Internal Auditor’s blogs reflect the personal views and opinions of the authors. These views may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers’ employers or the editors of Internal Auditor.

​Data Analytics: Obstacles and Opportunities for Internal Audit

Comments Views

Data is everywhere — the hard part is knowing how to use it to achieve a well-defined purpose or objective. To understand the core of the challenge, it's important to start with how the unique attributes of data have evolved over the past few years. These attributes, referred to as the seven "V's" of data from The IIA's Global Technology Audit Guide, Understanding and Auditing Big Data, are:

  • Volume — the amount of data being created. Some organizations are now measuring data volume in zettabytes (1 trillion gigabytes) instead of megabytes. Technology has enabled an explosion in the amount of both structured and unstructured data at our fingertips.

  • Velocity — the speed at which data is produced. When you consider the capture of transactional data at all points in a process, the ever-increasing use of video cameras — think of the growing use of drones alone — and all of the sensors on all different types of devices connected to the internet, velocity is allowing incredible amounts of data to be captured and uploaded in real-time.

  • Variety — the ever-growing sources of data capture (a few examples mentioned above). Also, where we typically have relied mostly on structured data in the past — think of data that organizes nicely into a database — the growth and use of unstructured data is incredible. Consider how much of your conversations Google, Amazon, and Apple are collecting with their smart speakers and what they are doing with it. What are they learning about your behavior and how can they leverage that to sell you more?

  • Veracity — the quality and accuracy of the data. Within the changes to volume, velocity, and variety are a number of critical, underlying questions. Is the data any good? Is it verifiable based on both accuracy and context? Is it collected and formatted consistently? Was it collected legally and ethically?

  • Variability — the extent that data points diverge from the mean and from each other. Variability is typically measured by range, mean, variance, and standard deviation.

  • Visualization — the ability to translate vast amounts of data into readily presentable graphics and charts that highlight insights gleaned from the data while being easy to understand and interpret by the end user.

  • Value — the data and how you use it and communicate it adds value to the organization. Value is generated most importantly when new insights are translated into actions that create positive outcomes. If the results of your data analytics are not producing value, you may just be wasting a lot of people's time.

This "Age of Data" presents serious opportunities (and risks, but I'm going to focus on opportunities). Many internal audit departments see the opportunity, but have struggled to generate significant value that outweighs the additional costs of implementing a data analytics program. I believe part of the reason for this is our attempt to oversimplify what it takes to implement an effective data analytics program. When I've discussed data analytics with many chief audit executives, I often hear a similar story:

"I have an auditor on my team who likes data and knows how to use [XYZ software]. I sent him to some extra training and asked him to come up with some analytics for a couple audits. He produced a bunch of rather large exception reports and ran some Benford's analysis. I'm not sure where to go with this next."

And that's just it: Data analytics is more than one person collecting data and creating reports. Most importantly, data analytics must start with a strong understanding of the organization (business acumen) as well as the needs of key business owners. Being so informed will lead to the identification of critical questions that need to be answered. How well you are able to answer these questions will determine the amount of value generated by the analysis. To answer these questions, consider two things: Do you have the data you need and does your team have the skills to get the data and analyze it in a meaningful way?

So, what skills do you truly need to make data analytics work for you? As this field is rapidly evolving, there is a lot of debate. Here are four critical roles I believe are necessary to develop a more valuable data analytics program:

  • Data Scientist — While defined in many ways, a data scientist turns large amounts of often disorganized data into a powerful dataset that can be used to solve big problems. With expertise in cleaning, organizing, connecting, and interpreting both structured and unstructured data, this role often links into machine learning and typically requires individuals to have a deep understanding of algorithm development and use.

  • Data Analyst — Translating data into plain English, data analysts collect, process, and analyze data. Most importantly, they are able to communicate that data in a way that is meaningful to the end user. Data visualization and storytelling skills are critical.

  • Statistician — Bringing an expert knowledge of the mathematical inner-workings of statistics, statisticians ensure that data is collected, organized, analyzed, and interpreted correctly, ensuring organizations avoid the concept of "garbage in–garbage out."

  • Database Administrator — The backbone behind the data, this role manages the capacity, configuration, database design, performance monitoring, and security of the organization's data. The database administrator is essentially the gatekeeper and expert who knows where the data is and how to access it.

Before you say it, I acknowledge two things. First, I've barely scratched the surface in terms of the potential complexity, scale, and scope of these roles. Second, and very important, most internal audit departments will not have the funding to hire all of these positions. Instead, recognize the need and look for opportunities to engage people with these skills through a combination of team development, cosourcing, and perhaps even tapping into other resources within your organization. More importantly, recognizing your strengths and limitations in these areas ensures you build a data analytics program that fits within your capabilities rather than setting data analytics goals that may not be achievable.

That's my point of view. I'd be happy to hear yours.

Internal Auditor is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.



Comment on this blog post

comments powered by Disqus
  • Idea-September-2020-Blog-1
  • Galvanize-September-2020-Blog-2
  • CIA-September-2020-Blog-3