In today’s data-hungry world, an analytics-capable audit function is a necessity. However, relatively few audit teams have developed sophisticated analytics capabilities and an embedded, integrated approach to analytics. So how can internal audit functions initiate and advance their analytics capabilities? Internal audit functions that have successfully implemented sustainable analytics activities have not only been able to clearly visualize and articulate the value analytics can deliver to their functions and the broader business, but also have started to realize that value in enhanced efficiency, effectiveness, and risk awareness.
Along the way, many functions have experienced missteps and setbacks. The lessons they have learned should benefit internal audit departments embarking on their own analytics journeys or those attempting to overcome false starts of the past. Some of these hard-earned insights are what one might expect. Difficult access to enterprise data stores marks a widespread pitfall, as does insufficient planning. Other data analytics lessons will surprise the uninitiated. Investing in robust technical skills training and analytics tools implementation often can be a distraction to getting an analytics program off the ground. By knowing what to avoid, internal audit departments can keep a data analytics program on track to reach its full potential.
Tools for Success
When internal audit leaders commit to introducing or furthering a data analytics program, there are six strategies that can positively impact these initiatives.
1. Create awareness rather than a silo
Internal audit leaders should resist the inclination to start by creating a data analytics silo within the larger function. While dedicated analytics functions are present within many internal audit functions with advanced analytics capabilities, this structure should more appropriately be treated as a long-term goal or possible target state than an immediate to-do item when getting started.
While it is necessary to have the appropriate technical competence within the team, creating a silo structure from the start can reduce focus on a more important driver of success: data and analytics awareness. This mindset helps internal auditors understand how data is created, processed, and consumed as it flows throughout the organization, the key systems where it resides, and the key business processes and decisions that it supports. This understanding represents a business-centric view of analytics as opposed to a technology-only view, a critical distinction in developing the right kind of thinking among the internal audit team.
When an internal audit function decides to reassign a technical resource as the team’s analytics champion, problems often ensue. Creating this type of structure too soon can cause the rest of internal audit, as well as the business, to view audit analytics as a purely technical exercise as opposed to an integrated component of internal audit’s culture, strategy, and activities. Insight from analytics are the result of the intersection between business awareness and the application of analytics tools and methodologies. These are two sides of the same coin and both must be present for success.
Internal audit leaders also should reflect on how they source their analytics talent. While there is no one way to do this, leaders should recognize that hiring analytics professionals or repurposing technical resources can pose risks to the development of an analytics mindset throughout the entire internal audit team. It takes time to understand business processes and what valuable information can be gleaned from the systems and data that underpin them. Building a more pervasive analytics mindset across the internal audit department is critical. The most effective audit analytics programs operate in a tightly coordinated — if not seamless — manner with all other parts of the audit team. All members of the team think about the data that exists in the environment, its business relevance, and the stories it can tell. The analytics teams then layer in their view and capabilities.
Dedicated analytics functions and externally hired analytics experts are common hallmarks of top-performing analytics capabilities; however, neither of these elements should be used in place of the initial establishment of the right analytics mindset throughout the internal audit function.
2. Understand the data before investing in a tool
One of the most common start-up lessons involves resisting the desire to acquire the latest and greatest analytical tool. Given the impressive power, look, and feel of analytics tools, it’s difficult to not be sold on a new piece of software with the promise that, within hours, internal audit will be generating a flurry of queries and new intelligence insights.
Rather than a first step, however, implementing an analytics tool should be a more deliberate step in the rollout of an analytics program. A rush to start using these tools, without establishing a plan and set of initial, high-value use cases, often leads to results that lack business impact, which can be detrimental for a start-up analytics activity.
Before using a tool, internal auditors should carefully evaluate a high-value area to target, understand the data source, validate it, and identify how the results will be evaluated and shared. When it comes to analytics tools, it is helpful to adhere to the 80/20 rule: 80 percent of the analytics team’s work should consist of understanding the data, the business process it supports, and the activities and decision-making that it drives, along with the business value the analysis is designed to deliver; 20 percent of the effort should focus on the technical aspects of the analysis, including the audit tool.
3. Plan sufficiently
Too many analytics initiatives suffer from too little planning. Plunging into data analytics does not mean that internal audit functions should give short shrift to key planning considerations.
The most effective and sustainable analytics programs tend to begin with a planning effort that includes:
- Understanding the system and data landscape; how data is created, processed, and consumed; and how it drives business activities and decision-making.
- Educating internal auditors on the power, benefits, and applications of audit analytics (the analytics mindset).
- Laying out how analytical talent will be trained or hired and retained.
- Seeking business partners’ input on areas of their domains that might benefit from audit analytics.
- Carefully identifying which initial analytics are likely to yield the most valuable results — and, as a result, support from business partners.
Neglecting any one of these items can lead to initial results that are low impact or miss the mark entirely.
When educating internal audit team members about the use of data analytics, it is helpful to steer the focus away from the technical inner workings of the capability by presenting real examples that demonstrate how analytics enhance the efficiency, effectiveness, or risk awareness of the internal audit function and the broader organization (i.e., how data can be turned into information that provides risk and business insights).
4. Think big picture
The expansive reach of audit analytics has, oddly enough, resulted in narrow thinking about its application. For years, internal audit professionals and experts have marveled at the way analytics and continuous auditing techniques can be deployed to test massive populations of transactions. This capability is rightly trumpeted as a massive improvement over the traditional approach of manually sampling large data sets, often months after the associated activity has occurred, to identify problems. While accurate, this view of analytics is severely limited.
Leading internal audit functions now use analytics throughout the audit life cycle to support dynamic risk assessments; monitor trends, fraud, and risk and performance indicators, or deviations from acceptable performance levels; and model business outcomes. These functions tend to view analytics as a way to interpret data that helps tell a story to the business that may not have been told before. To be successful here, there has to be an acute understanding of the data that is created, processed, and consumed within — and across — the organization and how it is used to drive business activity and decision-making.
5. Partner with IT
Given that data typically exists in a multitude of different systems throughout organizations as well as within third-party (e.g., cloud) environments, internal audit frequently encounters difficulties when attempting to access data for analytics. This problem relates not only to accessibility (the protracted data request process with IT), but also to completeness, accuracy, and validity of the data. Without understanding the specifics of what they are asking for, internal auditors cannot reasonably expect to get what they need — at least, not the first time around. In some cases, lengthy and ineffective data request back-and-forth between internal audit and IT departments results in data integrity issues (at best, perhaps) or the planned analytic being canceled entirely.
To succeed, audit analytics teams need to partner with IT departments to develop a robust process for data acquisition — either through specific and easily understood data requests or through direct connections to data repositories. This all starts by understanding the data environment. While this marks a common goal, it takes time, effort, and coordination to get there. Auditors should consider discussing how to decide which data elements should be created and captured, the business rationale for doing so, and how internal audit and business partners will use the information that analytics produce.
Thanks to recent advancements, current analytical tools more easily integrate with other enterprise systems. Internal audit functions’ growing tendency to use dedicated data warehouses also helps address data access and quality challenges, which can reduce stress on business production systems by giving internal auditors their own sandbox to play with data. However, there are risks with this approach, particularly with regard to security and privacy. Ultimately, establishing a dedicated data warehouse requires a sound business case that, among other things, addresses these risks.
Other, less technical qualities and practices also come in handy. Internal audit functions that have earned a reputation for collaborating with the business consistently encounter fewer data management obstacles when deploying data analytics. Their success stems partly from the fact that collaborative internal auditors are more apt to learn about, and apply, data governance standards and practices from their IT colleagues, which can help ease access to quality data residing in systems scattered throughout the organization.
6. Take advantage of visualization tools for inspired reporting
A picture is worth a thousand words. The same principle applies to the presentation — or visualization — of the analytics results. Tabular formats and simple charts are a thing of the past. Analytics reporting packages should be making use of widely available visualization tools. These tools allow for the dynamic presentation of results (e.g., a country map that shows the top locations where purchase card spending occurs) and real time, drill-down capability that represents a far cry from the static analytics presentations of the past. Visually compelling, high-impact reports can help internal audit’s clients quickly draw insights from the data.
A Fundamental Shift
At present, data is being created and collected at a pace that is far beyond anything seen before. While there is always some risk in undertaking a new program — and a desire to prove the return on investment — the bigger risk is doing nothing. It is simply not an approach that internal audit functions can afford to take if they want to keep up with the business, stay relevant, and deliver value and insight. The most innovative companies are looking at ways to capture and use data to transform their business operations as part of digitalization initiatives. Internal audit must be equally innovative and embracing of the need and value to make the company’s data work for them.
A key method to overcome common time and resource constraints with setting up a discrete analytics group within internal audit is by focusing on an “analytics mindset.” Further, internal audit functions are encouraged to work with business partners to identify areas where analytics can have high impact and high value, provide real business insight, and help address business challenges (rather than focus on a return on investment calculation). The value delivered in these initial analytics projects will set the stage for the program. Internal audit should look for parts of the business that are particularly data dense, or that have high volumes of data processing but still rely heavily on manual procedures. For example, focus on ways to:
- Pull business insight from the data-heavy areas (and show management a story they have not seen before).
- Work with management to convert audit analytics into reports that can be used in place of time-intensive procedures (e.g., “real time” monitoring of large, disparate data sets for key fraud indicators).
- Quantify the impact of findings and deliver more insight through audit reports.
These are some of the ways that internal audit functions are able to quickly demonstrate and communicate value in their investment in, and use of, analytics. Ultimately, however, stakeholders must recognize that there is a fundamental shift in how business is being conducted, and as such auditors must match that with a fundamental shift in how they audit.
Each Journey is Unique
Establishing a robust analytics program may take several years to mature. The process for developing a data analytics capability tends to be unique for each internal audit function. Some standard general assessments exist and can help, but each internal audit leader should chart a path forward that reflects the unique qualities and needs of his or her function and the unique characteristics of the industry, the organization, and the team’s relationships with business partners.
For additional guidance, download GTAG: Understanding and Auditing Big Data.