There seems to be an increasing gap between what internal auditors—and particularly Chief Audit Executives (CAEs)—say is the importance of data analytics to the future of audit and their capabilities to actually put analytics to work. Three major reports this year, from two of the Big Four and The Institute of Internal Auditors (IIA), raise some concerning issues.
1. Deloitte survey finds high expectations from audit leaders
First we have Deloitte’s “2016 Global CAE Survey.” Billed as Deloitte’s ‘most comprehensive global examination of internal audit to date,’ it is an impressive report that focuses on the major challenges faced by the profession. The report uncovered that “only 28% of CAEs believe that their functions have strong impact and influence within the organization.” And, “more than half of CAEs (57%) are not convinced that their teams have the skills and expertise needed to deliver on stakeholders’ current expectations—let alone future demands.”
The importance of analytics figures prominently as presenting “major opportunities,” with several key findings including that the “use of analytics is largely at basic levels”—but that within the next three to five years, almost two-thirds of respondents “expect to be using analytics in at least 50% of their audits. An impressive 37% expect to move to high usage—employing analytics in at least 75% of their audits.”
In fact, there are six pages in the report dedicated to detailed findings in support of the message that it’s time to embrace analytics and that “increased investment in analytics presents major opportunities to increase efficiency, value and impact of audits.”
The survey’s statistics around CAE expectations of high rates of analytics usage in the next three to five years are quite impressive. But, we have been hearing about these expectations and about the well-recognized transformational potential of analytics in surveys from the Big 4 and others for many years now. So, what’s the problem? Why, after all these years, is the usage of analytics still at basic levels in the majority of organizations?
The Deloitte survey does point out that “Internal Audit faces barriers to greater use of analytics” and highlights the number one barrier—by a significant margin—as: “availability of skilled talent.” This barrier is closely followed by: “not enough time.” It used to be that the biggest barrier was access to data. Notably, this issue is now seen as somewhat less of a problem than the lack of skills.
2. PwC survey points out that auditors are not using technology well
We also have PwC’s “2016 State of the Internal Audit Profession Study.” This report includes a showcase reference to an organization that is using advanced analytics in its audit team’s “journey towards Trusted Advisor.” The organization is also doing great things by transferring analytics into the business to help them “manage the risks to the organization.”
However, only 40% of survey respondents rated internal audit as performing well in their use of technology, which presumably includes data analysis.The IIA finds that audit leaders undervalue data analysis skills
3. The IIA finds that audit leaders undervalue data analysis skills
Then we have the IIA Audit Executive Center’s 2016 “North American Pulse of Internal Audit” report. This report seems to highlight at least one root cause of the analytics capability gap. According to the IIA AEC report,
CAE’s may need to re-evaluate the importance of data analytic skills. Only a little more than a third (37 percent) of respondents reported that they consider data mining and analytics skills very or extremely essential.
What is the answer to this apparent dilemma?
To summarize the above:
- Internal audit leadership recognizes the valuable role of data analysis in audit.
- Internal audit leadership expects in the next three to five years to be using data analytics far more extensively, in the way that they have said they want to for the past several years.
- Internal audit teams currently lack the skills and the time to achieve what they want to do with data analytics.
- However (and perhaps revealing a disconnect), the majority of internal audit leaders do not recognize data analytics skills as particularly important.
My initial question in the title to this article is “why is internal audit not addressing the data analytics capability gap?” It is not just a rhetorical question; nor can I provide the answer. Can anybody help with this? What needs to happen to avoid reading the same report findings year after year into the future?
Written by John Verver, CPA CA, CISA, CMC. He is an acknowledged thought leader, writer and speaker on the application of data analysis technology in audit, fraud detection, risk management and compliance. He is recognized internationally as a leading innovator in continuous controls monitoring and continuous auditing and as a contributor to professional publications. He is currently a strategic advisor to ACL, where he has also held vice president responsibilities for product strategy, as well as ACL’s professional services organization. Previously, John was a principal with Deloitte in Canada.