Even internal auditors at a giant software firm like Microsoft have to get the basics right to make the most of data analytics. It takes a strategic plan, skilled resources, management support, and access to clients' data. "It took time and a sustained strategy to build up our data analytics muscle," says Pooja Sund, director of Technology and Analytics for internal audit at Microsoft.
Microsoft's experience is indicative of the significant progress many internal audit departments are making in implementing data analytics into their work, according to a new survey. The most advanced audit functions are applying suites of automated analytics across multiple business processes, performing sophisticated analytics, and using data from broad sources, notes The Audit Analytics Institute's (AAI's) 2020 Survey on the State of Data Analytics Usage in Internal Audit (see "Survey Highlights," below right). AAI polled audit executives, directors, managers, and analytics specialists from about 70 organizations for the report.
These departments have specialists to deal with the complex aspects of data analysis and formal procedures to ensure the quality and sustainability of analytics use.
Moving Beyond the Basics
Increasingly, internal audit functions are moving beyond basic uses of analytics, such as testing all general ledger transactions for suspicious journal entries or examining purchase and payment transactions for duplicates. One example of more advanced analytics is in a payroll audit in which auditors compare data from network logins and use of physical access swipe cards to payroll records to identify nonexistent employees or fraudulent overtime payments.
One survey finding calls out the strong correlation between teams that have deployed data analytics successfully and how they addressed implementation issues such as needing structures and processes. The survey findings yield takeaways across eight topic areas.
Strategy and Objectives Six out of 10 audit teams have a clearly communicated audit analytics strategy, the survey finds. Nearly half have defined goals for analytics usage, and 68% of audit leaders are highly supportive of analytics. The takeaway for internal audit is that developing a formal, well-communicated audit analytics strategy, with specific goals and audit leadership's proactive support, is critical. For example, the strategy could be that for every audit, the department will evaluate the potential use of analytics, with a goal of integrating it into 40% of audits.
Implementation Planning and Program Management The survey notes that 57% of teams have an effective approach to planning and managing the use of audit analytics. Successful teams implement a well-managed and communicated analytics program. A program addresses practical information for achieving the strategy and objectives such as acquiring skills, working with IT, getting data, and setting standards and processes.
In The IIA’s 2018 North American Pulse of Internal Audit, 38% of respondents were not using data analytics, with 27% of these planning to do so. Two years later, the 2020 AAI survey shows the progress internal audit functions are making, including:
- 18% of audit teams have achieved a high level of maturity, using automated analytics across the organization, in cooperation with compliance and risk management functions.
- 26% rate their use of analytics as mature and well-managed.
- 26% are at an intermediate level.
- 18% occasionally use basic analytics.
- 12% do not use data analytics.
Integrating Analytics Into the Audit Process Analytics can support virtually all aspects of internal audit's process. Surveyed functions use analytics most in control testing (65%), substantive procedures (59%), and audit planning (48%). Successful integration into the audit process requires planning and review at the beginning and end of an audit. Internal audit needs a systematic process for determining whether and how it will apply analytics in each audit stage.
Dealing With Data Obtaining timely and accurate data is a big challenge for 62% of internal audit functions. Nearly half of teams access a central audit data store. Having staff members who are skilled at identifying data requirements and extracting data without relying on the IT function is essential. Internal audit also needs efficient, independent, and secure processes for obtaining and storing data.
Analytics Usage and Technical Resources Hiring people with appropriate skills and knowledge, developing the analytics skills of existing staff members, and acquiring resources such as analytics libraries are crucial to the long-term success of analytics programs. More than 60% of audit functions have staff members who are capable of performing and developing analytics to meet most audit objectives. About one-third use a central library to encapsulate analytics knowledge, including suites of analytics and documentation to support specific audit objectives in specific areas.
Automation, Repeatability, and Sustainability Four out of 10 say they expect analytics usage to be sustainable and repeatable. At least 31% have had problems with sustainability, and 38% are aware of the risks of over-relying on specialists. Automation, documentation, and use of appropriate software are important in achieving sustainable and repeatable analytics.
Quality Assurance, Standards, and Reliability About half of internal audit functions have formal standards for ensuring the integrity of analytics and data, as well as for developing, testing, and documenting analytics. Without appropriate standards, analytics results may not be reliable for audit purposes. Organizations that lack those standards may be placing undue confidence in the accuracy of analytics results.
Organizational Structure and Skills Development Nearly half of internal audit functions surveyed rely on specialists to perform complex aspects of data analytics and to support nontechnical auditors in basic use. Another 31% rely on specialists for all analytics tasks. Additionally, 53% have analytics training programs and include development of analytics skills in auditors' performance objectives.
How audit functions organize specialists and integrate them into audit processes depends on the department's size and resources. Most audit functions implement a "blended" model combining specialists and nonspecialists, which continuously spreads knowledge and skills throughout the team.
Strategy and Leadership Are Key
Successfully using data analytics is vital to transforming audit processes. While some internal audit functions are making progress, many are still in the early stages of the process. These departments will need to address the eight issues mentioned above to achieve maximum benefits and sustain data analytics in their audits. Fully integrating analytics into core audit processes takes time to achieve.
Some important steps to establish a strong analytics program include a realistic strategy, goals, a practical implementation plan, and processes for integrating analytics into the audit. Although analytics involve many technical issues and skills, ultimately internal audit's success will depend on good leadership and management.