How can internal auditors identify opportunities for analytics use?
Petersen In today’s data-driven world, businesses face numerous challenges, from increased regulation and need for transparency to emerging risks from unexpected sources. Auditors should view analytics as an opportunity to reduce risk by aligning test plans with strategic audit goals and auditing larger populations. First, think about your audit objective. Can data help identify where risks exist and how to mitigate them? Second, consider the audit workflow. Look at controls, processes, and procedures for the areas you are auditing to surface ideas for analytics tests to perform. These are generally instituted to mitigate risks, so if they aren’t being followed or are being circumvented regularly, the business could be taking on additional risk.
Zitting Opportunities to use analytics exist throughout the audit plan. A simple example is anytime you’re using the traditional method to pick samples for audit testing, analytics can replace that sample test. Think about data first — not as an afterthought. And when you think in broader terms about providing insight and assurance through data, there’s always a data point to be had. For example, if auditing employee talent retention risk, run IT application use metrics to trend employee engagement. If auditing emerging competition threats, use natural language data from Twitter to understand public sentiment. And, if auditing IT system profile vulnerabilities, use correlation analytics to compare IT assets to public vulnerability databases.
How can improper use of analytics damage an internal audit?
Zitting Whether you work with advanced analytics or old-school spreadsheets, the danger is the same: drawing conclusions based on bad data. The good news is there’s a review and quality assurance process mandated by The IIA’s International Standards for the Professional Practice of Internal Auditing to prevent us from drawing those bad conclusions. In a digital business environment, those processes need to evolve — making sure we have adequate skills and technical knowledge throughout the team to ensure that effective analytical review and validation steps are taken. If you’re overly concerned about analytics damaging your audit, ask yourself if you are instead actually concerned about changing the way you’ve always done things. Or perhaps you’re not sure how to step into this new technology and approach.
Petersen When auditors document their findings they should use very specific language to describe the analytics performed and the results vs. any conclusions being drawn from those results. Damage to an audit can occur if conclusions are drawn based on the results of an improper set of tests run against an unreliable set of data. Establishing the scope and determining the validity of the data to be analyzed is critical to the success of the effort. While most analytics tests do not provide proof of any fraud or wrongdoing, analytic results obtained during fieldwork can provide clues about areas that may need further analysis. Also, just because the analytical tests that were performed found nothing of concern, this doesn’t always indicate there are no concerns in that area of the business.
How is analytics use changing with innovations such as artificial intelligence (AI)?
Petersen AI is in its infancy in the audit world, especially for internal auditors. AI and the various technologies it encompasses (machine learning, deep learning, robotic process automation, natural language processing, image recognition, pattern recognition) will become more ubiquitous over time. AI can become another tool auditors can leverage to enhance their process and improve the time it takes to share results and findings. Future versions of analytics tools will be able to recognize data patterns to identify risks that might not have otherwise been considered or to recognize data that suggests specific tests be performed. Introduction of AI should mean that repetitive work will be performed by machines, allowing auditors to spend more time performing critical analysis and raising the value of the output of audit organizations.
Zitting AI isn’t magic — it’s another tool in our toolbox, just like traditional rule-based audit analytics is a tool. AI can be used in countless applications, but finding how it can help gain assurance in areas where we don’t always know what to look for is key. Machine learning helps natural language processing (NLP) improve over time. Historically, if I looked at millions of payments to spot which were fraudulent or bribes, I’d have to know what to look for and create a set of rules to run those payments through, flagging violations. I might look for all payments made in high-risk countries where the description includes “donation,” resulting in thousands of hits, most of which would not be an issue. But AI and NLP review the same payments and look at everything — the description, vendor, date and time, amount — and tell me which are more likely to be bribes based on criteria I never even considered.
What are the risks of internal audit falling behind with analytics use?
Zitting The world is moving faster. Historically, you’d go out, do an audit, take six months, and report on it three months later. By the time your audit report is in front of management, it’s nine months later. While your findings at the time may have been totally legitimate, the risk landscape shifted, and the business moved on. The report is now irrelevant. To avoid falling behind, we need to fully embrace and use analytics to move faster and do more. Even if the business doesn’t shift its focus between the time you start and finish your audit, there’s a good chance you’ll report on things the business already knows. Because, while you were out doing your audit, someone ran the numbers and got the answers they needed through analytics. Machines do these jobs much faster than we do.
Petersen Today’s business environment requires auditors to keep up with the rapid pace of change. In the current data-driven world, organizations are demanding and embracing easier ways to digest and dissect information. Management expects a focus on facts and data-based analysis in all aspects of the business. The traditional practice of simply pulling random samples to support audit testing will soon be considered archaic and of little value. Analytics offers opportunities to identify additional risks throughout the course of an audit, expand the scope of testing, and provide strategic insights. Failing to take advantage of these opportunities will make it challenging to meet increased demands and stay ahead of the changing risk landscape.
How are auditors using analytics to demonstrate their value?
Petersen The ultimate objective of internal audit is not to find issues, but to help the business flourish. Traditionally, analytics are performed during fieldwork, and may include testing for duplicate transactions, performing a Benford’s test, or looking for other anomalies in the data. However, opportunities exist to consider how analytics can be beneficial in other stages of the audit process such as in scoping, planning, continuous auditing, reporting, or continuous risk assessment. Proactively using analytics to identify areas of focus can help streamline the audit process and apply limited resources to the most important issues. Analytics tools used by audit can be introduced to parts of the business to monitor data throughout the year and head off potential issues before the audit even starts.
Zitting First, by making audit outcomes quantifiable. Issue ratings of high, medium, and low are almost a thing of the past — they’re too subjective. Whereas issues that come out of analytical use have a number or value attached, be it monitory or otherwise. There’s a quantifiable nature to our outcomes that makes them more valuable. Next, by getting to insights faster. An audit team that uses analytics is a team with an instantly fast audit robot. By creating automation along the way, auditors can do more work with the same — or fewer — resources. And finally, by providing more assurance over time. Analytics means more coverage.