Internal auditors have weighed the benefits of data analytics software since the earliest versions of the technology began to surface nearly two decades ago. The conversation has continued even as the tools have grown in sophistication and become more pervasive on Windows-based systems.
Yet, even though many professionals believe data analytics can add value by helping auditors detect errors, uncover fraud, and find opportunities to enhance operational efficiencies, widespread migration in that direction has proceeded slowly.
Early adopters largely use analytics sporadically, on an ad-hoc, case-by-case basis, according to results of a survey of 1,500 auditors that AuditNet released in September 2012. Currently, only a small percentage of audit functions use data analytics tools and techniques on a routine basis. An even smaller percentage embedded data analytics into their processes where they might be considered at the highest level of maturity.
The survey found that auditors not using the technology on a repetitive or continuous basis may miss seeing a positive impact on results. And if results from the use of audit software technology are not being measured or evaluated, satisfaction may be less than optimal.
Such underutilization is surprising for a profession that takes pride in embracing technology.
GETTING PAST THE SPEED BUMPS
The reasons why audit professionals aren’t taking full advantage of the technology vary. Typically, the first reason cited is cost. But that’s a bit of a stretch given how prices on software, for example, have come down while relatively free or low-cost products like Microsoft Excel have become more powerful for data analytics.
The cost of training is another consideration. Companies often express concerns that employees broadly trained in technology skills are in high demand and fret that when they leave the organization, expensive institutional knowledge goes with them. The response is essentially threefold, and relates to basic computer application development. Many auditors will “audit” and state that their internal clients are not keeping up with the following:
1. Companies should document what is built
2. Companies should use video training that can be referred back to by anyone left within the organization
3. Companies should ensure that enough users are trained and that there is a succession plan in case the main team members leave the company
However, some vendors promote the notion that to do data analytics successfully, one must spend huge sums on training, implying that bigger outlays lead to richer dividends. We believe in starting out on a small scale. Openly look for cost savings – actual cash you can retrieve. You could focus training on one specific area – such as accounts payable – where, at minimal cost with Excel software, it might be possible to find sizable savings for the company looking for duplicate payments or open credits with vendors.
Before getting started, decide on your objectives for using data analytics. Then, develop a training plan that leverages internal knowledge. Training can be provided by a vendor, professional association or through professionally produced webinars. Through Just-in-Time Training, auditors can learn from videos stored on the Web, which are geared to specific topics, such as a procurement card audit that looks for data anomalies. Calling up a relevant video that offers step-by-step guidance is much easier than trying to recall what was learned during an all-day off-site class months earlier.
Many auditors return from data analytics training brimming with great ideas, only to find they have no opportunity to apply what they learned. The situation that develops is akin to learning a foreign language: you use it or lose it. Approximately 60 percent of what’s learned in class disappears when it is not applied on a regular basis.
TONE AT THE TOP SETS THE PACE
A bigger factor stalling the move to data analytics may be a lack of management resolve – no buy-in into the process by the brass. It’s fine to turn to data analytics on a case-by-case basis, but there’s hesitation about mandating its use for every audit. It takes a cultural change to do that, as many organizations remain comfortable with the way they have always operated in the past.
Real change is driven when the chief audit executive or audit vice president supports the technology. Many companies only pay lip service to data analytics, observing: “We own a software tool, so we must be on the right track.” But when you look closely at what their employees are doing with the software, you realize they are just taking very simple samples.
The sudden collapse of Enron spurred the American Institute of Certified Public Accountants (AICPA) to issue a risk alert on tests that every CPA should be doing in the general ledger.
Auditors, however, have no mandate requiring they leverage technology. The standard of the Institute of Internal auditors (IIA) contains advisory language: “In exercising due professional care, internal auditors must consider the use of technology-based audit and other data analysis techniques.” It is important that the IIA strengthen the wording from “must consider” to “must.” It’s a direction the IIA needs to go in, as it did earlier with fraud.
Many auditors have not even begun inventorying the technology tools at their disposal. In order to assess where the department is and where they ought to be, auditors need to start with a baseline assessment. This could explain why auditors frequently use data analytics only on an ad-hoc basis. They don’t know the extent of the technology skills of their staff, and some organizations even have an issue getting access to data. Remember the old saw, “he who has the data has the power?”
A MATTER OF COMMUNICATION
Internal auditors need to communicate with data owners and IT departments. Any reluctance to allow auditors to get hold of data for fear they might misinterpret it or run their data analysis on a live system (as opposed to working with a copy) must be overcome.
It takes an influencer to step to the forefront and declare, “There’s a better way of doing things, and data analytics is that way.” It’s something we can’t assign to an IT audit department or IT auditor. Rather, it needs to be something that every auditor is using and thinking about, and has the capability of performing. Staff auditors should be proactive and start early in the planning process thinking about how they can employ technology to improve and facilitate upcoming audit assignments. Technology can be applied for risk assessment, planning the annual audit schedule and projects, fieldwork, reporting, and follow up. While many auditors will feel as though this is a lofty goal, starting with Microsoft Excel and more specifically, Pivot tables, any auditor can leverage analytics.
Data analytics can offer many benefits, including, most notably, improved audit quality due to greater coverage and broader perspectives. Working with an approval code, an auditor could scour the entire data file in the system and prepare a comprehensive approval analysis, looking at key exceptions in the approval process instead of examining only a selected 50 items. The auditor could get coverage from a broad array of perspectives: from the point of view of the trend in terms of day, time, frequency and persons doing the approvals, or approvals by the same person entering the transaction.
While audit efficiency itself should get better over time, don’t expect measurable improvement the first year because of the initial learning curve. Auditors will find themselves involved in a lot of standard audit procedures, plus new activities associated with the shift to continuous data analytics.
If we expect a paradigm shift in use of technology, we need standards, action plans and guidance coordinated through a taskforce of professional associations and audit consulting firms.
In this regard, AuditNet survey respondents cited a six-step action plan for auditors:
Prepare an inventory of technology tools and create a matrix linking tools to activities
Perform a gap analysis to determine target areas for improvement and determine financial resources required for software, training and maintenance
Prepare a technology skills inventory for current staff and perform a gap analysis
Acquire technology for target areas if not already purchased
Develop an implementation strategy to integrate technology in each phase of the audit process
Assign a technology champion to be the point person and have a succession plan in place
Data analytics in the audit process tend to get pushed off to the following year’s plan on a consistent basis. By taking small steps now, auditors can gain quality improvements, new perspectives and ultimately, a trend towards regular monitoring of their company’s processes.
This article was written by Jim Kaplan and Richard Lanza.