Demand for internal audit to incorporate data analytics into its work is growing, especially for departments that already are more expert, according to Protiviti Inc.'s 2017 Internal Audit Capabilities and Needs Survey of 906 internal audit professionals. Internal audit functions that have made analytics part of their audit processes are seeing real value, the survey report notes. On a 10-point scale, those respondents rate the value of analytics at 6.9.
"As recognition of these benefits grows, we expect to see chief audit executives work with management and the board of directors to make further investments to increase their data analytics capabilities, in terms of both tools and skill sets, as the practice of internal auditing shifts increasingly to analytics and continuous auditing and monitoring," says Brian Christensen, executive vice president, global internal audit and advisory for Protiviti.
Most respondents' departments have set out on the road to that future — some are going nowhere fast. Two-thirds of respondents say their department has made data analytics part of its audit process. Among the internal audit functions that haven't done so, 21 percent plan to incorporate analytics into the audit process within the next year, while 43 percent plan to within the next two years. Other audit departments (36 percent) don't plan to add analytics to their processes.
In terms of maturity, 40 percent say their department is at the initial, ad-hoc stage of developing their analytics capabilities, while 34 percent say they have documented analytics processes sufficiently to make the steps repeatable. That leaves 26 percent of departments that have at least made analytics a defined business practice or have reached the managed and optimized stages.
Overall, 42 percent of respondents report that their department uses analytics on 25 percent or fewer of its audits. Another 26 percent say their department uses it on up to half of its audits.
"It can be overwhelming for organizations just getting started with using data analytics," Christensen says, citing issues such as budget constraints and the need to establish processes and train auditors. "Companies just need to pick a starting point and get the help they need so that, over time, they can truly optimize their internal audit functions."
Departments that have reached the managed and optimized stages of maturity have seen a greater payoff from analytics. Thirty-eight percent of those departments use analytics on more than 75 percent of audits. That pushes the value of analytics up to 8.1 on a 10-point scale.
Accessing data is one of the biggest challenges organizations face in developing their analytics capabilities. Common problems include identifying where data is stored, system constraints, and coordination with the IT function. Furthermore, less than one-fourth of respondents say the quality of data for analytics is very good or excellent.
One solution to data access and quality problems is for internal audit to maintain its own warehouse of organizational data, similar to one established by internal auditors at the Canada Revenue Agency (see
"The Data Museum"). Twenty-eight percent of departments using analytics have a dedicated data repository, but 55 percent of the managed or optimized audit functions have one.
One bright spot for audit functions with more advanced analytics capabilities is that 62 percent are practicing continuous auditing, long touted as a principal benefit of analytics. Continuous auditing enables those departments to monitor areas with known risk issues, data related to controls in scope for compliance initiatives, fraud risk indicators, and key performance indicators in operational processes.
Progressing to such a stage will take a long-term strategy, the survey report advises. It outlines action items for internal audit functions, including:
- Looking for opportunities to expand the department's knowledge of data analytics capabilities.
- Conducting modest demonstrations of analytics capabilities in the early stages of development.
- Establishing a champion to lead analytics efforts.
- Expanding internal audit's access to quality data and identifying internal and external data sources.
Moreover, it recommends that internal audit functions devise ways to measure the progress of their data analytics efforts and report that to stakeholders.