Data about your organization can be a powerful tool, and internal auditors are increasingly taking advantage of new technologies to incorporate data analytics in their audits. Yet, the use of data can easily go awry. The insights data can bring to decision-making come with equal power to misdirect if not used wisely.
Regrettably, chief audit executives (CAEs) seem to be unsettled when it comes to this task: Only 42 percent of CAEs responding to The IIA's
2017 North American Pulse of Internal Audit reported they frequently or always used data analytics during audits. From that same report, the chart to the right further illustrates that data analytics just has not been embedded into internal audit departments. The chart shows that certain fundamental elements underlying an effective data analytics program have not been implemented.
Unfortunately, this trend continued in the 2018 North American Pulse of Internal Audit, with only 62 percent of CAEs reporting that they have partially or fully implemented data analytics.
That said, more and more CAEs are jumping into this growing area by assigning auditors to "go do data" without sufficient training, preparation, or strategic direction. Auditors taking on this role need to be aware of the risks surrounding data analytics. The list below is a starting point:
Clean and normalize the data. Internal audit has to understand data collection: Know the people collecting the data, the sources, and the analysis processes, to be confident in the end-product. Data used for analysis must be correct, consistent, complete, free from duplication, with inaccurate or irrelevant parts deleted. Clean data is easier to combine with different data sets to gain deeper insights. Normalization, which simply means looking closely to assure units of measure are comparable by transforming all variables to a specific range, is a prerequisite for effective analysis.
Deal with outliers. Auditors can't assume that a 99.3 percent positive return means things are good, because that 0.7 percent might be a significant issue that won't be known until you dig in. Outliers should not be ignored, they should be understood. They may be telling you something important. Seize the opportunity to discover the reason why things didn't come out the way you thought they would.
Accurately read patterns and eliminate "noise." Data that is not stable or has a high level of variability will not allow you to compare, predict, and forecast correctly. Eliminating noise or corrupt data will also allow your data to be correctly used by machines. Keep in mind that some patterns are too complex for most humans to detect and that many tools are being developed with built-in intelligence to enhance the capacity to detect meaningful patterns.
Clearly visualize the data. As I wrote in my recent
blog post, "Five Tips for Effective Data Visualization in Internal Audit," it is incumbent on auditors to communicate audit results succinctly and clearly, and that includes graphs and charts carefully constructed to convey maximum value. Data visualization also should be leveraged early in the analysis process, as it enables pattern identification.
Understand correlation versus causation. Correlation describes the relationship between two variables, while causation speaks to the idea that one event is the result of the occurrence of the other event. It is easy, and too common, to assume causation when there is simply correlation in the data and individuals viewing the data will be influenced by past experience and their own personal biases. Check out Tyler Vigen's
website called Spurious Correlations, which he created as a fun way to think about data, look at correlations, and show how variables work together. My personal favorite is the correlation between margarine consumption and the divorce rate in Maine.
Recognize when you should
not use data. More data isn't necessarily better, as not all data will help achieve audit objectives. Realize that you can't use data for everything, and sometimes instinct and experience are the best tools for auditing a certain area. Also, similar to correlation versus causation, data can often appear to have more meaning than it really does. Beware the danger of jumping to conclusions that ultimately may not be supported by the data.
Given the growth of data, both in volume and complexity, the field of data analytics is ramping up to keep pace. When it comes to truly understanding and leveraging your data, a number of skills are required. To this point, there is growing recognition that numerous roles are necessary, including data scientist, data analyst, data architect, and statistician, among others. Someday soon, internal audit may need to consider adding these types of roles to the department (some larger departments have already done so). Until then, it is critical that auditors at least add foundational data analytics skills to their tool set and that CAEs begin planning a comprehensive
data analytics strategy.
That's my point of view. I'd be happy to hear yours.