It is good to see the increasingly consistent signs that internal audit is (finally) getting to grips with the reality of data analytics. I have written repeatedly about the apparent disconnect between years of surveys reports that analytics are expected to have a major impact on the future of audit, while the majority of audit teams are still in the very early stage of use.
I mentioned in a recent blog post that the 2017 North American Pulse of Internal Audit report from the Institute of Internal Audit’s (IIA) Audit Executive did a great job in pointing out what is missing in the data analytics approach of many audit teams. Protiviti has also released a comprehensive survey report: “Embracing Analytics in Auditing – Key Findings from the 2017 Internal Audit Capabilities and Needs Survey.” This report provides new insight into the reasons why many (but certainly not all) audit teams are so behind in realizing the benefits of fully integrating analytics into audit strategy.
The challenge of the data analytics knowledge gap
The Protiviti report shows that chief audit executives (CAEs) now overwhelmingly recognize that data analytics are very clearly the biggest weakness in audit process knowledge. This is an important issue for the CAE to address. For years now auditors have said the biggest obstacle to the successful implementation of audit analytics is getting access to data. This is certainly still a very practical issue to resolve—but it is not the most important one. I spoke last week at an Audit Directors Symposium, where the attendees referred to the challenges of getting good data, but found that the biggest obstacle was obtaining budgets and resources—a telling shift in understanding.
CAEs need to deal with the issue of knowledge gaps, as well as the challenges of costs and resources. As the report points out, they should also be driving progress in the areas of analytics strategy, implementation planning, and management. The Protiviti report reveals that audit teams that are more advanced in terms of maturity of analytics usage see considerably more value (8.1 out of 10) than those that are in the early stages. The CAE should determine what costs are justified to get the resources to move the use of analytics from a basic level of relatively low value, to a more mature level delivering greater value.
The CAE then needs to put forward the business case if additional funds are required. Evidence of the value can be provided by moving ahead with pilot projects, as the Protiviti report suggests—or referring to the experiences of those audit teams that have already taken analytics to a higher level of maturity. Of course, it does not necessarily mean a net increase in budget funds to use analytics successfully; it may just require a shift in resourcing decisions. For example, next time an audit team member leaves, look for a replacement who has the skills and experience to be the audit analytics champion, a role that the Protiviti report also emphasizes.
Progress in continuous auditing and monitoring
The Protiviti report shows a positive trend around continuous auditing and monitoring:
“Although the overall use and maturity of continuous auditing and monitoring remains relatively low, internal audit functions with more advanced continuous auditing and monitoring capabilities are achieving impressive benefits. These include strengthening risk assessments, more effectively tracking fraud indicators and key operational risk indicators, and enabling a real-time view of organizational risk.”
It is also significant that business process owners, not auditors, are the leading group providing input into “determining what data is being monitored by continuous auditing tools.” This is significant because obtaining a high level of involvement from the business in implementing continuous auditing and monitoring is an important success factor, in part because this may well make it easier to secure additional funding for analytic resources.
Strategic outcomes of using analytics
For those of you who are responding to the IIA Pulse Report and developing an audit analytics strategy, the Protiviti report provides some indication of the most common strategic goals of the data analytics function:
Increased audit coverage 76%
Increased efficiency 76%
Increased effectiveness 73%
More robust testing 68%
Continuous auditing 58%
Targeted sampling 55%
Supplying management and the board with more quantifiable observations 48%
Visibility to risk indicators 45%
Meeting heightened expectations 35%
Supplying management and the board with quantifiable metrics for organizational risks 34%
The CAE is now in the driving seat
Protiviti listed “10 Data Analytics Action Items for CAEs and Internal Audit”, which I will not repeat here, as I think it’s worth your time to reading the entire report.
What I like most about this report is that the ball is put into the CAE’s court. It’s not a topic that should be delegated to a technical specialist or an “audit analytics champion”, however important these roles may be in practical analytics implementation. If analytics are expected to have a strategic impact on internal audit—as they should—then the driver needs to be the person responsible for audit strategy, and that’s where the CAE comes in.
Written by: John Verver, CPA CA, CISA, CMC Advisor to ACL