My husband and I both have watches that track our activity (number of steps, stand hours, exercise minutes, etc.). Over the last nine months or so, we've had a lot of fun sharing our activity with each other, and we've been somewhat competitive in trying to keep our movement and other activity streaks going (in all honesty, I may be more competitive than him in this respect). A positive side effect of this is that we're both moving more, ultimately having a positive impact on our health.
However, over the last month or so, we've had several situations in which we did virtually the same activities all day, and yet my husband's activity levels were much higher than mine, as captured in our activity trackers. We came up with several hypotheses as to why the significant differences might exist, including heart rate, body build, and other factors, but we still were not able to pin it down. My husband even searched online to see if we might be able to get some insight into the situation based on the device manufacturer.
Without any luck with these efforts, we decided a head-to-head test may help us get to the bottom of the differences. This past weekend, we had the perfect opportunity. My husband participated in an event for which it was not a good idea for him to wear his activity tracker because of the potential that the tracker would be damaged. However, as a spectator at the event, I also would be walking several miles over the event course. With this in mind, we decided that I would wear both of our trackers and see if, at the end of the day, our activity levels were the same as per our activity trackers.
What we learned is that while our number of steps was fairly comparable with me wearing both devices, my husband's total miles and exercise minutes were both significantly higher than my own. I was somewhat frustrated by this, given that I had done all of the walking for both of us, or at least what we were measuring with the activity trackers.
At this point, you are likely questioning what this has to do with internal audit. As auditors, it is easy to read key performance indicator (KPI) reports, benchmarking information, and other similar data, and make assumptions as to where potential risks and issues may be lurking. We also likely use this information as a component of our risk assessment processes. However, if we don't truly understand the underlying data, we may be making false assumptions.
In this world of big data, analytics is a truly powerful tool. But analytics is only useful to the extent that we are comparing like data and we have a good understanding of what makes up that data. Knowledge of the origination of the information, how key numbers are calculated, and linkage between data sets, all play a key role in the integrity of the information that we use to make decisions. Further, lack of controls to ensure that the data we use in our analysis is complete and accurate can result in misleading data in the reports and analysis that both we and our organization's key stakeholders rely on in the decision-making process.
In addition, to be able to rely on data, it is important to consider general IT controls related to the information we are using in our decision-making process. For example, logical access, change management, and backup and recovery related to critical data all play a role. Likewise, understanding processes and policies in place for managing source system data, any data standards in place, and roles and responsibilities in the organization related to data governance all play a role in enabling us to rely on the data that we receive.
My husband and I still haven't gotten to the bottom of the inconsistent data in our fitness trackers, and in the end, it may be better for my health to have low activity reported, if it makes me work even harder. Ultimately though, as we continue to rely on more technology tools and trackers, both personally and within the organizations that we audit, it is important to keep in mind that what we see on our trackers, KPIs, and dashboards may not tell the full story. After all, what good are your dashboard instruments if they are inaccurate or lack integrity?