Long a staple of internal audit, data analytics is no longer a nice-to-have, but a requirement. Internal auditors now have the ability to gain insights from, and test correlations with, a vast array of information on the Internet, which can be as diverse as competitor information, regulatory filings, and conversations on social media. Data analytics provide internal auditors with the potential to deliver oversight, insight, and foresight.
Analytics can help auditors examine the audit entity from a data-driven perspective (what does the data reveal about the audit entity?), drive understanding of the risks (what is happening?), and generate insight (why is it happening?). It also provides auditors with the ability to perform prescriptive analytics to develop recommendations to address issues, as well as predictive tools to look at what will happen and help to prepare for it. And yet, study after study has shown that the data analytics capabilities of internal audit functions consistently fall below what is desired and even what is required.
The implementation and improvement of data analytics are the most significant challenges for audit departments. Fifty-two percent of respondents identify the advancement of their data analytics capabilities as a high or very high priority for 2015, while an additional 35 percent rate it as a moderate priority, according to the Corporate Executive Board Audit Leadership Council’s 2015 Audit Department Challenges and Priorities.
The key to ensuring that data analytics has the best chance of success lies in managing the people, processes, and technology aspects of the initiative. The three are integral to any effort to develop data analytics and must be considered both separately and as a whole.
When it comes to people, there are several questions to address. Should each audit team be responsible for developing its own analytics capabilities or should there be a data analytics function that supports the audit teams? Can the department afford to have one or more people dedicated to data analytics, particularly if it’s a small internal audit function? Audit functions seeking to develop an analytics capability have a better chance of success if they create a separate analytics function, even if it is one person who has responsibility to support the audit teams in the analysis requirements. Support includes identifying data sources, obtaining and verifying the integrity of the required data, and assisting in performing the analysis. As audit functions move along the data analytics maturity curve, audit teams can take more responsibility for data analysis, and the analytics function will shift to providing complex analysis and verifying the integrity of the analysis performed by the audit teams.
|IT Skills Needed in an Analytics Function|
In addition to internal auditing, critical thinking, problem solving, and business acumen, the analytics function should have other IT skills:
- Understanding of data concepts (data elements, record types, database types, and data file formats).
- Understanding of logical and physical database structures.
- The ability to communicate effectively with IT and related functions to achieve efficient data acquisition and analysis.
- Ability to perform ad hoc data analysis as required to meet specific audit objectives.
- Ability to design, build, and maintain well-documented, ongoing automated data analysis routines.
- Ability to provide consultative assistance to others who are involved in applying analytics.
With this approach, the next question should address the level and experience of the person that should be part of the analytics function. A related question is: Should an auditor be taught programming (data extraction and analysis) or should a programmer be taught to audit? Failures in this area have one thing in common — management did not assign the right person or people to the task. “The greatest success is usually achieved when there is a specialized analytics function with responsibilities dealing with the technical aspects of the audit analytics process,” says John Verver, global director of analytics strategy at Denver-based High Water Advisors. Too often, a junior programmer with limited or no audit experience — addressing only the IT aspects of the job — is assigned to develop the analytics function. Given the nature of the task — dealing with business process owners, system programmers, and audit team leaders — the analytics function must be staffed at the appropriate level and with the necessary experience. The biggest hurdle is having the business process knowledge to identify the types of analytics to run. According to David Cotton, chairman of Cotton & Co., an audit and accounting firm in Alexandria, Va., there are basically two skills necessary to execute analytics: 1) business knowledge to define what analyses should be run and to be able to follow up on results; and 2) the technical skill set to obtain, cleanse, massage, and produce analysis results from the data. (See “IT Skills Needed in an Analytics Function” at right).
The size of the analytics function will depend on the size of the audit function overall, as well as the analyses to be performed and the types of technical expertise and experience that are available in the audit organization. If responsibility is assigned to a single person, he or she must be, at a minimum, the equivalent of audit team leader level and must have data extraction and analysis and audit experience. This will mean hiring someone with the required skills if they do not exist in-house. As the use of data analytics increases, the analytics function can grow, adding junior levels, a career path, and mobility to the function.
The analytics function will offer a single point of contact for all technology-related requests and ensure that requests from management and team members are addressed timely. Members of this group must be visible to all auditors and knowledgeable of, and responsive to, their specific needs. At the same time, the analytics function must be proactive in recognizing opportunities for the application of data analysis and in marketing existing and new applications of technology. A common pitfall is restricting analysis to the traditional audit box. “Data analytics can be used for more than simple sampling or the audit of financial statement amounts,” says Chris Pembrook, senior manager at Crawford & Associates in Oklahoma City. “It can be implemented into operational programs, grants and contributions, compliance, fraud prevention and detection, and other areas, as well.”
For example, in an audit of the readiness of a U.S. Army unit for deployment on a combat mission, an audit program included interviews with soldiers and commanders at various levels to ask about readiness. The analytics specialist suggested using data analysis to determine whether all the troops had received the necessary training (e.g., nuclear biological warfare and hand-to-hand combat), if all the necessary equipment (e.g., tanks and personnel carriers) was operational, and if the unit had the full complement of soldiers at all levels and occupations (e.g., private, sergeant, demolitions experts, mechanics, and combat forces). The results provided the team leader with questions that focused on the gaps in the unit’s capabilities and produced more relevant audit results than simply asking if the unit was ready.
Data analytics needs to be fully integrated into the internal audit process. Ensuring that data analytics are embedded in the audit process will require support from all levels, starting with the CAE. Management will have to reinforce the use of analytics, the data analytics function will have to market its services, team leaders will have to be challenged by management, and team members will have to employ analytics. The CAE should establish goals for the implementation and use of data analytics, and these should be communicated to the entire audit team. It should be clear that data analytics will support the audit planning processes (examining the controls, risks, and business processes), the audit phase (testing controls, drilling down into the risks, and assessing the effectiveness of the business process), and the reporting phase. Cotton adds, “Identifying business processes, IT systems, data sources, and potential analytics should be discussed and considered not only during planning, but also throughout the engagement.”
“Key in obtaining buy-in is to include auditors in identifying areas or tests that the analytics group will assist in developing for the audit,” says Pembrook. Initially, it will be important to highlight success stories and educate managers and team leaders about what is possible. Improving on the traditional audit approach of sampling, auditors can benefit from the implementation of data analytics to allow for more precise identification of control deficiencies, noncompliance with policies and procedures, and areas of high risk. Pembrook says these same analytics could then be used to ensure appropriate management follow-up has occurred by elevating the identified deficiencies or implementing continuous auditing procedures in areas of higher risk.
While analytics can produce significant benefits, the inappropriate introduction of technology can also have serious negative consequences. In many audit organizations, credibility is a valued, but fragile, commodity. Internal audit must continually demonstrate the value and utility of its work by producing high-quality, timely audits in areas of high risk. The incorrect use of technology and data analysis could produce erroneous conclusions and damage the credibility of the audit organization with its clients. It also could make any subsequent attempt to use analytics more difficult.
The successful use of technology-enabled audit tools and techniques can enhance the credibility of the audit organization and provide an improved level of service. For example, with data analytics, internal audit can consider not only control weaknesses, but also opportunities to streamline business processes, maximize the organization’s use of technology, and focus senior management on the areas of highest risk. Thus, rather than simply confirming that physical inventory levels match what is recorded in the system, inventory audits also should examine the efficiency of the inventory management system and the adequacy of the IT controls. One such inventory audit identified a failure to configure automatic reorder functionality that resulted in inventory clerks having to manually process reorder requests. It also identified obsolete inventory that was taking up valuable warehouse space and causing delays in getting parts to equipment that needed critical repairs. Finally, it identified economic reorder quantities that had not been updated to reflect current usage and purchase requirements.
Recommendations included the enhancement of the system’s reporting capabilities to support the identification and removal of obsolete inventory, and the reconfiguring of economic reorder quantities and automatic reordering functionality, which resulted in significant improvements to the inventory management system. Rather than simply counting and confirming the number of items in inventory, the inclusion of IT audit objectives resulted in recommendations that reduced storage requirements and inventory management costs that improved the management of information to support decision-making. This, in turn, contributed to increased efficiencies in the inventory systems. The audit saved the organization hundreds of millions of dollars and was more valuable than an audit telling management that 14 widgets were missing.
The most important questions surrounding technology are whether audit software should be purchased and what the cost will be. To answer these questions, internal audit needs to understand what analytics are already in place before embarking on efforts to develop its own analysis routines. “The existence of data warehouses and business intelligence (BI) tools should be investigated before deciding whether to invest in independent analytics,” says Norman Marks, a San Jose, Calif.-based former CAE at major global corporations and InternalAuditor.org blogger. The organization may already be producing reports that can be adapted for audit use. Auditors should obtain read-only access to application systems and the ability to run standard reports and access and use data warehouse and BI tools. If additional analytical capabilities are required, Microsoft Excel and Access can be useful in some circumstances, though with some limitations (such as the absence of an audit log and the inability to access certain types of files).
“As analytics become an integral part of the audit process and more complex, the need for a more robust software package to support data analytics increases,” Cotton explains. In practice, the use of specialized audit analysis software has distinct advantages — particularly in terms of logging, repeatability of tests and efficient test design, working with large data sets, and dealing with complex data manipulation. Verver adds, “The cost of audit software is usually significantly less than the investment in resources and skills required for a successful audit analytics program.” Management needs to put this in perspective and be willing to invest in the initiative.
“Any analytics initiative must quickly demonstrate a return on investment (ROI),” Marks says. Therefore, management should start with a targeted, ad hoc analytics program that will yield immediate benefits in terms of acceptance, ROI, and the development of the analytics function. At the same time, it should be clear that the initial steps are not sufficient for a robust analytics capability and that a strategy will need to be developed to improve and deploy analytic capabilities across the organization. The CAE should ensure that there is a plan to take action and measure results accurately. The organization, systems, and processes that support the analysis of the data must be able to take action with the insights that are generated.
Organizations should not expect that an individual with strong data analysis skills, armed with software and some training, will be able to drive a successful audit analytics program on his or her own. “Sustainable success in the use of audit analytics also requires leadership, strategic and tactical goal setting, audit process knowledge, team coordination, integration, and good project management,” Verver adds. The skills required to remain effective in an increasingly technologically complex world must be developed, nurtured, and supported. In addition, to efficiently and effectively implement and use data analysis by all auditors with a variety of computer skills, the organization needs to develop a standard, user-friendly, integrated environment; provide specialized training and IT support; and provide ongoing encouragement.
Effective analytics requires an initial investment of time and a commitment to follow up on results. Early analytics may produce a large volume of results — including false positives — and will need to be honed and evaluated to ensure results are manageable, reliable, and can be followed up on. Because analytics take time to implement and be fully effective, Cotton says the “CAE must manage expectations of senior management as well as the internal audit function and ensure that responsibility for analytics is assigned to a champion.”
The question should not be “Should we embark on developing analytic capabilities?” but “How soon can we start?” Adequately addressing the people, process, and technology aspects of the initiative will increase the likelihood of success.