Successfully implementing an internal audit data analytics strategy

Tip #1 – Do not go for a grand plan but start small and test and learn as you go

In my experience, successful data analytics comes not from the development of a grand implementation blueprint, but rather from starting small and testing and learning to see what works well for your organization.  This includes the building of support from the Board and executive leadership by showing, as you go, the insights gained from the analytics work done and the possibilities to go further with increased resource and technological investment.  This is in contrast to going upfront with a theoretical case and associated request for a big budget.  This approach lends itself to start with a pilot where you pick an area of audit work to be conducted and look to introduce some data analytics into this work.  This should be an area where you know you can get relatively easy access to the data you need.  Perhaps with an auditee who is an advocate of internal audit and willing to work with you to make the pilot a success. I have found that success breeds more success and considerable momentum can be delivered in this manner.  It is also good, early on, to build your library of data analytics case studies so that you can showcase your success with executives across the business to get their support for an expansion of data analytics activity.  I call this a test, share and impress approach.

Tip #2 – Do not get hung up on the technology, look to use what is already available

I have sadly wasted significant time in meetings on data analytics where we have discussed, at length, the potential technology available to conduct data analytics work when the time would have been better spent using the technology we already had in place and getting on with data analytics activity.  An important step in your data analytics journey is to establish what relevant technology your organization already has in place (and is already paying for!). In one organization that I worked for we found over a couple of weeks, a whole range of technology was already in place and ready for us to use.  This was done by engaging with the IT function to see what they knew about technologies in place.  However, we also found through our business networks other tools readily available that we could use that the IT function was not aware of.  While most of the tools you discover will not have been developed with the Internal Auditor in mind, they can be easily adapted to allow adoption in the function. So, get out there and find out what is available and get your team's access so that they can start playing with it to see where it can be put to use in your data analytics.  And remember, Excel is often enough and of course TeamMate Analytics for Audit data analytics capabilities can allow you to make huge strides in your analytics fully integrated into your audit work within the TeamMate system.

Tip #3 – Data access is crucial – negotiate from the top

Having got underway you will need to look at data access to ensure that your progress is not hampered.  Clearly, you cannot successfully deliver insightful data analytics if you do not have access to the relevant data.  However, you need to be focused in how you go about doing this as you expand beyond initial pilots into a more systematic approach.  As you increase the amount of analytics you are doing you will want to systematically ask yourself what are the really important questions that you wish to answer and how can data help you do this.  Where is the data in your organization held and do you have a map of these data so all of your auditors know where to look?  You may also face resistance in your organization as to whether you should be allowed access to sensitive data particularly in areas such as HR and customer data.  Clearly, you will need to demonstrate how you have appropriate controls in place to manage the security of this data.  It is important that you do this well as it will damage your reputation if you have a data breach of any kind.  Clearly, TeamMate can help here as you already know this is secure so holding analytics data in your core audit system will give you comfort that you are in control.  When you have done this, you can establish simple data access protocols that all parties support to ensure that future access is quick and simple.  You may also need to get the executive of the business involved if the resistance does not recede – Your CAO may need to engage with the CEO, CRO, HRD to smooth over this resistance.  This is where the share and impress part of your strategy is so important.  If the executive has already seen the power of your work in another area it is likely that they will be supportive of your access to the data.

And do not forget to ensure your auditors have read-only access to key organization’s systems, such as risk and HR, to allow them to use these on an ongoing basis.  This does not require feeds setting up or analytical tools, just the right to look in the database to see what is going on in the area under review.  This direct, read-only access, is one area that I think is seriously under-utilized in analytics strategies.

Tip #4 - Collaborate with your business colleagues – independence is a mindset

I have spent time with a lot of auditors who have been reluctant to collaborate in any deep manner with the business, citing the audit charter and the need for full independence from first and second-line activity.  I agree our independence as internal auditors is very important.  We need to be objective in all that we do.  However, I do not believe independence means that we cannot work closely with the business where it makes sense to do so.  One such area is the identification and development of data analytics capabilities.  Most organizations now have some strategic intent to develop the use of their data.  This means that there is often significant investment into analytics capabilities in the first and second line, alongside the excellent work that is being done in many internal audit functions.  Given this shared interest it makes sense for all those interested in analytics activity to come together to share ideas, technology, and data to the benefit of the business.  For example, this may mean developing a shared data warehouse that all can access, jointly investing in one of the many analytics tools out in the market, working together on a project to establish the permanent capability to analyze a company data set or directly, for internal audit, sharing analytics we have developed for permanent adoption in the business to help them ensure their controls are working on a continual basis.  Find out across your business who is interested in this space and join with them to share, learn and progress.

Tip #5 – Upskill all auditors at all levels (yes including you Chief Audit Executive)

The skills of your team to be able to identify when to use analytics and then how to execute are key.  Analytics is not the privilege of a few anymore but a core competency for all auditors.  This should be reflected in the recruitment and development approach for your team.  I am a huge fan of expecting data analytics skills from all your new recruits and testing this through the recruitment process through some form of case study exercise.  This allows you to examine both the mindset of the individual you are recruiting (i.e., can they see opportunities for using analytics) and the skills in using some simple analytic techniques.  Do you know that your new hires are data-savvy?  You will also need to revisit your Internal Audit competency framework (if you have one) to signpost the skills and knowledge that your auditors need to have to be successful in this area.  The framework should be clear on the skills they will need including areas like data manipulation, statistical analysis, coding (for some at least), data visualization, and presentation.  This is likely to mean that you will need to provide detailed training to the teams on the data analytics mindset and skills you need.  Programs are increasingly common where all auditors in a function go through together, including the Chief Audit Executive and Audit Directors, to build a common understanding and momentum around data management and analytics.

When it comes to your people you also need to be honest with yourself about where you do not have the skills needed.  Data analytics skills and knowledge are highly sort after and if you are a relatively small internal audit function you may not be able to build deep capability.  You will need to draw on other sources of expertise including the business and external consultancy support.  These can allow you to supplement both the capacity and capability of your team. 

Tip #6 – Ensure accountability through effective performance management 

It is important that you ensure people are held accountable for pushing your use of data analytics forward.  If you are to achieve wide-ranging use of analytics it is important to integrate reward and recognition of this into your performance management system.  One organization I worked with ensured everyone, right through the internal audit function, had a clear objective around the use of data analytics in audit work and the function as a whole had targets for the percentage of audit work that deployed simple analytics and more complex audit work that was reviewed and signed off by the QA function.  Whilst this is relatively crude it emphasized the point that this mattered and everyone should be looking for ways in which they could make the use of data analytics endemic in the function’s activities.  It had considerable success and now data analytics is integrated into all that the function does and is delivering considerable results in terms of audit findings, continuous business monitoring, and the deployment of audit developed analytic capabilities into the first and second line for them to use as part of their day-to-day control management activity.

Tip #7 - Widely communicate and celebrate your successes

There are many ways in which you can celebrate your achievements and every organization will have its own culture and approach to sharing success.  At one organization I worked for we prepared a six-monthly set of case studies of audit successes.  We presented at our six-monthly audit leadership event a handful of these, that had been voted as our proudest moments by the whole team, to the chief executive, chairman, and members of the audit committee as 3–5-minute vignettes of success.  A great evening for the team, but also a chance for the audit committee and executives to see a collective view of the value we were adding and the energy with which we brought to our work.  These case studies were not all data analytics-driven, but what we did see over time was an increasing number of them becoming analytics-led as momentum and support for the data analytics initiative took hold.

Tip #8 - Embed consideration of data analytics into every part of your audit methodology

It is important that you truly make using data analytics an ‘opt out’ not ‘opt in’ part of your audit methodology.  Auditors should, at key stages of the audit process (tollgates), have to show why data analytics cannot be used rather than how they can. This opt-out approach will focus the mind of the internal audit team on looking for data analytics opportunities at all stages and increase the proportion of audits using analytics.

Tip #9 - Build your capability in a sustainable manner 

It is very easy, audit by audit, to throw together a spreadsheet to analyse some data.  However, this won’t be reusable in the future.  Encourage your auditors when developing analytics, whether that be through Excel, in TeamMate, or using other software such as PowerBi and Python, to build with reuse in mind.  This will take a bit longer, as will require setting up in a way that someone can pick it up in the future, but the benefits will pay off for the function longer term.  Consider giving time at the end of each audit for the team to clean up the analytics and store it in a well-organized data analytics library.  Central data analytics teams can really help here if you have the scale to do this.  They can take the lead in ensuring this systematization is carried out when analytics are used and also develop pre-configured testing scripts and ensure the libraries set up are well maintained and useful.

Tip #10 - A multidisciplinary (sometimes called Hybrid) approach is most successful. 

This is all about how you set up your operating model to deliver your data analytics.  Some larger functions have dedicated well-resourced teams to deliver analytics, but increasingly functions are taking a hybrid approach where a small group of specialists work alongside front-line auditors who have been trained and encouraged to use analytics.  This blend allows capability built to be widespread and penetration of analytics work to be deeper into more audit activity than if the work is done in a separate central unit. 

Conclusion

There is no silver bullet for the successful development and implementation of a data analytics strategy, but hopefully, the series of tips outlined will be a useful catalyst to your work as you consider the conditions that need to be right for you to achieve momentum around your data analytics work.  Good luck!