Moving from ad hoc auditing to automated monitoring

Published | Friday, February 9th, 2018

Today, in financial institutions around the world, audit teams have an ever-growing portfolio of functions to manage while keeping up with a constantly changing regulatory landscape. These same auditors are expected to provide assurance over the endless streams of data that the bank or credit union generates. They also need to ensure that they’re making continuous, material contributions to the safe and sound running of the financial system.

But what happens when the auditors—who are constantly trying to wrangle and interpret the data—are being bombarded with daily demands and questions from senior management? They’re thrown into a position of being reactionary instead of strategic in their work. Regular tasks and planning go out the window and and many find themselves unable to manage the workload.

This is when automated monitoring comes in. By selecting key controls that can be tested through analytics and identifying routine tasks that can be automated, audit teams can:

  • focus their time on the things that matter the most
  • wrangle and extract the most value out of all that data
  • help the organization make strategic decisions without subjectivity.

Sounds good, right? Yet many in the industry don’t currently have a plan on how to expand into or start using data analytics and automated monitoring. So we put together this high-level outline on how auditors can make the switch from reactionary ad hoc analysis to fully automated strategic monitoring using analytics.

Create and enable a central team to focus on analytics

The process of introducing and implementing automated monitoring through analytics is not something that can be built and supported by a part-time worker. The team is a dedicated, knowledgeable resource that understands the business, its goals, and strategy. They will act as the single source of truth for all business/data-related questions.

Have the team look back and analyze the past six months

It’s time for the team to get familiar with—and take inventory of—all the ad hoc tests, requests, and demands from the past six months. They can then isolate the repeat requests and manual processes to pinpoint the tasks that can be automated.

Strategically review the work

The team now has a laundry list of testing and tasks that would benefit from automation. But before any further work is done, it’s important to review those tests and tasks to ensure they’re aligned strategically with both the organization and the department/business area. Keeping this focus will help weed out the work that doesn’t add value, identify the data and sources needed for the job, and uncover any gaps in technology and processes.

Implement analytics

This is a somewhat larger, more intensive step than the rest. But if you’ve already got a solution in place, like ACL Analytics Exchange—that allows you to schedule automated testing and connect all your data sources in one place—it’s much easier to make this leap. No solution in place? What you choose depends on your organization and the needs of your audit team. Working together, all of these stakeholders would evaluate and select the right analytics tool.

For those with ACL Analytics, we’ve made this step even easier by compiling hundreds of analytics testing ideas for quick implementation. For example, dormant accounts with sudden activity. Using analytics, you can identify any bank accounts that have had zero activity in the past X months, but have suddenly become active (via high-volume transactions or other unusual behavior) after this dormant period. Why was this account not being utilized before? Are these new transactions valid?

After selecting the analytic tests, it’s easy to schedule them to run on a regular, recurring, basis using Analytics Exchange.

Find more test ideas in our banking analytics application sheet.

By using these easy-to-implement tests and tapping into 100% of the organization’s data, auditors will move from after-the fact data extractions to predictive, continuous, near-time testing. Better yet, tests are run the same way, every time, no matter who runs them, so you can trust that the data is always consistent.

Track and report on your findings

With the program now in play, it’s time to define and track metrics to measure your team’s productivity. For example, are these automated processes saving valuable time? If so, how much? If not, what can be done to make things more efficient?

Next, collect the data, then create visualizations and storyboards to illustrate how the team is adding value. But also look at mistakes, learn from them and figure out new ways to do things so the same mistakes don’t happen again. Share reports and storyboards with senior management, and show them how they can have instant access to the results of the continuous monitoring system. (So much for those last-minute demands and requests!)

Rinse, review, and repeat

A great feature of automated monitoring is that it can be incrementally built. Once the above steps are completed, it’s good to go back to the beginning, and ensure the team is working well, that they have the right support and tools they need to be successful. Also, take inventory of the tests and routines: Is there something else that should be monitored? Any tests that can be refined or removed?

Rome wasn’t built in a day, and an automated monitoring program takes time to perfect. But with each cycle your system—and your team—will grow and improve.

Using automated monitoring, banks and credit unions will have specialized, targeted, always-on coverage. Freeing up resources to focus on more strategic tasks and achieve meaningful results faster.

Ready to learn more about ACL’s automated monitoring solution? Here are a couple of resources to get you started!

  • Three myths about continuous monitoring. Blog post
  • Siemens Financial Services, Inc. automates controls testing with an ACL enterprise continuous monitoring solution. Video case study | PDF case study

  Get in touch with us!

In compliance with Section 45 of the ECT Act please confirm the following:

I would like to receive future communication from CQS.

Leave a Comment

Your email address will not be published. Required fields are marked *