Internal auditing ramping up its data science and analytics efforts
The growing ability to capture, assess and analyse data is spurring audit leaders to rethink their traditional audit models and approaches, according to a study by Protiviti. Data based decision making is the largest area gaining momentum – as it stands, two third of internal audit functions now employ some form of data analytics in audit processes, but, there’s a long road ahead.
The report, titled ‘Internal Audit Capabilities and Needs Survey 2017’, asked more than 900 internal audit professionals globally to indicate their ambitions and maturity in the area of data analytics. The authors chose to zoom in on the topic in the eleventh edition of their annual survey as data analytics over the years has grown from a hype to a mainstream part of cutting edge operations. “The pace of change in our world is having a dramatic impact on how organisations operate. Internal audit professionals must be adept in applying new tools and techniques to understand and manage risk. The use of advanced data analytic techniques is the runaway winner as a best practice of the future,” remarks Brian Christensen, an Executive Vice President at Protiviti.
The study finds that data analytics is gaining a foothold in internal audit – two out of three departments utilise the technique as part of the audit process, seeking valuable improvements, efficiencies and insights buried within internal workflows and cultural habits. Compared to a year ago, 73% of the respondents say that demand for analytics related services to support audits has increased, with 20% citing a marked increase. At companies where data analytics is a dedicated part of the governance (i.e. a separate team or function), the growth in demand was significantly higher, at 80%, with an 11% higher percentage score for ‘significant increase’.
Data analytics maturity
The swift rise in demand and capability uptake means that, across the board, maturity is still relatively low. Most internal audit shops find themselves in their analytics infancy, with a strong majority of respondents judging their analytics capabilities to be at the lower end of the spectrum. Only 10% of those surveyed believe they can place their own performance in the top two maturity stages on a 5-point scale, described by Protiviti as ‘Managed’ (the process is quantitatively managed in accordance with agreed-upon metrics) and ‘Optimised’ (process management includes deliberate process improvement).
The low maturity comes with an opportunity cost, find the authors. According to the survey’s participants, the value that internal audit departments receive from utilising data analytics currently stands at 6.9, indicating that investments are paying off. “Many of the organisations that are already employing data analytics within their audit departments are beginning to experience significant value in the results,” states Christensen. Not surprisingly, the benefits derived from data analytics are found to correlate with maturity. Organisations with a dedicated analytics function score a 7.7, while those positioned in the two highest stages report a score of 8.1. This is according to the researchers the result of a more integrated approach (“they use analytics more pervasively throughout their audit plans and processes, enabling them to glean more value”), and a more dedicated team and skillset in place, among others.
“Although they are in the minority amongst their peers, internal audit functions with mature auditing programmes are achieving impressive benefits. These include strengthening risk assessments; more effectively tracking fraud indicators and key operational indicators; enabling a real-time view of organisational risk; and conducting risk-based audits,” comments Christensen.
Continuous monitoring is an important area which separates the wheat from the chaff. The approach, which helps audit functions serve the business more proactively opposed to the traditional retrospective way of working, can add value to a range of dimensions, including risk assessments, audit planning/scoping, the valuation of risk control self-assessments and the monitoring of operational key risk indicators. An area in which its value is heralded to be a potential game changer is in fighting digital and cyber risks, which are costing organisations billions in damages annually, and in turn has spiralled to the top of Chief Finance and Risk Officers’ agenda’s.
Among audit functions that use analytics, only 37% apply continuous auditing. Among organisations that have attained a ‘Managed’ or ‘Optimised’ state of maturity, the uptake of continuous auditing, which is becoming increasingly more feasible as innovative technologies enter the stage, stands at 62%.
Furthermore, a deeper drill-down, among functions that employ continuous auditing, just 15% deploy “very mature” processes that span the full breadth of the business. “The developments are promising, but more progress with continuous auditing is needed,” says Christensen.
Jumping on the bandwagon
Against the backdrop of the booming technology scene and widening possibilities unleashed by data science, audit executives and managers are betting big on ramping up their analytics capacities. Of the group of respondents that currently do not apply analytics within the audit process, two thirds (64%) say they plan to do so within the next two years, while, among those that have already embraced the methodology, 34% highlight they are planning to add analytics headcount.
The road to a more mature operation is set to however come with a number of challenges. Identifying where data resides is a challenge for 60% of organisations, as are system constraints (56%). The source – data – is an issue as well, with only 22% of the respondents rating it to be excellent or good. Other commonly cited bottlenecks include a lack of defined protocols governing the extraction and usage of data, insufficient ability to objectively analyse data (through for instance benchmarks or industry averages) and legacy IT systems, a feat which complicates data warehousing and analysis down the line.
Based on the study’s findings and their decade long track record in the domain, Protiviti’s experts have crafted several recommendations that can help those tasked with building more sophisticated analytics processes with overcoming the constraints. At the heart of the advice stands a clear strategy for analytics, supported by the commitment garnered from organisational leaders. This includes having a roadmap in place, including a business case, as well as plans for investment in skills, tools and expertise. Plans should further recognise that demand for analytics is only set to increase in the coming years, paving the way for an accelerated growth path.
Whilst drafting agenda’s, decision makers are advised to understand the budget and resource constraints, along with business-as-usual workloads, that can limit internal audit’s ability to grow in maturity. The use of carefully chosen and well-crafted pilot programmes herein is key, in particular in realms where even modest demonstrations of analytical prowess can set an influential tone. Teams are further stimulated to explore avenues to expand access to quality data, to implement protocols that govern data management, to either build a team of champions or establish a dedicated function and to implement steps that measure the success / ROI of analytical efforts.
“Using data analytics can be overwhelming for organisations. There may be budget and resource constraints, employees need to learn new technologies and new processes need to be developed. We’ve found that companies need to pick a starting point and get the help they need so that, over time, they can truly optimise their internal audit functions,” concludes Christensen.
A recent study from EY found that legacy IT is mounting pressure on reporting effectiveness, while another white paper on data highlighted that also the HR function is increasingly embracing HR analytics and reporting.
