by Susan Fisher, Contributing Writer, SAPinsider Delivery Hero’s vision is to always deliver an amazing experience fast, easy, and to your door. This may not seem unusual for an order and delivery service organization, but with over 1 billion orders per year, and continued growth and expansion, it appears the company is delivering on its ambitious vision. Delivery Hero’s acquisition and hyper-localization strategies have created a large number of individual entities in over 50 countries. Given the diversity of markets and regulatory requirements with many potential localized risks to track, having strong assurance is essential to their success. Internal Audit (IA) was created in 2016 when Larry Herzog Butler, CPA CIA, joined the organization as Head of Internal Audit, to align IA with strategic objectives to protect and add value to the organization through independent assurance. “My vision is for us to be the IA team of the future by adding value through audits and capture the attention of stakeholders including C-level, management teams, and the board,” Herzog Butler says. But it is challenging to provide assurance to every aspect of the business, with over 35K employees and significant diversity in geographies and partners too.

How IA does more with less, leveraging resources for greater productivity, insights, and value

The IA team is forced to take a risk-based approach. Supporting that approach includes a lot of stakeholder engagement, planning and prioritization, investment in people, and digitization of processes. Centers of excellence have been created across the organization for deeper engagement with internal stakeholders with a focus on automation and analytics to improve efficiency and intelligence. This includes risk and compliance to identify critical risks that the business is facing. “Without a doubt, the number one risk facing our business is cyberattack,” Herzog Butler says. “If our platforms are not operating, we don't make money.” Cybersecurity is part of every audit they do regardless of audit type including general controls to more specialized areas of cybersecurity. Collaboration with the data analytics team, machine learning, and business intelligence teams has enabled IA to predict the risk level of their observations utilizing machine learning and data analytics. In the reporting phase, IA observations are put into a program and the program predicts the risk level, with IA having the authority to override the risk level. They’ve integrated this into their audits. Local market knowledge and boots on the ground relationships are significant competitive advantages for the company and ongoing contributors to growth. To support this hyper-localization, IA created audit or ‘hero’ hubs in five international locations working collaboratively with partners in the region. Planning and prioritization support IA’s drive to add value. In 2021, the team will continue to expand, and two additional international hero hubs will open. In the coming 18 months, IA is considering developing a dedicated data analytics team within IA as well as exploring having an artificial intelligence (AI)/innovations team within IA to advance its automation capabilities and move closer to continuous auditing. Automation means much greater assurance coverage given the capacity to analyze millions of transactions, and is a strategic imperative given the rise in risk, and regulatory and compliance standards. The business also benefits with time and cost savings Technology is at the core of Delivery Hero’s success and the backbone of its business. Creating better stakeholder experiences includes having better data, insights, and processes to enable its complex and rapid growth. “We look to leverage technology to support IA innovation projects that will move us into the future by consolidating and utilizing data to prevent fraud and identify anomalies and processes and move us closer to auditing in our sleep,” Herzog Butler says. Advancing robust topline data and better utilization as consolidation occurs are also on the horizon. Larry Herzog Butler, CPA CIA, Head of Internal Audit, Delivery Hero   Hiring, training, and developing the IA team is paramount. A relentless focus on adding value is a defining characteristic of the team and why they’ve earned a reputation for innovation. “During the recruiting process, I look for people who can tell a story because audit reports can be very dry. We’ve been able to capture the attention of our executive leaders through storytelling in 80-second video summaries of audit reports and we’ve reduced our audit reports from more than 25 pages to five to six.” “As a leader, help develop passion for your team members. Passion supports honesty, competency, and the commitment to learn and expand what you need to consider through the audit process, and innovation,” is advice from Delivery Hero’s Senior Manager, IA, Sholpan Niyazbayeva.

Measuring success

Diversity is stated as a key pillar for success. “Diversity is what takes me to work every day because I can rub elbows with people from all around the world. We have a hundred different nationalities represented at our hero hub here in Berlin, Germany,” Herzog Butler says. Niyazbayeva is opening their next IA hub in Turkey, with South Korea opening after that, demonstrating this strategy is working in support of hyper-localization and continued growth. In 2021, the top key performance indicator (KPI) for Delivery Hero IA is Management Action Plans (MAP) with a focus on overdue MAP, understanding why they’re overdue at a root cause level, and the percentage completion to their audit plan. This is where conversations and reporting are focused, and IA has captured the attention of executive stakeholders who want to know what’s fixed or implemented in a timely manner. Herzog Butler is also trying to connect KPIs to adding value to the business, i.e., dollar amounts saved on behalf of the company. They are experimenting with KPIs in their innovation projects too calculating the time, resources, and money saved for each innovation. Sholpan Niyazbayeva, Senior Manager, Internal Audit, Delivery Hero

Driving automation and scale in a complex world

SAP is a major partner with Delivery Hero, helping to drive automation and scale. Delivery Hero has been running SAP Audit Management and the core SAP GRC suite since 2017 when the company first established the internal audit function. This enabled the organization to support the initial build out of its team and management of core audit and compliance processes. SAP Audit Management is enabling IA to see more vulnerabilities and faster, aligns MAP across three lines of defense, and automates the audit process through SAP Analytics Cloud to meet their goal of continuous auditing. By analyzing millions of transactions, preventing fraud on a very timely basis, and providing transparency in real-time, IA’s mission of protecting and adding value to the organization is standing strong. Delivery Hero is continuing to focus on analytics and automation, exploring how it can further leverage solutions such as SAP Analytics Cloud, SAP Digital Boardroom, and AI technologies such as Natural Language Processing. Remote working in many jurisdictions is a pressure but the team is highly flexible and utilizing tools like SAP Ruum to support a systems approach that is accessible, collaborative, efficient, and transparent. EY was Delivery Hero’s implementation partner for SAP Audit Management, which was critical to automating key processes and doing more with a small team, and its journey toward the digital boardroom. Analytics is a strategic part of Delivery Hero’s next phase, leveraging data to create insights to drive decision making and PwC has been an important advisor for this. Out of this collaboration, IA has been able to develop capabilities internally such as creating dashboards within SAP Analytics Cloud.

What Does This Mean for SAPinsiders

• Understand the strategic value of audits in highly regulated markets. Alignment to business strategies and collaboration across the organization are strategic drivers for IA contribution. Embracing technology for efficient risk mitigation supports a strategic value proposition for IA.
• Commit to learning what you don’t know so you are better prepared to add value to your organization. According to Herzog Butler, “my development is cybersecurity. I have put time and energy into learning, certifications, and licenses. I’m able to identify and prevent, detect and recover, and have better conversations with information security teams at Delivery Hero, and better manage the subject matter experts that we partner with to conduct our audits.”
• Open audit to the same innovation opportunities as the rest of the business: Analytics, AI, and automation are being applied in other business functions. They should also be explored in the audit function. Tap into the innovation projects and knowledge that already exist to create new applications, processes, and visibility within audit.

  Watch this short video and learn how Delivery Hero’s IA team has gone from scratch to impact. For Premium Member insiders – Watch the full on-demand session from the SAPinsider 2021 virtual GRC event, “How Delivery Hero’s better audit management helped improve the customer experience,” presented by Larry and Sholpan You’ll learn about creating a vision for your digitized future, how to establish and build your internal audit function from scratch and focus your internal audit innovation projects on what matters most. Become a Premium Member