Data continues to be captured and processed at phenomenal rates. In fact, Computer Sciences Corp. predicts that by 2020, data production will be 44 times greater than it was in 2009. With so much data being generated, there is a need to connect the dots and get meaningful information from it. An audit that is intuitive-based and uses a selection of random samples may not be that effective in the changing business landscape. With so many automated processes, the way internal audit departments conduct audits also needs to be automated.
An analytics-based approach to audit makes it possible to review large data sets and get meaningful insights into internal control processes, including probable vulnerabilities in meeting the overall assurance objectives. The use of analytics can increase audit efficiency and lead to a deeper understanding of the business, risk assessment, and real-time monitoring. Data analysis can be applied to areas such as audit planning, sample selection, risk assessment, control testing, and identifying red flags.
Data Types and Storage
Before embracing data analytics, it is important to understand the types of data being generated. The analytics methods and tools used will depend on the type of data and the manner in which the data is generated and stored.
Qualitative data is a categorical measurement expressed with a natural language description. In statistics, it is often used interchangeably with categorical data (e.g., favorite color = “blue” or height = “tall”). Data are classified as nominal if there is no natural order between the categories (e.g., eye color), or ordinal if an ordering exists (e.g., exam results).
Quantitative or numerical data are counts or measurements. The data are said to be discrete if the measurements are integers (e.g., number of people in a household) and continuous if the measurements can take on any value, usually within some range (e.g., weight). Quantities whose value differ from one observation to another are called variables (e.g., the height and shoe size of every person are different).
Generated data is stored in data warehouses in different formats. Structured data is information, usually displayed in columns and rows, that can easily be ordered and processed. This could be visualized as a perfectly organized filing cabinet where everything is identified, labeled, and easy to access. Unstructured data has no identifiable internal structure. Types of unstructured data include word processing files, PDF files, digital images, video, audio, and social media posts.
Data analytics is an analytical process by which insights are generated from operational, financial, and other forms of electronic data internal or external to the organization that communicates exceptions and outliers. Exceptions are deviations from any defined criteria internal or external to the organization. Outliers are considered any data or records that are inconsistent with the population to which it belongs. Analytics relies on the simultaneous application of statistics, computer programming, and operations research to quantify performance.
Data analytics tools and techniques assist in transforming and improving audit approaches in terms of providing insights, predicting outcome, optimizing sampling decisions, extending audit coverage, and highlighting key deficiencies. Analytics embeds data visualization to effectively communicate insight.
Analytics is not just about technology. It refers to the use of certain technologies, skill sets, and processes for the exploration, evaluation, and investigation of data generated during business operations (See “The Process of Data Analytics” at right).
Analytical techniques can be used for risk assessment and control testing in various areas. It is important to link the business understanding, processes, and regulations and co-relate them with the data available to identify exceptions or outliers. There are four types of analytical stages.
Descriptive analytics identifies events that occurred in the past, while diagnostic analytics looks for reasons past events occurred. Predictive analytics predicts future outcomes based on past events, and prescriptive analytics provides a feasible line of action. Auditors need to gradually move from identifying what went wrong to forecasting what may go wrong. The shift from descriptive to predictive and then to prescriptive analytics requires the application of business insights with analytical techniques supported by technology advancements.
Some of the numerous tools available for carrying out data analytics require coding or scripting and may not be as user-friendly compared to tools with an easy-to-use graphical user interface. Questions that can help determine which tool to invest in include: What problem needs to be solved? What are the net costs for learning a new tool? What are the other available tools and how do these relate to commonly used tools?
Changed Business Environment
Considering the ever-increasing nature of digitization, it is inevitable that internal auditors change their approach to executing audits. Traditional methods of vouching and verification may need to be reviewed to bring them in line with the changed business environment. Considering increased expectations from stakeholders and the need to look deeper into business transactions, embedding analytics in audit is unavoidable. The proliferation of new forms of data and evolving concepts of analytics-driven audits means internal auditors can gain deeper insights into the business.