Rob Turnbull

Audit Data Analyst II

Coming from a military background, there’s a term frequently used to describe being able to do more and more with the same or limited resources: “force multiplier.” A force multiplier can be any combination of technique, tool, environment, and training—and that’s what ACL has been for me, my team, and my organization.

I’d like to share a little about my group’s voyage with ACL. Like everything, my journey using ACL starts from the beginning, and like many of you have experienced, getting from there to here with a new software tool often comes with several challenges, a few setbacks, and (hopefully) many successes.

My first steps: Getting the organization on-side

I started doing continuous auditing four years ago. It was my first time working in internal audit at a financial institution, and my first time using ACL software. In those four years, our Internal Audit department didn’t really grow in terms of headcount, yet the demand for data reporting increased dramatically—from a modest 15 or 20 ACL reports tracked in Excel, to a very diverse and extensive report library.

This increased demand gave birth to the first set of difficulties that I had to overcome.

Within my organization, I was (and still am) the primary user of ACL. In fact, up until recently, I was the only user. So resource- and impact-wise, that meant things like version upgrades, patches, connectivity, and a myriad of other support needs were given low priority.

There also isn’t any continuity on the support knowledge side, often requiring additional effort to re-educate a new person on the intricacies of ACL.

The following are some of the shortfalls I faced within my organization and some of the ways that I was able to overcome them:

  • Staff turnover.

    Turnover of personnel will always happen. I was working with one person in IT in the beginning, but when that person left, all of their experience left with them. It brought home the importance of involving multiple people whenever there was any ACL troubleshooting, fixes, and upgrading to ensure good continuity of ACL support knowledge.

  • Technical issues and documentation.

    Documenting technical issues and resolutions as completely as possible (for both internal and external/ACL support tickets) and keeping them in one place is critical. This has also had a secondary benefit of having a repository of issues particular to my data and install environment.

  • The unexpected.

    It’s beneficial to be as involved as possible when something out of the ordinary happens, and then observe and note how it was resolved. Exposure to the non-routine can sometimes lead to an epiphany on how to do things better or more efficiently in the future. I have learned more about the different ACL applications than I would have otherwise, which has led to increased ACL support and adaptation within my enterprise.

Growing: Implementing new and better solutions

As my skill and experience with ACL deepened and matured, internal audit found itself outpacing its foundation. We used to operate our AX server using physical hardware. This was expensive, slow, and growth-limiting.

After upgrading our hard drives for the second time, the decision was made to move to Azure and take advantage of the platform’s speed and scalability. At the time, we were among the first to do so and there were some pitfalls. It’s always disruptive when upsetting the status quo, but there were also firewall and software compatibility issues, challenges coordinating two organizational support teams, a knowledge shortfall, and other unanticipated hurdles.

But it was totally worth it.

My successes: Community, resources, growth, and agility

A final (and ongoing) effort is the transition our business unit partners made from an Excel environment to the GRC platform. Organizational paradigms are always hard to shift, especially when the benefits and the end goals are hard to visualize. Efficiency and reliability are great concepts, but the effort and change management required to get there can be a major demotivator.

To remove roadblocks and to stay engaged, I leverage the online ACL Community and ACL’s internal support team. Chances are that if there’s a challenge or difficulty I’m facing, I’m not the first one to confront it. I’ve learned that it’s okay to ask questions and solicit ideas from others. In fact, I’ve had opportunities to pay that assistance forward by helping others in the forums, sharing my experiences, and providing answers to the same questions I’ve asked in the past.

One of the highlights of my experience with ACL is just how much the community fosters engagement and collaboration. It has been amazing how helpful the ACL consultants, support team, the forum, user group members, and ACL Connections dialogs have been. As force multipliers, everyone in these groups has been an enabler, a motivator, or a teacher. In addition, the pre-built scripts in Script Hub and the courses from ACL Academy have made my reports better, faster, and more user-friendly.

ACL has made me a resource that others seek out.

Perhaps it’s my position and visibility that is partly responsible for that, but I genuinely believe that it’s primarily because ACL allows me to be more agile in response times, notification and dissemination options, researching and experimenting, and the repeatability and validity of results generated. In return, I have gained more exposure to different processes, controls, data sources, and collaborators. In fact, using ACL eventually made me so much of a resource that I had to scale back on how much I could support other business units.

What’s next for me and ACL

Four years of association with ACL has benefitted me in many ways, both personally and professionally. “Growing” with the software through the last several iterations has given me positive experiences and insights that can’t be taught. It gave my department the flexibility and resources needed to build a robust continuous monitoring program from scratch, and simultaneously provided me with confidence and a greater understanding of logic and analysis. I’m excited to see where the newest version takes me and the user community as a whole. With AI and machine learning still on the distant horizon for many, we have the opportunity to experience it now and make it part of our DNA. That’s great stuff.

eBook: Don't navigate risky waters without internal auditors

Don’t Navigate Risky Waters Without Internal Auditors

This eBook gives guidance on leveraging data analytics for risk management, including risk-based audit planning, example analytics for identifying risk, and real customer stories.

Download eBook

Share This