearEndedMarch31,2012) InternalAudit

6

SonyGroupConsolidatedResults

Overview

InternalAudit

SonyInternalAuditDepartment

InternalAudit

InternalAuditOrganization

IADepartment

In2003,SonyadoptedtheCompanywithCommitteescorporategovernancesystemundertheCompanies ActofJapan.

InternalAudit

InternalAuditOrganization
Audit Committee
Top Management CorporateExecutiveOfficer, ExecutiveVicePresidentandGeneralCounsel SeniorGeneralManager, HeadofGlobalInternalAudit

IADepartment

OrganizationalindependencethroughdottedreportinglinetoAuditCommittee,anddirectlinetoEVP.

GlobalInternalAuditManagementTeam
GlobalPlanningOffice
GeneralManagerandHeadofRegionalInternalAuditOffices

IAD

CAD(SCA)

SoMC

GAO(SCE)

SFHGroup

Japan

LatinAmerica

SCEI

Europe

Electronics

SCEA

AsiaPacific

Music

SCEE

China

Pictures

InternalAudit

10

PurposeofInternalAudit
IADs Mission: Identify Gaps Between Strategy and Execution

IADepartment

The Internal Audit Department (IAD) establishes and maintains the internal audit organization and internal audit activities and formulates internal audit policies for the Sony group. IAD plans and executes its activities utilizing a riskbased approach for the purpose of providing an objective and independent assessment on governance, risk management and control processes for the Sony group.

Abilityto:
Identifycriticalissues

Strategy

Escalate toseniormanagement Makerecommendations for improvement

InternalAudit

Audit

Execution
11

InternalAuditProcess
Request
Global Key Risks

IADepartment

HQ

RiskAssessment

Regional Risks

Stakeholders
Concern

Region

Planning

StandardAuditProgram CAATTool ExternalResources

Audit

Fieldwork Reporting

Benchmarking

Consolidated Reporting

Good Practice Issues

Reporting

InternalAudit

12

IADepartment

1996989920002002 2003200405092011

SonyGroupGlobalKeyAuditableRiskAreas

GlobalInternalAuditCharter 1997GlobalInternalAudit 1999RiskbasedAudits InternalAudit

GlobalIssueTracking

GlobalAuditSummaryReporting

RenamedtheInternalAuditDepartment(IAD)

HistoryofSonyInternalAuditDepartment

AuditCommitteeestablishedinSonyCorporation InternalAuditOfficeestablishedinLatinAmerica(IALA)

InternalAuditOfficeestablishedinChina(IAC)

RenamedtheGlobalAuditDepartment

StartedKnowledgeSharing

FirstRiskAssessmentforSonygroup

InstituteofInternalAuditorsJapanChairman'sAward

GlobalInternalAuditPolicyDeveloped

InternalAuditOfficeestablishedinSingapore(IAAP)

1968

1987

1993

InternalAuditOfficeestablishedinEurope(IAE)

FirstSonyInternalAuditNewsletterIssued

InternalAuditFunctionseparatedfromAccounting

InternalAuditOfficeestablishedinAmerica(SCA)

InternalAuditFunctionestablishedinAccounting

13

GlobalCoordination
GlobalInternalAuditStructure: Howtofocusonbettercoordinationi)amongIAofficesandii)withotherauditactivities?

IADepartment

Audit Collaboration

Joint audit team with diversified experts from regional internal audit offices:

Collaboration with Regional Internal Audit Regional Meeting / Global Internal Audit Leaders Meeting Central Support Team (CST)

Collaboration with regional internal auditors in audit activities, e.g. Scheduling Risk/scope assessment Internal knowledge-sharing Regional meeting held to share knowledge and experience among internal audit offices, and conduct audit planning workshops Quarterly Regional Meeting Annual Internal Audit Leaders Meeting Established CST team in India, consisting of 6 members with professional backgrounds, centrally support the global audit activities in terms of: Data analysis by CAAT tool Information Security System controls and IT projects management

InternalAudit

14

AuditCollaboration

IADepartment

Resource sharing is essential to share expertise and knowledge of the audit process in reality
Audit
Nordic India Europe,Japan AsiaPacific,Japan,Europe Japan,Europe Japan,AsiaPacific,Europe Japan,Europe,AsiaPacific Japan, Europe,CentralSupportTeam Japan,Europe,CentralSupportTeam Japan,Europe,CentralSupportTeam Japan,Europe,CentralSupportTeam AsiaPacific, Japan AsiaPacific,Europe,CentralSupportTeam

Resources

Americas

China

Japan

Europe

Japan

SouthChina HongKong PanAsia Japan Japan

AsiaPacific
Japan Vietnam Gulf

InternalAudit

15

RegionalMeetings

IADepartment

Update internal audit team members on Business results/management direction, internal audit projects and various audit planning topics. Provide an opportunity to listen to Sony/Internal Audit managements voice and also, have common understanding of internal audit projects/audit planning status and discuss next actions.

Learnfrom Management

Enjoythemanagementpresentationsandparticipate

Benchmark Results

Domaindepthcredibilitybuiltfromexperience Utilize theAudit Workshops todiscuss andbenchmark Continuously develops selfloves learning

Team Sharing

Continuouslysharebetweenregionalteams

InternalAudit

16

TeamBuildingActivities SonyFutsalCup

IADepartment

InternalAudit

17

CentralSupportTeam(CST)

IADepartment

EstablishaCentral SupportTeaminIndia:
Provideinternalauditservices,suchasdataanalytics,datamining, continuousmonitoring,etc.toallinternalauditregionaloffices. Allowregionalinternalauditofficesgreaterflexibilitytomeetbusiness changes.SupplytalentedandexperiencedresourcestoallIAregions. Scaleableresources minimiseregionalinternalauditcostswhile maintainingahighstandardofaudits.

Provideadditionalsupporttoeachregionalinternalauditoffice.

InternalAudit

18

CentralSupportTeam Benefits
EstablishedtheSonyInternalAuditCentralSupport Team(CST)inBangalore,India. ThecostadvantagesofutilizingIndiaOffShoremodel areasfollows:

IADepartment

Culture Tolerantofmisunderstandings Patient Cheerful

AuditFieldwork AuditWorkpapers ITAudit UseofCAATs

IncreasedFlexibility
Scaleupanddown

During Audit

ReducesCosts
Minimiseregionalinternalauditcostswhile maintainingahighstandardofaudits

Pre Audit
RiskAssessment AuditPlanning AuditNotice/ Requestfor Information(RFI) Auditorsaccessto ERPandothersystems AuditPrograms

CST
Ad hoc

Post Audit

Communication andReporting

MoreBenchmarkingOpportunities
Overviewofissuesthatcrossborders Sharebestpracticesamongstinternalauditoffices

TrackingofAudit Issuesthatspan geographies Processofsharing LeadingPractices

19

InternalAudit

CaseStudy:AdvertisingandPromotion

InternalAudit

20

CaseStudy:DataAnalytics

InternalAudit

21

WhyDataAnalytics?Background
Abletodrawonmultipledatasourcesandsystems Definearepeatableapproachforintegratinganalyticsintoacycle Analysisofdatatoidentifyanomalies,trendsandriskindicators Analysisbasedonlargepopulationoftransactionsinsteadofsample

DataAnalytics

Usedtosupplementorreplaceotherprocedures inspection,inquiry,observation,andreperformance

IncreasedAuditCoverage Test100%oftransactions ImprovedcompliancewithCAP ImprovedAuditEfficiency Analyticstestssupplement traditionalauditworksteps Audittestsfocusedonexception analysis QuantifiableAuditResults

FraudDetection Increasingthefocuson frauddetectionandmonitoring ProvidesabasisforContinuous Monitoring Welldesignedanalyticscan evolveintocontinuousmonitoringtools BroaderAuditCoverage Auditresultsare basedonasignificantlylargerpopulation thansamplebasedapproachisused

InternalAudit

22

DataAnalytics UsageofACL
IATeamwork
Itisessentialtodefine Decidewho theroleswithintheIA team doeswhat!

DataAnalytics

Work together closely..

Hybridapproach:ACLexpertsand nonexpertsunderstandboththe toolandauditprocess. Sincefieldauditorsunderstand thebackgroundoftheanalysis, theycaninvestigatepotential issueseffectively.

SOURCE:

InternalAudit

23

DataAnalytics IntroducingtheACLCMM

DataAnalytics

InternalAudit

24

DataAnalytics ACLCMMand(current)RegionalPlacement
Level0 Nonexistent

DataAnalytics

Pretraining. ACLandCAATtoolsnotusedorimplemented. ACLnotusedorimplemented. CanleverageexperiencefromotherCAATtools. ACLtrainingprovidedtoallteammembers. Training/usagemethodologyexist,butarenotapplied.

Level1 Basic/Adhoc

Level2 Applied

Level3 Managed

Expertsaresourceforregionalteams,OpsunderstandandutiliseACL. ConsistentuseofACL riskcoverage,eciencies. AuditreportsandfindingsarereflectiveofACLusage. Methodical,systematicuseofACLacrossallaudits. Bestpracticesandtemplatessharedacrossauditteams. CAATsscriptsareautomated. Abilitytoprovidemonitoringresults. Identifyredflagspriortoauditsoroccurrenceofissue.

Level4 Automated

Level5 Monitoring

InternalAudit

25

CaseStudy:Logistics

InternalAudit

26

Logistics ComplexityoftheBusiness
ITandSystems MISandReporting HR

Logistics

FinanceandTaxation

Planningand Forecasting

Distribution Network

Freight Consolidationand Forwarding Insurance Management

Dispatch Management

Inventory Management

ReverseLogistics

Business Processes

OrderProcessing

Repairs Management

SalesandMarketing

QualityControl

Pricing

Procurement

Contract Management

Partner Management

Billing

Customs Handling

CustomerService

BUSINESSUNITS

GlobalIntegratedForwarding LandTransportation OceanServices SRPC

Warehousing AirFreightServices InternationalCourier LogisticsConsultation

InternalAudit

27

LogisticsStandardAuditProgram
ProcessandAssessmentArea
BusinessUnit/Factory 1

Logistics

KeyAuditProgram Scheduling,planningbetweenbusinessunit/factory
Validatetheplanningprocess BusinessUnitrequestandLogisticsplanningcommunication Verifythestarttoendoperationalprocessflow,andinventoryownership,PIC. 2

RequestforLogistics

Dispatchmanagement Transportationpickup,delivery
Assessvendorselectionprocess,assessshipment,warehouse,customsupplierperformance Validateandreperform planning,routing,cargoselection,loading/unloading,custom

PickupArrangement

3 WarehouseManagement

Warehousemanagement Load/Unload,dailymaintenance
Reviewwarehouseselection,contractrenewal,pricing,insurance ReviewandrecalculatewarehousecostandbillingtoBusinessUnit storage,damage, package,OT,utility

TransportationDelivery,PoD

Financials Tracking,billing,payment,andP&Lreporting
ValidatePayment/cost Warehouse/trucktracking,invoicereconciliation,reviewsample invoice ValidateBilling/revenue Scheduling,storage,custom,PoD,handlingfee,sampleinvoice

SupplierInvoice CustomerBilling 5 KPI,CostEfficiency

KPI,performancemeasurement,costefficiency
Review,reperformKPIdetails,benchmarkwithGlobalfinishedgoodsKPI,documentation Assesscurrentmanagementreview,involvementinoperations,driversforcostefficiency

InternalAudit

28

CaseStudy:BPO

InternalAudit

29

BPO Background
Audit Scope:
RISKSCOPE ProcessEfficiency/Effectiveness ContractCompliance VendorPerformance/Monitoring VendorEducation/Compliance VendorControl/ProcessVisibility BillingfromVendor/Cost SoD /SystemAccessRight InformationSecurity BusinessContinuityPlanning ServiceLevel Efficiency Compliance

BPO

Information

KEY POINT : AUDIT AGAINST CONTRACT. Two Phases 1. Contract Design: Are key risks covered? 2. Contract Execution: Is it working as designed? Are we monitoring?

InternalAudit

30

SONY or make.believe is a registered trademark and/or trademark of Sony Corporation. Names of Sony products and services are the registered trademarks and/or trademarks of Sony Corporation or its Group companies. Other company names and product names are the registered trademarks and/or trademarks of the respective companies.

InternalAudit