Data analysis technology has enabled many audit teams to achieve success and return on investment. A large car rental company transformed audit processes and reportedly reduced traditional audit work by 10,000 hours annually by using automated analysis to test all revenue transactions on an ongoing basis. Additional tests identified nearly US$1 million a year in incorrect commission payments and multiple instances of payroll fraud that may not have been discovered through manual methods.
Data analytics has helped such organizations increase the productivity of the audit function and improve the quality and value of audit findings by giving auditors the ability to examine and test entire populations of transactions and balances that underlie an audit area. Because internal audit has access to processes and data from across the organization, data analysis often enables auditors to provide insights into risk, control, and performance issues that no other function can provide.
Realizing the Benefits
Despite data analytics’ benefits, most internal audit departments are still in the early stages of usage and are far from achieving their full potential. This often stems from a lack of understanding of what is involved in the audit analytics process. However, six success factors can help internal audit departments overcome obstacles and realize the benefits of analytics.
Strategy and Leadership Many internal audit departments fail to make progress in implementing audit analytics because they do not treat it as a strategic initiative, overall objectives are unclear, and the department lacks necessary resources. Defining the strategic objectives for audit analytics is a vital starting point. For example, The IIA’s Global Technology Audit Guides 3 and 16 discuss how combining responsibilities for continuous auditing and monitoring can enable internal audit and the organization to achieve the strategic goal of continuous assurance. Moreover, using data analysis to support both audit objectives and management’s maintenance of effective controls aligns closely with The IIA’s Three Lines of Defense in Effective Risk Management and Control model.
The CAE’s active support and involvement in an audit analytics implementation adds to its strategic importance and can help it deliver significant, sustainable benefits. The CAE should lead the effort by communicating the vision, strategy, and expectations.
Goals and Metrics Underlying the overall strategic objective, internal audit departments can establish specific objectives by prioritizing the expected benefits. Goals and metrics could include:
- Data analysis to be used on x percent of audits within a y-month time frame.
- Reduction in audit hours of x percent because of use of data analysis compared to the hours spent on the same audit using manual methods.
- Data analysis results in an x percent increase in positive feedback from audit client departments about value added by internal audit.
Establishing metrics and communicating progress helps align the audit team, provide a basis for managing the implementation process, and facilitate benchmarking with other organizations. It also can communicate value to senior management.
Planning and Project Management Audit analytics implementations often are undermined by poor management. As with any important technology-driven initiative, effective planning and project management are critical to success. A well-managed implementation program helps ensure the use of analytics is sustainable and not overly dependent on any one individual.
To achieve greater benefits, audit analytics needs to be integrated into the overall audit process. This means understanding at what point in the audit cycle different forms of audit analytics are best used. All members of the audit team should be aware of when and how audit analytics are to be used, together with their own role in the process. Audit analytics can be used in virtually every stage of the audit process, including audit planning and risk assessment, controls testing, substantive procedures, reporting and quantifying audit findings, and continuous auditing.
A Knowledgeable and Organized Team The success of implementing and maintaining an audit analytics program depends heavily on the extent of knowledge and skills available within the internal audit department and how the team is organized. Primary knowledge and skill requirements include:
- Data access and extraction.
- Design of analysis tests to meet specific audit objectives.
- Familiarity with using selected technologies.
- Understanding of the overall audit analytics process.
Training plans should reflect individual roles and related levels of knowledge. Those involved directly in data access and test development may require specialized training in specific software. Auditors performing simple analysis and tests may only require training in basic analysis concepts and introductory-level software usage. Managers and reviewers should be trained in audit analytics processes overall.
A variety of roles are involved throughout the analytics process, including data access specialist, data analysis specialist, and follow-up analyst to confirm any findings. Audit team leaders should understand how to best organize the different roles within their teams. In most audit departments, many of the roles may be combined in one or two individuals. In large departments, roles may be allocated across different team members, which allows for specialization and focus.
The Business Case for Resources Internal audit departments that achieve the most success in using analytics develop a business case to identify investment costs and expected benefits and to measure progress in achieving objectives. In compiling its case, the department should consider benefits such as reducing audit staff hours, increasing productivity, increasing the value of advisory findings for audit clients, and achieving cost savings or revenue gains. Potential costs include specialist resources and implementation assistance, software, training, and startup funds. The business case also can consider the effect of cost sharing with risk management, compliance, and other related functions.
Technology A wide range of data analysis software can be used to support audit analytics. Surveys indicate that more internal auditors use Microsoft Excel for analysis than any other software. However, specialized audit data analysis software is also popular, especially in organizations that are more advanced in using analytics. Other analysis technologies can play a role, although these products may not support all aspects of the audit analytics process.
Leadership Is Key
Simply acquiring software and sending a few people to a training course is not a recipe for success. Data analysis can help transform much of the audit process for the better, but it takes leadership, vision, commitment, and management execution to achieve sustainable benefits.