Article
Leveraging data to drive agility in internal audit
May 19, 2022 · Authored by Ashley Deihr, John Romano
In today’s environment, internal audit teams must aim to make their work more valuable, more efficient and more impactful. Two key interrelated tools internal audit functions can use to achieve these goals are data analytics and agile auditing. Maximizing the use of data can be indispensable for an organization, allowing internal audit to be faster, more flexible and more strategic in its work.
Effective use of data can enable more strategic and timely risk assessment practices, incorporating emerging internal and external risks around which an organization may need to adjust its audit plans. Data analytics further support internal audit to focus and refocus work as risk effects shift, so that the organization’s limited time and resources can be directed toward the biggest, most strategic risks. Additionally, data analysis and visualization can be powerful ways to showcase outcomes with the organization’s board, audit committee and leadership, allowing the audience to more quickly grasp complex issues and address challenges identified.
Recently, Baker Tilly hosted a virtual roundtable of internal audit stakeholders to discuss the intersection of data analytics and agile auditing. Participating organizations represented a multitude of industries and were at various maturity levels in data analytics usage.
During the roundtable, industry breakout groups focused on the impact of data analytics across the audit life cycle, holding in-depth collaborative discussions in the areas of risk assessment and planning, fieldwork and reporting. Flash polls conducted throughout the event revealed a challenge with data quality/access as the greatest obstacle in using data analytics in their internal audit functions, while more dynamic recommendations were cited as the biggest positive benefit.
The groups discussed their goals in leveraging data and agile concepts, what they are doing to develop a data-driven mindset to enhance agility, and success, challenges and lessons learned. The session’s key takeaways are summarized below.
Risk assessment and planning
Get buy-in from stakeholders early:
Stakeholders must understand the value of data analytics and the need for time and resources to successfully leverage data. For example, one organization found success incorporating data analytics in its audit process by getting its audit committee engaged from the start. Now, even when they have hiccups, the audit committee is supportive because they feel consulted and understand the process.
Create or utilize an existing data warehouse and ensure you have clean data to leverage:
Having a central location for individual departments to archive documents can increase the speed and efficiency of performing an internal audit since everything is in one place.
Even if an organization has a data warehouse, if the data isn’t accurate, it’s worthless. The sources, timing and organization should all be reviewed to ensure the data is reliable.
Allow for time:
In all aspects of this phase, time is needed to ensure the correct data is being collected and in the right time frame. Organizations need to make time for training staff in how to properly use their data. They also need to make time to meet with stakeholders on a regular basis.
Fieldwork
Train in order to understand capabilities:
Understanding the possible applications and analysis with data can be challenging, but strong software, dedicated training efforts and time to experiment can help. The goal is for the team to understand the available data and how it can be analyzed and leveraged. This is a continuous learning curve, and that’s OK!
Meet regularly and share successes:
For example, one organization holds monthly refresher courses where team members give hands-on training and share specific analyses used in recent audits. Another offers weekly peer knowledge sharing sessions to discuss how to leverage their available tools and data.
Invest in resources:
In this example, an organization dedicated data analytic specialists within the internal audit team. Another chose to sponsor an individual to earn their master’s degree in data analytics, after the individual expressed an interest in the subject. Others requested IT provide their teams with more powerful laptops to better support analysis of larger data sets.
Reporting
Know the audience:
Some attendees said their audit committees welcomed quantitative analysis and visualization in reporting, while others were content with largely narrative reporting and were only interested in data analysis that demonstrated major issues in the data. Most attendees agreed that an invaluable part of the reporting process and use of data analytics is the collaboration between internal audit and the business owners when identifying opportunities to improve the use of data such as continuous monitoring and new ways to visualize information for management analysis.
Choose wisely:
Identify visuals that will be most helpful for the conversation and the points being made. Visualizations may be most appropriate in the body of the report or in the appendices as reference. Either way, remember that less is more — just because all of that data is there doesn’t mean it needs to be used!
Exercise patience:
It takes time to incorporate data analytics into long-established processes. Start out small, with data sets that could be done in a month or so, report out on that and get the support to move on from there.
Implementing analytics in internal audit
Define your strategy and road map
Prior to implementing data analytics at your organization, it is important to consider the areas outlined below, including these key questions prior to implementing analytics:
- Have you documented your alignment of data analytics strategy with your internal audit strategy and organizational strategy?
- Have you defined maturity in your use of analytics for your department?
- What are your priorities and drivers for implementing or enhancing your data analytics? Establish your priorities and how success will be measured.
For example:
Increased efficiency, by reducing time and money spent. Success will be measured by overall cost savings.
Improved and greater assurance, by using analytics to increase coverage and reduce the margin of human error. For example, success could be measured through an increase in audit universe coverage in a given plan year.
Increased effectiveness, through whole population testing versus random sampling. Success could be measured through improved time to complete an audit, increase in insights provided and/or decrease in error rates over time. - What is considered success after year one, year two, year three, etc. in your use of analytics?
- How will you train and develop your staff to meet your definition of success?
- Which areas are cross functional and will be easier to provide insights? For example, human resources or treasury functions.
- What areas are strategically important?
- What mitigating controls may affect the risk profile of the area? Are they manual or automated controls?
- Have there been previous reports or complaints about an area?
- Which area has the most volume?
- Has the area been reviewed as part of another audit (e.g., internal audit, external audit)? How recently?
- What data sources are available? How reliable are they?
More upfront costs, less time for implementation and results
- Option 1: Hire dedicated in-house data analyst(s)
- Option 2: Leverage initial skill sets by an outside provider or firm and transfer knowledge to the internal audit team over time
Fewer upfront costs, more time for implementation and results
- Institute a training program with a reward system within internal audit for improving data analytics skills and implementing its uses on internal audit engagements.
- Utilize resources within the business areas (finance, compliance, IT, etc.) to assist with analytics on an ad hoc basis or a project management office dedicated analyst.
- Option 1: On a one-off basis to perform an “audit” or prepare for an audit
- Option 2: Periodically, as a monitoring tool (e.g., quarterly or monthly)
- Option 3: Continuously, with red flags sent to the represented department(s) for follow-up
Effective use of data analytics cannot be accomplished without the use of appropriate tools designed to extract data, identify high-risk transactions and showcase trends. The tools to best perform the key tasks related to data analytics include the following:
Baker Tilly has dedicated risk advisory and digital specialists with experience assisting internal audit organizations in maturing their data analytics skills, use cases, and value provided to stakeholders through actionable insights. For more information, connect with us.
