“Where there is data smoke, there is business fire” warned Thomas C. Redman in his book Data Driven yet only half of audit teams are performing data analytics on every audit, according to TeamMate Audit Benchmark.
Without a data-driven audit approach, audits are often executed based on gut instinct or worse, simply doing what was done in the last cycle. With a rapidly evolving audit environment, auditors need to make decisions on the most impactful areas to focus their attention using the best information they have available. More than ever, audits must be data-driven.
TeamMate Audit Benchmark surveyed more than 1,000 internal auditors across 14 key areas to understand their audit approach.
While only 50 percent of internal audit teams responded with “Analytics are part of every audit executed”, reassuringly a further 38 percent indicate they are planning to do this. Only 12 percent were not planning to incorporate analytics into every audit.
Forty percent of respondents are already performing continuous testing and monitoring, and a further 36 percent plan to. Continuous testing is an important element of a data-driven audit approach. Automation and repetition enable subtle changes to be monitored over time, and actions can be taken to mitigate emerging risks.
Following that, more advanced forms of analytics, such as using advanced analytics to test complex systems, identify trends, correlations and predict patterns; using process mining to leverage data from the organizational ecosystem to understand control strengths or weaknesses instead of manual walk-through tests; using machine learning to test for anomalies and/or automate tasks; and robotic process automation to extract data and/or test routine and predictable areas of the audit plan are much less common in audit teams, although a significant number of teams plan to address this in the future.
What three things can audit teams do today to adopt a data-driven analytics approach?
1. Enhance data analytics skills
Twenty-seven percent of respondents say they don’t perform analytics on all engagements because they lack the skills or resources required. Reasons for this include difficulty hiring people with the right skills, challenges with upskilling existing auditors, and not having budget to outsource or hire freelancers.
It’s clear that to incorporate analytics into every audit and implement more advanced analytics, finding people with the right skills to do this is critical. However, there aren’t scores of young data science graduates eager to join the world of auditing, and there’s huge competition in general to hire people with these skills.
How can we become more data-driven, given these challenges?
Borrow resources from elsewhere in the company
Many larger organizations already have data analytics capability but not necessarily within Internal Audit. Perhaps these skills can be leveraged to benefit the internal audit team.
Build a small center of specialists
While a large team of data analysts might not be possible in the short-term, perhaps recruiting one or a few specialists is to tackle some of the more challenging analytics projects, such as implementing continuous monitoring for key controls.
Upskill auditors to perform more analytics
Another way to get analytics performed on every audit is for auditors to perform analytics themselves, in place of alternative manual procedures. The difficulty is that many auditors don’t currently have the required skills.
Aside from becoming proficient in a particular data analytics tool, a fundamental key skill missing from many auditors toolkits is the ability to form a hypothesis and translate it into a data analytics test. For example:
- I have a hypothesis that the purchase order approval control is not operating effectively
- I would know that this is the case if:
- A purchase order could be issued without it being approved
- A purchase order could be approved by someone without the correct authority
- I can test this by:
- Looking at every purchase order issued in a certain period and ensure that the approval has been completed; and
- Ensuring that the approver has the correct authority for the spend level.
That can then be translated into a data analytics test, which could be executed in any number of tools from Excel to Python—whatever the auditor is more comfortable with.
Instead, they’ll test by taking a sample of 30 purchase orders and check for each one that there’s a purchase order and that the approver has the correct authority. A population of 100,000 purchase orders is 0.03 percent coverage, and verifying 30 will probably take significantly longer than using an analytics to test 100 percent of transactions.
However, these skills are tough to teach—they’re better learned by doing. Starting with a few analysts, borrowed from elsewhere in the organization or recruited in, to hold auditors’ hands as they start to design and perform analytics for themselves, is often more effective than training courses.
2. Get buy-in
TeamMate Audit Benchmark found that the ranking of importance of data analytics/data science is an indicator of the pervasiveness of analytics in an audit team.
The auditors that consider data analytics skills to be “not required” or “desirable but not needed” tend to have lower levels of maturity in data analytics: a one or two rating. They often don’t have data analytics skills on their team or they don’t have a suitable tool. The auditors either don’t have an analytics program, or it is focused on one or two specialists doing all the analytics work for the entire audit team.
The auditors that consider data analytics skills to be extremely important tend to have higher levels of maturity: a three, four or five rating. They have a greater number of analysts on their team, and while 31 percent still have most of their analytics done by one or two specialists, 50 percent say that anyone can perform basic analytics, with more advanced analytics being handled by specialists. A third of those say they’re also in the process of automating analytics. This group is also more likely to use tools like R and Python to perform more advanced analytics and machine learning.
Causation is not clear. Whether those that consider data analytics skills to be important do so because they’ve seen the value analytics can bring, or whether data analytics has been more heavily invested in because of audit leaders’ view of its importance. But, what is clear is that data is only an integrated part of the audit when leadership recognizes the value of analytics and builds their team with that skillset in mind.
The key to success in implementing a data-driven audit approach is buy-in from leadership. A good way to do that is to demonstrate success with data analytics by starting with smaller projects that deliver tangible benefits to try and get them on your side.
3. Find the right tool(s) for the job
TeamMate Audit Benchmark asked the respondents that perform data analytics on every audit what tools they used and found that there’s quite a variety. In fact, 61 percent use two or more data analytics tools, indicating that there’s no single data analytics tool that is ideal for every application.
Unsurprisingly, the single tool that is still king of analytics is Excel, with 73 percent of teams still using it. However, 53 percent use Excel along with another tool.
Eighty percent of teams use a data analytics tool other than Excel but there’s a wide range of tools employed. Traditional audit analytics tools are being replaced with or supplemented by business intelligence tools, such as Power BI, Tableau and Qlik, often because these tools are already used elsewhere in the business and linked to the organizational data that audit needs to access. Sixteen percent of teams are developing more advanced data science capabilities, using R and Python for audit analytics.
What this means for audit teams wanting to adopt a data-driven audit approach is that the choice of tool depends on how they wish to apply analytics, and most importantly, the skills and experience of those that will be performing analytics. TeamMate Audit Benchmark tells us that teams where one or two people do all the analytics often use more traditional audit analytics tools, which might require scripting skills and more experience.
Teams that democratize analytics, enabling all auditors to perform some level of analytics themselves tend to use more user-friendly tools, such as TeamMate Analytics, pure Excel, or self-service BI tools, like Power BI. Teams with more advanced analytics capabilities and data science skills also employ R and Python.
Once you know what data analytics skills you have available, choose the appropriate tools that work for the people with each skill level.
If your audit team is struggling to become more data-driven, take a look at your teams’ data analytics skills, buy-in from the top, and the tools you have at your disposal.
TeamMate Audit Benchmark is open
Complete the survey to understand how your team stacks up against five levels of maturity across 14 key areas. Data analytics is just one of them! Click below to learn more about TeamMate Audit Benchmark and to take the survey.