What is the state of the art in data analytics?
Makhijani In today’s data-driven world, analytics refers to a range of data analysis, automation, and business intelligence capabilities. The future is audit intelligence — leveraging these capabilities to continuously monitor organizational risk and drive an integrated risk-first, data-centric approach to audit. Analytics enable audit departments to provide real-time assurance, address relevant risks, and provide better insights and increased value to the entire organization.
Stohr In simplest terms, state of the art is the ability to combine data from multiple internal sources and multiple external sources to better inform audit planning, real-time execution, and audit reporting. For example, it is the ability to combine financial performance data and strategic metrics, organized by audit entity, with relevant external inputs such as regulatory enforcement actions and applicable global news to better prepare the audit risk assessment, prioritize audit resources, or report finding priorities in the areas that may experience emerging risks. Traditional audit tools provide plenty of support for the underlying audit execution processes. The new generation of technology is providing additional value by allowing audit teams to combine a wide range of internal and external data, including artificial intelligence (AI) driven content, to provide better insights to inform decision-making throughout the audit cycle. These new technologies help audit leaders think more broadly about the company and offer a deeper level of insight into factors that may affect business performance.
What’s driving the use of analytics?
Stohr For most audit teams, the driver is always managing cost while demonstrably increasing internal audit’s value perception. Internal audit can leverage new data analytics to better focus its findings on helping the business understand emerging risks to business objectives and proactively help business partners understand actions they can take. This is critical, as today most organizations are forced to rethink every aspect of their daily operations in response to the COVID-19 pandemic.
Curiosity is a close second. Nearly every audit leader understands the potential value hidden in the massive amounts of data available. Emerging technologies such as machine learning and natural language processing can help internal audit harvest data in unique and informative ways.
Makhijani Success in today’s data-driven environment is nearly impossible without having a central system to maintain the risks, controls, deficiencies, and audit engagements the department is responsible for. A number of pressures are at play. There is an expectation that internal audit is operating like a modern business unit and can reliably report on department performance to executive leadership and the audit committee. Industry pressure is leading audit departments to break silos and prioritize data sharing across the three lines of defense. Today’s economic environment multiplies the pressure to improve efficiency and effectiveness of audit programs. To stay competitive, businesses need reliable data to react to emerging risks. Lastly, the new normal is a remote-first and often global workforce that requires a system in which audit teams can effectively operate from anywhere in the world.
What are internal audit functions at the mature level doing well?
Makhijani At a higher level of maturity, internal audit has successfully integrated data with its counterparts in risk management and compliance. It is now focused on integrating its data with key systems and data across the organization. Ultimately, internal audit is seeking two outcomes: 1) increased performance and ability to be strategic by leveraging cross-functional data, and 2) the ability to drive broader organizational value by sharing audit insights with the business.
Stohr These audit functions are creating and articulating a strong vision and road map for how audit will leverage technology and data to better inform and improve business performance. They are incorporating operating and emerging risk perspectives in audit risk assessment and planning. They are monitoring business performance and adjusting audit execution as needed. They are leveraging better data integration and analytics to improve coordination with second line functions. And, they are adjusting their talent acquisition and development to support their technology-enabled vision.
How does internal audit move its analytics capabilities to a higher level?
Stohr Once a technology-enabled internal audit vision is established, the first step is identifying an audit technology that is capable of integrating data and content from many sources and presenting that data in informative and context-sensitive ways throughout the audit process. The next step is identifying the questions internal audit would like to answer at each step of the audit process. For example, during audit planning internal audit may want to know which areas of the business have traditionally produced a high number of findings compared with areas seeing an uptick in regulatory activity. With the key questions in mind, internal audit can begin identifying sources of data. In this example, internal audit needs to mine audit history by audit entity and overlay it with emerging regulatory risk data. With a prioritized set of questions and associated data sources, the audit team can begin incrementally incorporating the new analytics in its audit processes and reports. The goal should be to evolve the data sets and analytics over time.
Makhijani Embedding data analytics into the organization’s culture in a way that positively impacts the organization and affects how decisions are made is an ongoing evolution that often takes years. It’s important to take a layered, incremental approach. Internal audit should start with where its audit data is, and build from there. If the audit team hasn’t digitized its internal audit program yet, it should start by unifying its data in a central audit management system, ideally one that can be integrated with other departments to pull insights to improve the program as well as the business. Another approach is to look at what the organization is already using for analytics and find an audit solution that can integrate with those solutions. Once internal audit has a system for its audit, risk, and compliance data, it should begin thinking about where else in the organization it can pull data from to target more important risk areas or key controls. What’s important is looking for solutions that can grow with internal audit.
How can analytics help internal audit during the current crisis?
Makhijani Without a modern audit management system in place, operating effectively during the crisis can be a nightmare. Centralizing data in an intuitive system that the entire organization can rely on is key to department continuity and success. Then, internal audit can effectively leverage analytics to monitor key business processes and risks. This type of continuous monitoring can enable internal audit to surface problems arising from a rapidly changing environment, enabling the business to stay ahead of the curve.
Stohr While the current crisis has created turmoil and disruption for nearly every business, it has also created a tremendous opportunity for businesses to rethink their current perceptions of what is required to make the business run. An audit group we work with helped its business partner identify 22 productivity factors for which it had reliable data available before the pandemic. The concern was by forcing employees to work from home productivity would fall off. After six weeks they checked the productivity factors again and were shocked to find that not only was productivity sustained, but nearly every factor it measured had actually increased. As a result of the analytics the chief audit executive provided, the decision was made to permanently close half of the 120 office locations globally and reinvest the savings into technologies to better enable and connect the distributed workforce. Further, initiatives were launched to change the nature of hiring practices to expand talent acquisition into regions where the organization had not previously looked for talent. In this case, the audit analytics helped the business embrace and harvest the change to achieve a positive outcome.