Not the same old audit survey report
It is very good to see that the 2017 North American Pulse of Internal Audit report from the Institute of Internal Audit’s (IIA) Audit Executive Center addresses an issue that needs far more attention than it has received in the profession to date.
For years, survey reports from the IIA (as well as the Big 4) have been referring to the importance of analytics in internal audit and reported on CAE’s expectations that their teams will start to use analytics on a far more widespread and advanced basis. However, the same reports have indicated, year after year, that the majority of audit teams are still only using analytics at a relatively basic level.
It’s good to see that the 2017 Pulse report addresses this issue head-on by singling out data analytics as one of two areas that the report covers “where internal audit leaders have identified ongoing challenges.” The section on audit analytics starts by saying that:
“If CAEs were to audit their own data analytics practices, many would not have positive results.”
The importance of recognizing that analytics should be implemented and managed as a program
The report refers specifically to some of the critical factors in implementing a data analytics program. This in itself is a bit of a breakthrough—recognition that implementation of analytics needs to be considered as a program. Successful use of audit analytics involves a lot more than acquiring some software and sending some audit team members on a training course.
Look at the way software technology, particularly big data analytics, have transformed business processes such as marketing, sales and product management. This level of transformation obviously involves setting goals and objectives, developing and following a serious project plan and reworking many aspects of processes and how people are organized. Somehow, many audit teams seem to have missed doing the very things that they would expect any business area to be doing in order to successfully implement technology and new processes.
Good advice on getting audit analytics up on its feet
The report gives some good advice on implementing a data analytics program:
“Planning and structure are important precursors to internal audit’s effective use of data analytics. To properly implement a data analytics program, CAEs should:
A realistic assessment of where most audit teams are in their use of analytics…
The survey results show that the majority of audit teams that are still struggling to advance their use of analytics have done little to address these points. The Pulse report points out that:
“as organizations gain more experience with data analytics, they understand the value of having the right planning and structure in place. However, even the most frequent users of data analytics have not always completed these tasks, increasing the likelihood of inefficient or ineffective data analytics activities. It is important for internal audit to plan strategically and ensure that a sound IT infrastructure, established processes, and ample trained resources are in place before moving forward.”
What needs to be done?
The report also includes a number of other excellent takeaways that I think are well worth calling attention to here:
“Data analytics can be of great value to internal audit, but its use must be planned, structured, and executed properly.
Plus: my 5 extra ingredients for the secret sauce
In my experience, virtually all of the audit teams I know that have come close to realizing the full potential for audit analytics have addressed the above. But, to expand on the above, I would also add in the following additional five factors that I have witnessed as critical to successful implementation of an audit analytics program, including:
Many audit leaders were simply not aware of the issues
If every CAE was aware of the importance of these issues, I think the internal auditing profession would have already made a lot more progress in audit analytics. However, I suspect that the reality is that many CAEs have thought of audit analytics as being not significantly different to using spreadsheet software, or generic query software — the “it’s just a tool, how difficult can it be…” sort of attitude.
One of the other common challenges that I have seen over the years is over-reliance on specialists. Having a brilliant analyst on board can, unfortunately, turn into something of a double-edged sword. On the one hand, finding that one person who really “gets” analytics can be very powerful—they can do some very impressive things that turn on many auditors and audit leaders to the potential of analytics. On the other hand, specialists can turn out to be a one-person show who do not necessarily understand the bigger picture issues and objectives and the full potential for transformation of the audit process. And if they leave — the whole use of audit analytics can easily turn out not to be sustainable. Rather, consider audit analytics as a team sport.
It’s been a long time coming … but better late than never
I have to admit to many years of personal frustration in seeing the same old audit survey reports on data analysis—constant recognition of the benefits, but nothing like the progress that could have been achieved. Now, I finally feel genuinely confident that the Pulse report indicates something important has happened. Kudos to the IIA and the Audit Executive Center for producing this valuable guidance. It is time this message gets to every audit leader and manager.
Get your hands on the 2017 North American Pulse of Internal Audit report here.