Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​The Analytics Journey: The Good Analytic

A team of internal auditors and stakeholders is the final puzzle piece to a successful analytics program.

Comments Views

​The previous installment of "The Analytics Journey" discussed how to choose the right tools for internal audit's analytics program and how these may change throughout phases of the development project. Yet, the most important part of the analytics program is not the tools and technology. Instead, it is the people who use them to reach the program's intent.

Much as a scalpel will only produce the desired results in the hands of a trained surgeon, so analytic tools and techniques must be wielded by a team of auditors and stakeholders who are trained to develop and use them effectively to achieve "good analytics." A good analytic starts with the right question, shows what was found and why it matters, and signals how to act on the finding (see "What Makes Good Analytics?" below).

Good Analytics Start With the Right Question

It is not possible to ask the right question without having the right stakeholders in the team because the right question comes from having strong business acumen, specifically executive-level business acumen. Auditors should start assembling their project team by enlisting the process owner, or the individual who is ultimately responsible for the process that they are thinking about examining. This person will help auditors understand what questions would add value — the questions that the process owner wants answered about this area. In a sense, this process owner acts as the client of the new analytic project.

Interestingly, having the right business question may not be enough to answer it. Once internal auditors understand what they want answered, they need some more business acumen to figure out how it could be measured. New stakeholders are needed, this time a team member who can contribute operational business acumen from the process team that performs the work. With this individual's help, auditors can understand what is needed (data) and how (data processing) to find the answers for the process owner.


Knowing what auditors want is not the same as having it; in fact it usually is very far from it. The process team may know how the data is generated and where it is input on the "user side" of the business systems that support the process. However, it is unlikely it also will know how this data is stored — in the system tables, fields, etc. — and how to access it.

To understand this, auditors need a new team member or stakeholder: the IT person who supports that module within the business system. To find this person, you may ask the business team who it contacts when it needs to create new reports, change user interphase, grant or remove access, or make other changes in the business system.

Good Analytics Produce Valuable Findings

Once the core team is assembled and understands the question, internal audit is ready to process the data using its data analytics tools to generate answers. Sometimes these answers are summarized as exceptions, anomalies, or trends, but to be useful, these results must explicitly show what was found and why that matters. The reference or context that explains why the result matters comes from the team members/stakeholders — typically the process owner or process team.

Good Analytics Enable Responses or Actions

Once auditors process the data and have produced findings, the final ingredient they need for good analytics is the ability to understand how to act on what they find. At the very least, the analytic provides context/contact information for follow up — that is, "the high-performing region is sector 5, led by this person."

Although there is some business acumen involved at this stage, knowledge may not be enough. Auditors also must be able to influence the business into acting on this intelligence, such as by deciding to start a new audit or recommending direct process adjustments. The type of information needed for action and the influence to stimulate action will come from the team members/stakeholders.

Sidebar: The Analytics Journey

Click the links below to read previous installments of "The Analytics Journey" and look for more coverage of analytics by Francisco Aristiguieta and other practitioners in the On the Frontlines blog series on InternalAuditor.org.

"The Analytics Journey" — The road to implementing data analytics begins with defining the elements of a program.

"Finding the Right Direction" — A key step in establishing internal audit's analytics program approach is knowing its objectives.

"Analytics Development" — A consistent approach facilitates communication and the chances of dependable results.

"Analytics Roadmap" — As internal audit embarks on its analytics program, it needs a method to guide auditors in selecting and prioritizing projects.

"Analytics Toolbox" — With an array of software to choose from, internal audit needs to set criteria for selecting the products that best fit the needs of its analytics program.

Developing Good Analytics Takes a Team

For the analytics team, the sign that it has produced a good analytic is whether it is able to produce results. Analytics have less to do with what happens in the computer than with the internal auditors' ability to execute projects and build effective teams.

In the end, the analytics will be as good as the people who come together to identify and answer the question. It takes a team to bring together all the capabilities needed to develop good analytics for each new project. That team must:

  • Work toward a valuable question.
  • Know what is needed to answer that question.
  • Have access to the data that allows that answer.
  • Produce the answer timely and upon request to get things done.


No one person can provide all of these capabilities. The team is complete when it has: 1) a champion, 2) a business process team, 3) an IT representative, 4) an analytics programmer, and 5) an influencer. Some team members may wear more than one hat, but all roles must be in place.

Chances are this team of people will likely change from project to project, depending on the business area, business process, and systems involved in the new "right questions." If internal audit builds the wrong team, even the best tools, techniques, and access to data will not be enough to create "good analytics." The team becomes the secret sauce that makes this possible.  

The Journey Continues

This article closes the series of key ideas internal audit functions should keep in mind when developing analytic programs. A common theme throughout the Analytics Journey is how the success of the program is tied to defining and sharing the "true north" to guide it. Developing an analytics program should be seen as a job function that must be aligned with the ever-evolving needs of the business — a function that needs processes, tools, and people to fulfill its mission. Even once internal audit's analytics program is well underway, there is still much to learn as the team continues its analytics journey.

Francisco Aristiguieta
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author

 

 

Francisco AristiguietaFrancisco AristiguietaFrancisco Aristiguieta, CIA, is responsible for internal audit analytics at Citizens Property Insurance Corp. in Jacksonville, Fla.https://iaonline.theiia.org/authors/Pages/Francisco-Aristiguieta.aspx

 

Comment on this article

comments powered by Disqus
  • AuditBoard-April-2021-Premium-1
  • PwC-April-2021-Premium-2
  • Pulse-of-Internal-Audit-April-2021-Premium-3

 

 

Thanks, We Already Know Thathttps://iaonline.theiia.org/blogs/jacka/2020/Pages/Thanks-We-Already-Know-That.aspxThanks, We Already Know That
U.S. SEC: Environmental, Social, and Governance Risks Better Be on Your Radarhttps://iaonline.theiia.org/blogs/chambers/2021/Pages/US-SEC-Environmental-Social-and-Governance-Risks-Better-Be-on-Your-Radar.aspxU.S. SEC: Environmental, Social, and Governance Risks Better Be on Your Radar
Six Data Privacy Predictions for 2020https://iaonline.theiia.org/blogs/Jim-Pelletier/2020/Pages/Six-Data-Privacy-Predictions-for-2020.aspxSix Data Privacy Predictions for 2020
Public Servants Are Vital to Defeating COVID-19https://iaonline.theiia.org/blogs/chambers/2020/Pages/Public-Servants-Are-Vital-to-Defeating-COVID-19.aspxPublic Servants Are Vital to Defeating COVID-19