Audit Analytics: How to Use Data for Internal Audits & Why It’s Important

Having a sound data analytics function within the internal audit department is increasingly critical as the world continues its drive toward digitization. Tools and trends like big data, cloud computing, robotics and automation, machine learning, and artificial intelligence are altering how businesses operate, and internal audits should be no different. The traditional audit approach of substantive testing using sampling will continue to be a key tool in the auditor’s arsenal, but internal audit departments can magnify their impact by building an audit analytics team and embedding data analytics into their audit methodologies.

Wondering where, or why, to start? This post will attempt to answer those questions and more. While this post focuses on the use of data analytics in the context of an internal audit department (hereafter referred to as audit analytics or just analytics), these ideas can also be applied to using analytics in first- and second-line groups.

What are Audit Analytics?

Audit analytics are audit tests performed using data and software rather than traditional substantive testing procedures. The testing is performed via computer rather than reviewing evidence in physical form. If performed properly, the test procedures are automated and only outliers or potential exceptions require manual review and investigation.

 

What are the Benefits of Performing Audit Analytics?

Creating an audit analytics function requires an investment in people, processes, and tools. It is therefore important to understand the benefits that can be achieved and why they outweigh the costs. Some of the benefits include:

• Efficiency – Data analytics can be much more efficient than traditional substantive testing using samples. This is especially true after the initial creation of the analytics since audit analytics can be automated and run on a continual basis with little or no manual effort other than reviewing outliers and results.
• Effectiveness – Audit analytics can provide full coverage for an entire population, eliminating drawbacks of sample testing like sampling error, and providing greater assurance.
• Coverage – Auditors must limit the scope of their audits due to the scarce resources of time and personnel. These scoping decisions occur both in creating the annual audit plan and within individual audits. Because of increased efficiency and effectiveness, audit analytics can free up audit resources to do other things. This enables increased coverage of risk since scopes can be enlarged to address more auditable entities and business processes.
• Regulator Expectations – An audit analytics function is increasingly becoming an expectation by regulators. Creating this function and embedding it in the audit process demonstrates proactivity and competence in managing risk and compliance.

 

What Challenges Do Auditors Face When Using Audit Analytics?

Each internal audit department is unique and will need to evaluate the environment they work in to determine the best way forward in building an audit analytics function and the level of investment required. Consideration will need to be given to the areas of people, processes, and tools.

People

Getting the right people in with the right experience in the right places is key to the success of audit analytics. Thought and effort should go into staffing the various levels involved, including:

• Audit Executives – Success starts with the tone at the top. Audit analytics teams need the support of audit executives who understand the benefits analytics can provide and who have the authority to drive the necessary methodology changes for the adoption of analytics. Without support at the highest levels within the internal audit department, the audit analytics effort is likely to fizzle.
• Audit Analytics Team Leader – The audit analytics team leader oversees the audit analytics team. This person should have a seat at the table with audit leadership and be seen as an equal with the leaders of other audit teams within the department. It is helpful if this person has an IT or data background in addition to an audit background. This enables them to understand the challenges of dealing with data.
• Audit Analytics Team – Finding people with the right experience to be able to execute the audit analytics testing can be challenging. However, people with audit analytics experience can be found. Success has also been found by identifying IT auditors who have an interest and aptitude for analytics and transitioning them into the audit analytics function.
• Analytics Champions – The adoption of audit analytics can be accelerated by identifying individuals on other audit teams to serve as audit analytics champions. They can help create a mindset of using analytics within their teams and generate awareness and excitement for using analytics in audit testing.

Processes

The successful adoption of audit analytics will require changes in the audit process. Thought should be given to each phase of an audit department’s audit lifecycle and the department’s methodology should be updated accordingly. Success is most likely to be achieved when there is a simultaneous top-down and bottom-up approach to promoting analytics. Audit executives and leaders provide the top-down momentum by driving the adoption of analytics down their chains of command to the audit teams that report to them. The audit analytics team provides the bottom-up push by advocating the use of analytics, training audit teams on the best use of audit analytics, delivering quality work products, and promoting examples where analytics have made a significant difference in the outcome or success of an audit.

Technology

Audit analytics needs the right tools for the job. The exact tools for data analytics chosen should be left to the discretion of the audit analytics team, subject to company procurement policies and the company’s existing IT environment. Although many options exist, the tools should enable the audit analytics team to extract, manipulate, and visualize data at the scale and volume they are likely to encounter. Many auditors are familiar with products such as ACL and IDEA, but consideration should be given to applications that are not audit-specific and are more modular like SAS, R, or Python (particularly the Anaconda distribution which contains useful Python libraries and simplified installation steps). Using visualization tools like Tableau or PowerBI helps bring audit tests to life and make them more relatable, understandable, insightful, and impactful.

 

How are Audit Analytics Used in the Audit Lifecycle?

Knowing when and how to use audit analytics is something the audit teams should be trained on. Ideas for how audit analytics can be used in the audit lifecycle are provided below.

• Annual Audit Planning
• • Provide insight to help in scoping auditable entities
  • Identify trends that may impact aggregated risk ratings
• Audit Pre-Planning
• • Provide insight to help in scoping the audit
• Audit Planning
• • Review inventory of existing analytics and the results of any continuous auditing tests
  • Re-run relevant prior-year analytics to help provide a sense for the operation of the controls during the audit period, look for outliers, or identify shifts in risk
  • Convene with all the audit teams on the audit to brainstorm the use of analytics in the audit and create the analytics test plan
  • Obtain access to data and systems needed to execute the plan
  • Understanding the availability and reliability of data needed to perform the audit tests
  • Begin executing the analytics as soon as possible rather than waiting for fieldwork to start
• Fieldwork
• • Execute the analytics procedures and provide the results to the audit team
• Reporting
• • Assist the audit team in crafting the wording for issues identified by the analytics team
• Business Monitoring
• • Hold an after-action meeting to discuss how the audit went and lessons learned for using analytics in the future
  • Identify audit tests to be performed on a recurring basis or turned into continuous audit tests
  • Provide support in the tracking and closure of issues identified by analytics

 

How Mature is Your Audit Analytics Function?

Standing up an audit analytics function is a journey of increasing maturity and sophistication. Common steps along the maturity ladder include:

• Level 1 – Population Pulls
• • Audit analytics is focused on pulling populations for internal auditors to sample from.
  • This can be a good first step as it helps audit analytics understand what data is available, how to access it, the quality of the data, etc.
• Level 2 – Targeted Sampling
• • Audit analytics pulls a sample of a population based on criteria specified by internal auditors.
  • This helps ensure internal auditors are testing records that are more relevant or present more risk in a business process.
• Level 3 – Full Population Testing
• • Audit analytics performs testing on an entire population.
  • This is where audit analytics starts providing increased value.
• Level 4 – Visualization and Insights
• • Beyond providing a list of potential exceptions for internal auditors to follow up on, audit analytics provides visualizations, live dashboards, and other value-add work products to help provide insights.
• Level 5 – Continuous Auditing
• • Audit analytics is fully embedded in the audit process and analytics tests are run throughout the audit period rather than during an audit.
  • This is where the up-front investment in creating the audit analytics function truly starts paying off.
• Level 6 – Data-Driven Auditing
• • Entire audits become data-driven and automated without any manual testing.

Conclusion

Audit analytics have the potential to transform internal audit departments. Hopefully, this post has proven that and provided ideas on why and how to implement this in your internal audit department.

If you would like to learn more about data analytics or some of the audit services offered by the experienced auditors at Linford & Co, please contact us.