Slots of Risk

Success in gambling has nothing to do with luck and everything to do with knowing the system -- just ask Cheryl Kondra, chief audit executive of Harrah's Entertainment.

Kondra leads a staff of 82 internal auditors in an 80,000-employee company that has completed several major acquisitions, including the 2005 $5.2 billion deal for Caesars Entertainment, in recent years. And then there are the industry-specific regulations: "Eighty-nine percent of our 2009 audit plan consists of regulatory audits," Kondra notes. "We can't not do the work. As much as we like to talk about risk-based auditing, and it's something we value, we're doing 90 percent of what we do whether we think there is risk there or not."

The system that Harrah's internal audit function uses to maximize its odds for success consists of new technology, best practices gleaned from auditors within the legacy organization and recently acquired companies, and strong relationships with other corporate functions, particularly finance and information technology (IT). Success takes the form of executing the legally mandated components of its audit plan with greater effectiveness and efficiency, the latter of which frees up hours to devote to more risk-based auditing.

"Our auditors are spending more time in the pit or up in surveillance conducting observations," she continues. "And they're coming up with new ideas for efficiencies and game protection."

Harrah's internal audit model is of particular interest right now for two reasons.

First, the current function is the product of significant merger & acquisition (M&A) activity, a dynamic that may pick up in other industries as company valuations drop in a bad economy and competitors snap them up. Harrah's postmerger internal audit integration offers valuable lessons.

Second, Harrah's internal audit function has learned how to do more with less, freeing up resources to devote to risk-based auditing and other strategic GRC activities. Most companies want to do so. "Protiviti's 2008 Internal Audit Capabilities and Needs" survey identifies computer-assisted audit techniques, continuous auditing, and data analysis, respectively, as the greatest areas in need of improvement. Many internal audit departments, regardless of their industry, face budgetary pressure to trim head count in a tough economy and regulatory pressure to avoid doing so.

"Harrah's is a good example of how analytics can be used to better address a high volume of regulatory requirements while supporting growing expectations that audit looks at the company's most important at strategic risk issue," says John Verver, a vice president with ACL Services. "The idea is to use technology to free up auditors to use their professional judgment ... and their skills are proving to be applicable not only in a traditional audit-assurance function but, increasingly, in supporting overall GRC activities."