Internal audit departments still are not widely using data analytics and other technology tools that could massively impact the work auditors do and their value to organizations, according to recent reports on the profession.
These reports warn that failing to adopt such "foundational" tools may make internal audit obsolete and unprepared to address the opportunities and risks associated with technologies such as artificial intelligence (AI) and robotics. Internal audit's failure to use data analytics more extensively also may impact corporate strategy and competitiveness as company information is not being mined effectively to inform management decision-making.
Understanding where data resides and uncovering patterns and insights to enhance decision-making is increasingly critical to business success. Additionally, experts say the appropriate use of data and data analytics is equally important for internal audit's effectiveness and value to an organization.
Yet, reports such as The IIA Audit Executive Center's
2018 North American Pulse of Internal Audit describe many internal audit departments' use of data analytics as developing in maturity, at best. While nearly one in three of the survey's 636 respondents say they use simple analytics techniques extensively, few are automating routine tasks or adapting more advanced techniques.
Many internal audit departments are still struggling to develop a formal methodology for integrating data analytics, according to a survey of more than 1,500 chief audit executives by global consulting firm Protiviti. Moreover, audit functions are only using analytics tools as "point solutions" on a case-by-case basis, rather than as part of a broader initiative to leverage analytics throughout the audit process.
2018 Internal Audit Capabilities and Needs Survey notes that while two-thirds (66 percent) of internal audit functions that do not currently use data analytics plan to do so as part of the audit process within the next two years, one-third (34 percent) still have no plans to do so. For those departments that are implementing the technology, data analytics "allows internal audit to provide better and more detailed information to inform corporate strategy and for management to leverage business opportunities," says Brian Christensen, executive vice president, global internal audit at Protiviti.
One barrier to realizing these benefits is a lack of analytics knowledge and skills within the audit function. "CAEs need to focus on increasing the levels of education in their internal audit functions, and more specifically, to move from general plans and discussions about using analytics to actually advancing and integrating analytics, robotic process automation, and other digital initiatives into the audit plan," Christensen says. "Those who fail to integrate these initiatives risk becoming obsolete as their organizations continue to undergo digital transformation at an increasingly rapid pace."
Protiviti's research also finds that U.S. internal audit functions have been slower to adopt the technology than their counterparts in other parts of the world. Three-fourths (76 percent) of organizations in Europe and the Asia-Pacific region are using data analytics in the audit process more frequently, compared to only 63 percent from North America.
Evolving, Following, or Observing?
Results from PwC's latest
State of the Internal Audit Profession report deliver more pessimistic results. Just 18 percent of respondents say their internal audit function currently uses analytics for advanced testing procedures — 38 percent plan to do so within two years. Only 13 percent say internal audit uses analytics to identify risk and determine audit scope and planning, but 30 percent plan to do so within the next two years. A mere 10 percent say internal audit has adopted tools to help with analytic visualization, and 27 percent plan to do this by 2020.
CAEs are aware of the problem. Most internal audit leaders surveyed (56 percent) say they are concerned that lack of technology adoption will result in diminishing value for their organization.
In fact, PwC deemed only 14 percent of internal audit functions surveyed as "advanced" in their technology adoption. PwC refers to these functions as "evolvers" (as opposed to "followers," which adopt new technologies at a slower pace, and "observers," which are constrained by lack of budget and technical knowledge). More than 80 percent of evolvers are self-sufficient in their data extraction, and use tools and skills for enhanced productivity.
Furthermore, evolvers are more likely to invest in technology risk management and IT training than their peers. As a result, they are rated more valuable to their organization. For example, twice as many evolvers than their peers report that their organizations' risk management programs respond to innovation very effectively.
Evolvers are realizing direct value from their adoption of analytics. For instance, they rate high on focusing on their organizations' critical risks and on auditing emerging risks. And tech-savvy audit functions benefit in other ways, too. Nearly three-fourths of evolvers excel at recruiting and training the talent they need because they are seen to invest more resources in people and training, compared to 46 percent of followers and 29 percent of observers.
Lauren Massey, principal in PwC's internal audit, compliance, and risk management practice, says data analytics has been a topic of discussion in the profession for several decades, yet adoption continues to be slow. As a result, those internal audit departments that fail to take up analytics will be at a disadvantage as new technologies emerge. "If internal audit functions are unable to embrace the benefits that analytics has to offer, or cannot find the resources to train themselves in how to use it," she says, "there will be the constant challenge for internal audit to get up to speed with cutting-edge technologies like robotics and AI quickly."
Making Up Ground
Despite such warnings, it is not too late for internal audit functions to turn the situation around. Protiviti's report outlines several actions CAEs can take to improve their department's analytics capabilities.
For departments that are just beginning to use analytics, the easiest way to become familiar with the technology is to start in more familiar areas such as account reconciliations, journal entries, payables, fixed assets, payroll, human resources, and threshold/limit controls. "The internal audit function may find it easier to test data based on information it already knows," Christensen says.
CAEs also should find champions to lead and support the analytics effort. Protiviti notes that 59 percent of respondents agree that when internal audit shares detailed information about analytics with the audit committee, committee members also are highly interested in the use of audit analytics.
Other ways to increase the use of data analytics tools and techniques include embedding analytics as part of the audit process and expanding internal audit's access to quality data. Moreover, internal audit should find ways to measure and report to management and other stakeholders the successes directly associated with the technology's use.
"Internal audit groups that can successfully demonstrate tangible value will build a stronger business case for increased budgets and resources dedicated to a data analytics function, as well as underscore throughout the organization the importance of analytics and, in the process, boost internal audit's reputation internally," the Protiviti report says.