Data analytics are about one thing—extracting actionable intelligence and valuable insights from data to provide stakeholders with a deeper understanding of their business. By capitalizing on the wealth of data organizations have available, Internal Audit can provide greater assurance across the three lines of defense and position themselves as a trusted partner.
Today, many internal audit teams rely on a single individual or a few specialized data analytics staff to support their data analytics program. This means internal auditors have to pick and choose which audits to incorporate data analytics into. Senior leaders and stakeholders need to determine if they are willing to accept this level of risk. Is your organization comfortable knowing that on half of your audits your audit findings don’t tell the complete story? With the volume of data in your organization, doesn’t it make good business sense to look at the entire data population rather than just a sample?
Data analytics is also the cornerstone of Internal Audit detecting fraud. Traditionally, internal auditors used sampling to make assumptions about an entire data set. The downside is that the sample is not always representative of the whole population, which can lead to risk. The other disadvantage of sampling is that fraud often can’t be identified by just pulling out a few transactions to review. Looking at the entire data population provides internal auditors with deeper insight into business operations and helps internal audit teams identify potential fraud more readily.
10 best practices to kick-start your data analytics program
Are you one of those organizations that whenever the word “analytics” comes up, everyone takes cover and points at the person who’s been allocated as your “analytics champion.” Internal audit has fostered that environment, and it’s going to have to change if internal auditors are going to stay relevant. To do this, internal auditors must recognize that there is a need for a change, and that need has to be stronger than the perceived difficulty of changing. We've built up this barrier that says data analytics is really hard, but what it really requires is a shift in mindset.
When you talk to most auditors about the advantages of performing data analytics on 100 percent of the data set versus pulling a sample, they understand the value. Here are 10 best practices that can help your organization break through the barriers when adding a data analytics strategy to your auditing program.
-
Develop a vision and plan
It’s important to establish a clear vision for the desired end-state and a detailed plan to help you get there. To help define your vision, ask “Where do we want to be a year from now? Two or three years from now?” Talk to peers at other organizations that you believe are further along the maturity curve to get ideas about how analytics can improve an audit team and its product. Once you’ve decided on your vision, the next step is to develop your plan. This is a tactical approach to the steps you need to take to achieve your vision. Your plan could start with something as simple as having all internal auditors start performing completeness and accuracy checks on their data. Whenever an internal auditor gets a spreadsheet, they have to perform these data checks—and then build from there. Finally, and most importantly, make sure to communicate your vision. When you speak something out loud, it makes it that much easier to become a reality.
-
Get buy-in from the top
Make sure the Chief Audit Executive is fully on board and voices his or her support. Oftentimes, when a new solution is brought in, senior management and stakeholders expect things to change overnight. It’s important that you not only have their buy-in but set expectations so that everyone fully understands what they are supporting and they are supporting all of these best practices throughout the change process.
-
Determine success
What is success? What does it look like to your organization? In addition to your audit plan, it’s important to set targets and design Key Performance Indicators (KPIs) to monitor progress. There are several KPIs to choose from, so make sure you select those that are most relevant to the objectives and evolve with the plan.
-
Appoint a lead
There’s often talk about champions, but a lead is different. A lead is a person who's monitoring the KPIs and ensuring that the internal audit team is progressing according to plan. A lead is similar to a project manager appointed to keep the internal audit team moving in the right direction. The lead can be the leader of the audit team, or another member of the team but who visibly has the full support of the CAE.
-
Appoint champions
Champions are the internal auditors that have a natural lean towards analytics. It doesn’t mean they are performing all of the data analytics, but they coach other team members in their progression toward using more analytics in their audits.
-
Provide training
It’s important to provide an appropriate level of training for champions and users, not just during the initial implementation of your data analytics program but offering ongoing training that maps to your plan as well. Training is not only the “how”, but also the “what”. “What” should I be looking for and “what” tests should I perform as well as “how” do I perform those tests using the tools we have.
-
Identify quick wins
When internal auditors are first getting started with data analytics, it's always a good idea to deliver a few quick wins to get buy-in. If you pick the hardest, most difficult audit to perform data analytics, you are reinforcing the mindset that data analytics is hard. It helps to find a few simple areas or tools to build momentum and demonstrate initial success.
-
Share ideas and successes
It’s important to encourage experimentation and collaboration, share ideas and examples of data analytics usage to build enthusiasm. The most successful teams share knowledge regularly, whether it is weekly or monthly. This is a good way to continue to keep internal auditors thinking and learning along the way.
-
Incorporate analytics into planning
The most successful organizations have built questions into their audit planning to help them determine at the onset what analytics they are going to perform. This is key to ensuring that data analytics are considered early in the audit planning process and baked into audit programs. Data analytics should not be a one-time event but a critical component of every audit process.
-
Mandate use or provide incentives
Set expectations that internal auditors will use data analytics and consider linking each individuals’ usage to their annual performance targets and bonus. For any audits where data analytics aren’t being used, establish protocols to state that not incorporating analytics requires justification and approval.
With any change worth doing, it’s worth doing right. Implementing data analytics into your auditing workflow can take time to ensure everyone is on board and understands the value. As data analytics become integrated with your existing audit processes and workflow, the meaningful data extracted will enable your internal audit team to deliver audits that have a greater impact on your business. By identifying potential fraud and other risks earlier in the audit process, you’ll also be able to implement change faster and make decisions more quickly to help maintain your competitive edge in the marketplace.