Internal auditors have weighed the benefits of data analytics software since the earliest versions of the technology began to surface nearly two decades ago. The conversation has continued even as the tools have grown in sophistication and become more pervasive on Windows-based systems.
Yet, even though many professionals believe data analytics can add value by helping auditors detect errors, uncover fraud and find opportunities to enhance operational efficiencies, widespread migration in that direction has proceeded slowly.
Early adopters largely use analytics sporadically, on an ad hoc, case-by-case basis, according to results of a survey of 1,500 auditors that AuditNet released in September 2012. Currently, only a small percentage of audit functions use data analytics tools and techniques on a routine basis. An even smaller percentage embedded data analytics into their processes where they might be considered at the highest level of maturity.
The survey found that auditors not using the technology repetitively or continuously may miss seeing a positive impact on results. And if results from the use of audit software technology are not being measured or evaluated, satisfaction may be less than optimal. Such underutilization is surprising for a profession that takes pride in embracing technology.
GETTING PAST THE SPEED BUMPS
The reasons why audit professionals aren’t taking full advantage of the technology vary. Typically, the first reason cited is cost. But that’s a bit of a stretch given how prices on software, for example, have come down while relatively free or low-cost products like Microsoft Excel have become more powerful for data analytics.
The cost of training is another consideration. Companies often express concerns that employees broadly trained in technology skills are in high demand and fret that expensive institutional knowledge goes with them when they leave the organization. The response is essentially threefold and relates to basic computer application development. Many auditors will “audit” and state that their internal clients are not keeping up with the following:
- Companies should document what is built.
- Companies should use video training that can be referred to by anyone left within the organization.
- Companies should ensure that enough users are trained and that there is a succession plan if the main team members leave the company.
However, some vendors promote the notion that one must spend huge sums on training to do data analytics successfully, implying that bigger outlays lead to richer dividends. We believe in starting on a small scale. Openly look for cost savings – actual cash you can retrieve. You could focus training on one specific area – such as accounts payable – where, at minimal cost with Excel software, it might be possible to find sizable savings for the company looking for duplicate payments or open credits with vendors.
Before getting started, decide on your objectives for using data analytics. Next, develop a training plan that leverages internal knowledge. Training can be provided by a vendor, professional association, or professionally produced webinars. Through just-in-time training, auditors can learn from videos stored on the web, which are geared to specific topics, such as a procurement card audit that looks for data anomalies. Calling up a relevant video that offers step-by-step guidance is much easier than trying to recall what was learned during an all-day off-site class months earlier.
Many auditors return from data analytics training brimming with great ideas, only to find they have no opportunity to apply what they learned. The situation that develops is akin to learning a foreign language: you use it or lose it. Approximately 60% of what’s learned in class disappears when it is not applied regularly.
TONE AT THE TOP SETS THE PACE
A bigger factor stalling the move to data analytics may be a lack of management resolve – no buy-in into the process by the brass. It’s fine to turn to data analytics on a case-by-case basis, but there’s hesitation about mandating its use for every audit. It takes a cultural change to do that, as many organizations remain comfortable with the way they have always operated in the past.
Real change is driven by the chief audit executive or vice president supporting the technology. Many companies only pay lip service to data analytics, observing: “We own a software tool, so we must be on the right track.” But when you look closely at what their employees are doing with the software, you realize that they are just taking very simple samples.
The sudden collapse of Enron spurred the American Institute of Certified Public Accountants (AICPA) to issue a risk alert on tests that every CPA should be doing in the general ledger.
Auditors, however, have no mandate requiring they leverage technology. The Institute of Internal Auditors (IIA) standard contains advisory language: “In exercising due professional care, internal auditors must consider the use of technology-based audit and other data analysis techniques.” The IIA must strengthen the wording from “must consider” to “must.” It’s a direction the IIA needs to go in, as it did earlier with fraud.
Many auditors have not even begun inventorying the technology tools at their disposal. In order to assess where the department is and where it should be, auditors need to start with a baseline assessment. This could explain why auditors frequently use data analytics only on an ad hoc basis. They don’t know the extent of the technology skills of their staff, and some organizations even have an issue getting access to data. Remember the old saw, “He who has the data has the power?”
A MATTER OF COMMUNICATION
Internal auditors need to communicate with data owners and IT departments. Auditors must overcome any reluctance to get a hold of data and fear they might misinterpret it or run their data analysis on a live system (as opposed to working with a copy).
It takes an influencer to step to the forefront and declare, “There’s a better way of doing things, and data analytics is that way.” It’s something we can’t assign to an IT audit department or an IT auditor. Rather, it needs to be something that every auditor is using and thinking about and has the capability of performing. Staff auditors should be proactive and start early in the planning process, thinking about how they can employ technology to improve and facilitate upcoming audit assignments. Technology can be applied to risk assessment, planning the annual audit schedule and projects, fieldwork, reporting and follow-up. While many auditors will feel this is a lofty goal, starting with Microsoft Excel and, more specifically, Pivot tables, any auditor can leverage analytics.
Data analytics can offer many benefits, including improved audit quality due to greater coverage and broader perspectives. When working with an approval code, an auditor can scour the entire data file in the system and prepare a comprehensive approval analysis, looking at key exceptions in the approval process instead of examining only a selected 50 items. The auditor could get coverage from a broad array of perspectives: from the point of view of the trend in terms of the day, time, frequency and people doing the approvals or approvals by the same person entering the transaction.
While audit efficiency itself should get better over time, don’t expect measurable improvement in the first year because of the initial learning curve. Auditors will find themselves involved in many standard audit procedures, plus new activities associated with the shift to continuous data analytics.
WHAT’S NEXT?
If we expect a paradigm shift during the use of technology, we need standards, action plans and guidance coordinated through a task force of professional associations and audit consulting firms. In this regard, AuditNet survey respondents cited a six-step action plan for auditors:
- Prepare an inventory of technology tools and create a matrix linking tools to activities.
- Perform a gap analysis to determine target areas for improvement and determine financial resources required for software, training and maintenance.
- Conduct technology skills inventory for current staff and perform a gap analysis.
- Acquire technology for target areas if not already purchased.
- Develop an implementation strategy to integrate technology into each phase of the audit process.
- Assign a technology champion to be the point person and have a succession plan in place.
Data analytics in the audit process consistently get pushed off to the following year’s plan. By taking small steps now, auditors can gain quality improvements, new perspectives and ultimately, a trend toward regular monitoring of their company’s processes.
Learn more about data analytics by exploring these related tools on KnowledgeLeader: