Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​The Data Analytics Strategy

Adding analytics to the audit methodology requires careful change management.

Stefan Davis, Product Owner, TeamMate Analytics, Wolters Kluwer
Sergiu Cernautan, Director, GRC Strategy, ACL

Comments Views

​What are the key components of an effective data analytics strategy?

CERNAUTAN Successful data analytics strategies should start by building an internal business case, as these programs often lose momentum and fail if their value is not appropriately "sold" within the organization. Next, address the knowledge and skill gaps by allocating funding to resource and train the audit teams. When it comes time to buy, invest in modern technologies that are easy to use and implement. For maximum impact, integrate data analytics requirements into the audit methodology. Make the use of analytics required rather than optional. Aim for quick wins that will naturally progress to larger successes by phasing the program in with an agile methodology. By focusing on automating routine audit areas, teams can self-fund the program through efficiency gains and demonstrated return on investment.

DAVIS The key component for developing an effective data analytics strategy involves changing the way you think about your work. Start with defining the objectives you are trying to achieve either for your audit team or your audit cycle. Then plan and execute a vision for using data analytics to achieve your objectives. You'll need strong support from senior management and buy-in from the audit staff to gain efficiencies in meeting your objectives. Tools that are easy to use, train on, and deploy will lead to quick wins and help with buy-in and boost the data analytics strategy momentum for more advanced analytical strategies down the road. An analytics lead or champion should be responsible for executing the strategy. To track progress, set targets and monitor key performance indicators such as the percentage of audits performing at least one analytics test.

What do CAEs need to know before jumping in?

DAVIS Changing from traditional audit techniques to incorporating analytics is not always an easy exercise. Including analytics is a significant change in methodology, especially for experienced auditors, and it requires careful change management. The chief audit executive (CAE) needs to set expectations for the analytics effort, making it clear to the auditors that analytics is a priority for the department to gain efficiencies in meeting audit and department objectives. Knowing when to apply analytics and identifying opportunities for efficiency gains with analytics are critical to implementing a strategy.

CERNAUTAN Over the past 20 years, the CAEs I've worked with who struggle to implement a successful analytics program all cite at least one of three factors: 1) difficulty in accessing data; 2) lack of data analytics skills; and 3) the high costs to implement. This may have been true years ago, but in today's world it is simply not the case: Data is easier to access; analytic tools are powerful, flexible, and easy to use; and the cost of not implementing vastly outweighs the cost to implement. To remain relevant, internal audit must adopt analytics literacy as a basic requirement. In today's world of big data, social media, and increasing risk velocity, it is impossible to fulfill the internal audit mandates of "adding value and improving an organization's operations" and "improving the effectiveness of risk management, control, and governance processes" using antiquated manual audit processes that focus solely on post-detection techniques.

How can data analytics be leveraged to strengthen risk assessments and the audit plan?

CERNAUTAN The greatest risk is the unknown. Integrating analytics into risk assessments confirms the completeness of identified risks, and assumptions made about them, while illuminating potential gaps. By applying data analytics to support your risk assessments, the resulting audit plans will be better informed and developed from objective measures rather than subjective ones, which are prone to error. Forrester analyst Nick Hayes puts it this way: "Your assumptions about risk are deeply flawed without analysis of actual transactional data."

DAVIS In the past, analytics have been primarily focused on fieldwork, but they can add huge value to risk assessment and planning. In audit planning, data analytics allow audit departments to gather company, industry, and prior audit results to help drive the audit plan. Visualization and summarization, along with regression and trend analysis, can highlight changing and emerging risks as well as issues to target and explain current and future audit coverage.

How can data analytics be leveraged to strengthen individual audit engagements?

DAVIS Starting with engagement planning, auditors should consider opportunities to incorporate data analytics. If an audit is repeated, revisit audit programs to see where analytics will add value, rather than repeating manual tests. Getting data relevant to the audit objectives before fieldwork begins will allow preliminary analytics to identify risks that may influence audit scope. In fieldwork, data analytics will strengthen an audit through the ability to analyze complete data sets, rather than sampling. Complete testing leads to deeper insights into processes and procedures. Testing every instance of a control provides more robust audit evidence and increased coverage provides greater assurance. When reporting issues, deeper insights can be supported by tangible, measurable valuations. Rather than saying "we tested 30 purchases and found two without authorized purchase orders," analytics allows you to say "we tested the full population of purchasing transactions, and found $84,234 in purchases with unauthorized purchase orders." When they can see the dollars involved, management has a reason to follow or correct a control.

CERNAUTAN One cannot truly achieve a risk-based audit approach and add value without being data driven throughout. From the initial risk assessment, to scoping and planning, to executing fieldwork, to raising issues, and all the way to preparing the final audit report — the nature, timing, and extent of procedures to be performed are largely driven by the magnitude of the risks. What better way to quantify the risks, rationalize your audit effort, and support your results with evidence than by analyzing actual data?

What's more, executives constantly ask "so what?" to challenge the value of audit findings. Transform that response by supporting findings with objectively quantifiable data and key performance metrics. Consider a process recommendation to "take advantage of procurement discounts by accelerating net payment terms," subjectively rated as high impact. Consider the same recommendation, objectively supported by data. "If we had taken advantage of the procurement discounts offered over the last year, we could have avoided $10 million in costs." Which is more compelling and relevant to the organization?

How can auditors use data visualization to communicate audit results?

CERNAUTAN To be effective, visualizations must be social, interactive, and actionable. In an increasingly technological and social world, auditors can communicate visualizations more effectively using social media tools such as virtual storyboards. Incorporating elements of interaction further increases stakeholder engagement by allowing recipients to pull relevant information and trigger responses or actions based on what they see.

DAVIS Presenting data visually makes it easier to digest. You need to start with the message that you are trying to communicate, which in the case of audit results can be complex. Through the use of visualization, you can communicate a single message and answer detailed questions in a single image. For example, you can show the highest risk category over the last year by location from one visual as opposed to reviewing pages of detail. Visualizations do not need to be complicated. The key is to keep it simple with line charts showing trends over time and bar charts for non-time-based information.

Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Ia Online StaffIa Online Staff<p>Written by <em>Internal Auditor </em>magazine staff.</p>


Comment on this article

comments powered by Disqus
  • AuditBoard-January-2022-Premium-1
  • CIA-January-2022-Premium-2
  • 2022-GAM-January-2022-Premium-3



Stopwatch Auditing Auditing
Thanks, We Already Know That, We Already Know That
Remember the 98 Account the 98 Account
Hidden Goals Goals