John Verver, CPA CA, CISA, CMC

Advisor to ACL


Not the same old audit survey report

It is very good to see that the 2017 North American Pulse of Internal Audit report from the Institute of Internal Audit’s (IIA) Audit Executive Center addresses an issue that needs far more attention than it has received in the profession to date.

For years, survey reports from the IIA (as well as the Big 4) have been referring to the importance of analytics in internal audit and reported on CAE’s expectations that their teams will start to use analytics on a far more widespread and advanced basis. However, the same reports have indicated, year after year, that the majority of audit teams are still only using analytics at a relatively basic level.

It’s good to see that the 2017 Pulse report addresses this issue head-on by singling out data analytics as one of two areas that the report covers “where internal audit leaders have identified ongoing challenges.” The section on audit analytics starts by saying that:

“If CAEs were to audit their own data analytics practices, many would not have positive results.”


The importance of recognizing that analytics should be implemented and managed as a program

The report refers specifically to some of the critical factors in implementing a data analytics program. This in itself is a bit of a breakthrough—recognition that implementation of analytics needs to be considered as a program. Successful use of audit analytics involves a lot more than acquiring some software and sending some audit team members on a training course.

Look at the way software technology, particularly big data analytics, have transformed business processes such as marketing, sales and product management. This level of transformation obviously involves setting goals and objectives, developing and following a serious project plan and reworking many aspects of processes and how people are organized. Somehow, many audit teams seem to have missed doing the very things that they would expect any business area to be doing in order to successfully implement technology and new processes.

Good advice on getting audit analytics up on its feet

The report gives some good advice on implementing a data analytics program:

“Planning and structure are important precursors to internal audit’s effective use of data analytics. To properly implement a data analytics program, CAEs should:

  • Include data analytics in the internal audit strategic plan to help ensure the activities are properly positioned, coordinated, and resourced.
  • Establish a process for incorporating data analytics into department planning and specific audits to promote consistent, efficient, and focused use.
  • Determine the resources needed to successfully implement data analytics. Consider the quantity (time) and quality (competency) of human resources, as well as the tools needed.
  • Consider whether the organization’s IT infrastructure can support internal audit’s data analytics activities. This includes the data storage capacity, availability of data, and internal audit’s ability to segment and protect data from unauthorized access (as necessary).”

A realistic assessment of where most audit teams are in their use of analytics…

The survey results show that the majority of audit teams that are still struggling to advance their use of analytics have done little to address these points. The Pulse report points out that:

“as organizations gain more experience with data analytics, they understand the value of having the right planning and structure in place. However, even the most frequent users of data analytics have not always completed these tasks, increasing the likelihood of inefficient or ineffective data analytics activities. It is important for internal audit to plan strategically and ensure that a sound IT infrastructure, established processes, and ample trained resources are in place before moving forward.”

What needs to be done?

The report also includes a number of other excellent takeaways that I think are well worth calling attention to here:

“Data analytics can be of great value to internal audit, but its use must be planned, structured, and executed properly.

  • Consider all the possible ways that internal audit can use data analytics. Avoid focusing only on detailed analysis to supplement routine audit approaches. Consider using data analytics more fully in developing the department audit plan and as a replacement for traditional audit methods.
  • Identify the components needed for a data analytics programs. Such components likely include a clear objective, defined processes, skilled practitioners, quality data, and adequate IT platforms.
  • Fill the gaps that could derail a data analytics program before fully implementing. Everything does not need to be perfectly in place to start a data analytics program, but some fundamental aspects are critical. Start experimenting in data analytics to establish the scope, methods, processes, and talent needed, but don’t consider a pilot program complete without filling the gaps.
  • Establish stakeholder relationships necessary to build an effective data analytics program. Work with IT, risk management, compliance, human resources, and other internal stakeholders to address IT infrastructure, processes, and resources. Work with internal and external stakeholders (including management and the board) to understand how internal audit can leverage data analytics to serve stakeholder needs.
  • Document the approach to data analytics in the internal audit strategic plan. A data analytics program can provide tremendous benefits. Ensure the efforts are not only well planned and documented, but also communicated to key stakeholders through the internal audit strategic plan.”

Plus: my 5 extra ingredients for the secret sauce

In my experience, virtually all of the audit teams I know that have come close to realizing the full potential for audit analytics have addressed the above. But, to expand on the above, I would also add in the following additional five factors that I have witnessed as critical to successful implementation of an audit analytics program, including:

  1. Develop a strategy and objectives for the use of audit analytics that includes a range of specific goals, together with corresponding metrics that can be used to measure progress on achieving outcomes.
  2. Manage the implementation process by working to a plan, having one person responsible overall for its achievement, assigning responsibilities and scheduling activities.
  3. Map out the five or so key stages in the audit analytics process, and identify roles and responsibilities around each stage (from accessing and managing data through to designing and managing analytics).
  4. Identify when, where and how analytics are to be integrated into the different stages of the audit process.
  5. Make informed decisions around critical technology requirements, particularly in terms of integrating analytics closely into the entire audit and risk management process.

Many audit leaders were simply not aware of the issues

If every CAE was aware of the importance of these issues, I think the internal auditing profession would have already made a lot more progress in audit analytics. However, I suspect that the reality is that many CAEs have thought of audit analytics as being not significantly different to using spreadsheet software, or generic query software — the “it’s just a tool, how difficult can it be…” sort of attitude.

One of the other common challenges that I have seen over the years is over-reliance on specialists. Having a brilliant analyst on board can, unfortunately, turn into something of a double-edged sword. On the one hand, finding that one person who really “gets” analytics can be very powerful—they can do some very impressive things that turn on many auditors and audit leaders to the potential of analytics. On the other hand, specialists can turn out to be a one-person show who do not necessarily understand the bigger picture issues and objectives and the full potential for transformation of the audit process. And if they leave — the whole use of audit analytics can easily turn out not to be sustainable. Rather, consider audit analytics as a team sport.

It’s been a long time coming … but better late than never

I have to admit to many years of personal frustration in seeing the same old audit survey reports on data analysis—constant recognition of the benefits, but nothing like the progress that could have been achieved. Now, I finally feel genuinely confident that the Pulse report indicates something important has happened. Kudos to the IIA and the Audit Executive Center for producing this valuable guidance. It is time this message gets to every audit leader and manager.

Get your hands on the 2017 North American Pulse of Internal Audit report here.

Share This