previous article in The Analytics Journey series discussed how each new test development can be thought of as a project and how a consistent project methodology can support the scaling, scope, and rotation of the program. Now that internal audit knows how to perform the projects, it must decide which projects to tackle first and which projects to save for later.
This decision — defining a roadmap for the program — requires internal audit to understand how small steps today allow for great leaps tomorrow. In other words, auditors must clearly understand what kind of insight could be expected from the first few runs in an area, and how — and why — that insight should improve over time.
Once defined, the analytics program roadmap reminds all stakeholders of which projects are live and which projects are coming soon. It details what this project mix means about the program's maturity and the kind of insight and value that the program will bring to the organization. In the analytics journey, if the
program intent serves as a compass, the roadmap charts the path.
Where Should Auditors Start?
It is clear that the internal audit analytics program must respond to the needs of the business. That said, the more aware auditors are of business needs, the more "shiny objects" (potential projects) they will see. Because of this, it is important for internal audit to know when to pursue those projects and when to let them go.
Although this decision will be tightly related to internal audit's program intent, there are some key factors that can help the department decide whether to take on or drop a new analytics project:
Organization chart. Is this function defined for the organization and clearly rolled up to a process owner and executive leadership? If a job function is important enough to have its own executive, then data is being created, and there is something valuable to the organization that can be monitored, audited, optimized, or improved by studying that data.
Money. Does this function generate or handle a significant portion of the organization's revenues or costs?
Personally identifiable information and company data. Does this function manage nonmonetary risks? Could a data leak originate from this function? Would this leak cost more than money?
Public. Does this function interact with the organization's clients? Could it affect the organization's standing in public opinion or its market?
Vendors, employees, and other business partners. Does this function interact with the organization's supply chain and resources needed to run the business? Could it affect the organization's ability to respond to client needs?
Volume of activity. How active is this function? Is this a data-rich environment?
Business process and controls. How complex is this function? Would it lend itself to standardization of processes, objectives, or outcomes, or is it usually a series of "one-off" activities? Would it have measurement points? What would auditors be trying to measure or predict?
Systems complexity. Are these functions supported by one system, manual interactions between systems, or automatic interactions between systems? The more hand-offs there are between systems, the more measurement points. However, those hand-offs create more abstract meaning between those readings and will require a larger team to obtain and interpret the data.
Recent work. Is this a well-established and well-understood function, or is it recent or continuously evolving? Do other analytics monitor it? Would the organization benefit more from going deeper into the function, or should internal audit be covering something else?
These factors relate to how easy or how valuable it would be to tackle a project on an area (see "Data Analytics Program Roadmap" below). By scoring potential projects on these factors, auditors can compare the cost and benefits of different projects in terms that may be relatable to stakeholders.
Projects With Future Potential
What about projects that would position the organization for a better future? Auditors should remember their training on net present value: The attractiveness of a project is defined by its expected impact (future value), the value of the team's patience (return rate), and the time it will take to get it.
For some internal audit departments, a series of quick wins may be more valuable than a large transformation that may be months away from happening. Other teams may reach different decisions. In the end, the balance between current and future needs will be governed by the analytics program's intent.
Internal auditors also must remember that the analytics program is continuously moving through the maturity curve. Specifically, simple insight today (data access and descriptive projects) can lead to deeper understanding and the ability to predict and prescribe actions in the future.
"Program Maturity, Value, and Capabilities Progression," below, illustrates this evolution of program capabilities. At a high level, the chart explains how auditors can aggregate
event-level transactions into
behaviors, which they can use later in combination with new features or characteristics to create
predictive profiles. Eventually, by understanding these predictive profiles, auditors can learn how to intervene (modify the profile) to obtain desired outcomes and even enable artificial intelligence to recommend — or make — the decision.
Is the Roadmap Working?
Internal audit can measure the effectiveness of the analytics program roadmap through the buy-in from audit clients. As the program becomes better known through consistently successful deployments, the audit function, audit clients, and management will start to have opinions about whether internal audit is looking at the right things and what its next project should be. Eventually, even with a method to allow for transferability and scalability, new project requests could arrive faster than internal audit can grow the program.
Above all, the program must respond to the needs of the business. By including a consistent approach to deciding what the next project will be, auditors will know, and be able to explain, why they are prioritizing specific projects. At the end, the roadmap will be the best way to ensure the program produces its intended value.