The site of your next audit?

Chief Audit Executives (CAEs) have repeatedly stated that data analysis expertise is a much-needed skill in internal audit, and surveys by the Institute of Internal Auditors (IIA) over the past 10 to 15 years have rated data extraction, data analysis, and analytical software as critical tools for effective internal audit organizations. Why then do more than half of internal audit shops—according to those same surveys—still rate their analytic capability as poor or needing improvement? The answer is that they have not approached data analytics with a clear plan of action.

I have been a user and advocate of analytics for 28 of my 30 years as an internal auditor. It was during the first two years of auditing that I realized I could do a better job by analyzing data. Since then, I have been asked hundreds of times: "How can we develop and maintain an analytics capability?" Too often CAEs give up without even trying. "We are doing good audits now, why change things?" they say. Others make only a feeble attempt at it. Another common scenario? "Let's get a programmer right out of college and have him, or her develop analytics for us."

The reality is that change is difficult. As internal auditors, we are constantly making recommendations to help others improve, transition, or do more, but we stick with traditional auditing tools and techniques. Perhaps what is needed is a taste of our own medicine.

It Starts with a Plan
We can't simply wish data analytics into existence or hope that it will crop up organically. To successfully integrate data analysis into the audit process you must have a formal development and implementation plan. The plan must address the need for staffing at the appropriate level and number; technology, including software; and processes and the data around those processes.

It also takes a real commitment; you will need to change the way you currently perform audits. It must also have a project manager who will be held accountable for the delivery of the plan, clear objectives, milestones, and a reporting requirement. Reporting should go to the CAE and the audit committee, but only if the audit committee fully supports the adoption of analytics.

Analytics also requires an understanding of the business processes, the data supporting them, and a solid grasp of internal auditing processes and requirements, including the application of the IIA professional standards. None of these will be provided by junior level auditors or programming resources. Rarely will all these skills exist within one individual, and they might not already exist in your audit organization. Rather than being an impediment, this should be seen as an opportunity to obtain the right resources and task them with a clear objective.

If you are lucky and have the appropriate type of resources in your organization already, then you are ahead of the game. Existing personnel should already know the business processes and have the internal audit skills, and perhaps have some analytical capabilities. However, they will need to be supported by training and software, and given sufficient time to develop the skills and implement the analytics functionality. Most importantly, they will need to be dedicated to analytics. Otherwise, you end up pulling valuable resources away from other priorities and tasking them with something in addition to what they are already doing; or settle for a subset of the required skills. In either case, it is a recipe for failure.

A statement I hear often is: "We are a small audit organization, and we can't afford to dedicate a person to analytics." Indeed, lack of staff is a common rationale for not using data analytics. But does having a small team mean you can afford to be less efficient and effective? The reality is unless you are using analytics, you are not addressing risk, testing controls, examining compliance, and improving business operations to the extent that you could be. If you are going to decide not to use data analytics, at least make it an informed decision. Examine the costs and benefits and then decide. Don't simply look at your existing resources, which are most likely being used to the maximum, and decide that you can't take on anything else. It is not a question of doing more with the same resources. Ask yourself if there are things that you don't need to be doing or if they are better ways to do what you need to do. Also look at what you are not doing and determine the value-added if you could do those things. Then decide if you can afford not to be using data analytics.

Which Software Package?
A common questions for internal audit departments just starting out on data analytics is which software package to use. The answer should be decided based on your requirements and your short- and long-term plans for analytics. Start by leveraging existing capabilities such as standard reports and Excel, but don't be limited by what you have. Experiment, and when you exhaust your current capabilities look elsewhere. Find out what other audit organizations are using. There are many options, including ACL (which I use), Tableau, SaS, TeamMate Analytics, and many others.

Regardless of the software package you choose, you should be using data analysis. You will need to plan and manage your adoption of analytics, and it will take time, resources, and technology, but the benefits are endless. It also must be integrated into every phase of the audit process—including planning, fieldwork, reporting, and follow-up —and should be developed with an understanding of the business processes and the underlying data. It is easy to do it wrong, but worth doing right.

It's time we move on from the "why" of data analytics and get down to doing it. Get off the fence and actively pursue it. The successful implementation of analytics will add significant value to the internal audit function and your ability to support the goals and objectives of senior management.

Looking for more information on data analytics? See MISTI courses, Successful Audit Data Analytics or Using Data Analytics Throughout the Audit Process. MISTI also offers courses on using ACL.