Internal Audit Service in Entertainment/ Media Sector

The high visibility, diverse technology and systems, and complex business relationships of media companies make them more susceptible to cyberattacks than other industries. Internal audit has the potential to play a significant role in identifying and mitigating these risks.

Cybersecurity lapses are a major threat to the entertainment industry as they are vulnerable to cyberattacks because of the high-profile brands, valuable intellectual property, and large number of customers. Cyber Security lapses can threaten the entertainment and media industry in the following ways:

• Data Breaches: Cybercriminals can steal sensitive data from media companies such as customer information, financial data, and intellectual property. The use of this data is possible for fraud, identity theft, or blackmail.
• Ransomware Attacks: The data of media companies can be encrypted by cybercriminals, and they may demand a ransom payment to decrypt it, causing disruptions and significant financial losses.
• Denial-of-Service Attacks: Media companies' websites and servers can be overwhelmed by denial-of-service attacks by cybercriminals, making them unavailable to customers and resulting in significant financial losses.
• Reputation Damage: The reputation of media companies can be damaged by cybersecurity lapses. If customers believe that their data is not secure, they are less likely to do business with the company.

Potential steps for internal audit in entertainment industry:

• Assess the company’s cybersecurity program, guided by media industry standards, cybersecurity standards, and regulations such as ISO 27001.
• Perform cybersecurity maturity and penetration testing audits.
• Assess the effectiveness of identity and access controls.
• Assess the business continuity plan and data governance framework to identify priority information assets.
• Assess the cybersecurity incident response plan.
• Review the company’s vulnerability management and patching programs.

Note: The average cost of a data breach to a media company is $4.24 million, According to a 2023 report by Verizon.

Information security and privacy protection are clear priorities for media companies as they navigate globalization, technology innovation, and business model evolution.

Continuously re-evaluating privacy and security is crucial. Failure to meet these requirements can result in risks such as the breach of personal information/identity, theft, fraud, access management issues, system availability, and damage to the company’s reputations. From a regulatory point of view the European Commission finalized the introduction of General Data Protection Regulation (GDPR) which introduced new requirements for data protection.

The internal auditor assess the data privacy on following basis:

This is a way of loading balance in the customer’s account electronically without any use of a voucher. In this case, there should be a proper link between the system that facilitates the electronic uploads, systems, wherein the stocks has been maintained and the financial system, wherein the money has been entered. The internal auditor needs to ensure that there is a proper control over the E-Recharge process and there is a system of reconciliation between the stocks as per electronic system and stock as per financial system.

• Potential impact of the GDPR on the organization’s information governance strategy and budget.
• Integrate GDPR requirements into the organization’s annual audit program to assist in improving compliance.
• Data breach notification process for regulatory and legal compliance.
• Ensuring necessary levels of access that employees can have to the system's data.
• Security audits around cloud and social platforms.
• Assessing the company's compliance with data privacy regulations, which include the General Data Protection Regulation (GDPR) and rules concerning Personal Identifiable Information (PII), Protected Health Information (PHI), and Payment Card Information (PCI).

Data Governance

Media companies should have strong data governance policies and procedures to ensure that their data is collected, used, and shared in a responsible manner. This includes having a clear understanding of what data the company has, where it is stored, who has access to it.

By increasing data analytics in the business and internal audit process, increasing risk coverage, audit scope, testing precision, and simplifying auditing, internal audit can expand data analytics in the business and internal audit process.

The world of business is being transformed by intelligent automation, such as robotic process automation (bots), machine learning, and cognitive solutions. The use of new technology that complements and enhances human skills can lead to exponential increases in speed, scale, quality, precision, and operational efficiency across organizations. The domain of humans has been taken over by smart machines, but they now perform activities and make decisions that were previously done by humans, and their work is done faster, more accurately, and at a much larger scale.

The days of employees clocking in to work just to repeat manual tasks over and over will soon be a thing of the past. It's no surprise that intelligent automation has become a mission-critical initiative, given the clear benefits and numerous use cases.

It is important for companies to be aware of the risks when embarking on a significant digital transformation project. The proper implementation of intelligent automation programs can be ensured by a well designed risk and governance function. It is crucial to identify, evaluate, mitigate, or accept associated risks effectively.

The global market for augmented reality and virtual reality is expected to reach $209 billion by 2025.

• Augmented Reality (AR): AR superimposes a computer-generated image on a user's view of the real world, resulting in a composite view. AR is not entirely immersive, but it is related to a virtual world. Instead, it adds simulated or digital content to a user's current environment.
• Virtual Reality (VR): VR is a truly immersive experience that swaps the user's real-world environment for a simulated one. VR headsets provide a 3D stereoscopic view to the user, while motion sensors track their head movements to give them a sense of being present in the virtual world.

The entertainment and media industry's revenue recognition and generation are complex and vary depending on the business type and products or services offered. Despite this, there are certain general principles that apply to all companies in this industry.

• The fair value of the consideration received or receivable should be used to measure revenue when it is earned.
• Subscription, transaction, advertising, and licensing are all revenue models that are commonly used.
• The company's revenue recognition process is tested by internal auditors to ensure that revenue is recognized and generated in accordance with these principles and models.

Here are some specific areas that internal auditors should focus on when auditing revenue recognition and generation in the entertainment and media industry:

• Subscription Revenue: Internal auditors should review the company's subscription revenue recognition policies and procedures to ensure that they are compliant with accounting standards. They should also test the company's system for tracking and recording subscription revenue.
• Transitions to New Standards: If the media company has recently adopted Accounting Standards Codification (ASC) 606 or International Financial Reporting Standards (IFRS) 15, internal audits may focus on the transition process, including evaluation of contracts under the new standards and the impact on financial statements.
• Advertising Revenue: Internal auditors should review the company's advertising revenue recognition policies and procedures to ensure that they are compliant with accounting standards. They should also test the company's system for tracking and recording advertising revenue.
• Rights and Royalties: Media companies pay high royalties to content creators and licensors. Internal auditors should focus on accurate tracking and payment of royalties and the corresponding recognition of revenue.
• Licensing Revenue: Internal auditors should review the company's licensing revenue recognition policies and procedures to ensure that they are compliant with accounting standards. They should also test the company's system for tracking and recording licensing revenue.

Consumers are increasingly turning to media consumption, viewing content on multiple devices and requesting personalized, on-demand content. Media companies are adapting by investing in new technologies and strategies to deliver content to consumers at the right place, time, and in the desired manner.

Media companies can transform customer-focused processes, policies, and initiatives by conducting internal audits to create superior digital experiences, improve processes, and realize value from customers. The business can stay on strategy, measure progress, and ensure accountability with the involvement of internal audit.

Primary focus while auditing customer feedbacks are as follow:

• Comparing customer service processes, policies, and tools to the best practices in the industry.
• Examining the organization's use of data analytics and social media monitoring to anticipate and respond to customer behavior.
• Identifying threats and opportunities in the organization's digital strategy.
• Examining different aspects of the information technology platforms that support digital build outs, such as pre- and post-implementation reviews.

Internal audit in the Entertainment Industry or Media Industry plays a vital role in helping media companies to unlock value. By focusing on customer experience, relevance to customers, regulatory compliance, and other key areas, internal auditors can help media companies to improve their performance, reduce risks, and achieve their strategic goals. In conclusion, internal auditors should ensure the industry’s financial integrity, regulatory compliance and protection of intellectual property.