Internal audit, as the third line of defense in the organization, usually delivers value in the form of providing assurance or advisory opinions to first and second lines of defense. But such value can only be realized after gaining buy-in from C-level executives and being factored into their decisions. As executives are held accountable for their decisions, any recommendations to them, including those from auditors, will be required to provide proof, for which data and analytics play an indispensable role.
But for auditors, this is more than just making audit reports look more data-savvy – it has to be built upon a data-centric culture deeply rooted across the entire audit function. Culture is never built in one day; it is an ever-evolving journey. Here are five key things to watch in this journey:
#1 Ask good questions
Today, with growing digitalization in the business world, there’s simply too much information available to internal auditors – what they need is knowing where to focus. This is especially crucial given that internal audit function is just a small fraction of the organization’s workforce and is most likely outnumbered by the rest of the organization in terms of analytics resources. Auditors need a holistic approach to identify, quantify and ascertain risks arising from areas of audit concern in an efficient manner.
There’s never been a better way to kick-start an audit analytics endeavor than by talking to seasoned professionals involved in day-to-day operations of audit interest. If auditors are able to understand every step of the business process and the digital “footprints” left behind, they have gained unprecedented insights into noteworthy controls, pain points and challenges that audit analytics can dive into.
#2 Start small and show value
A data-centric culture requires professional judgements to be made not solely upon past experience and preconceptions, but also upon concrete and verified facts. This is a mindset change for auditors who are used to a checklist audit approach, i.e. strictly following existing audit procedures without thinking about the context through exploratory data analysis.
The best way to accelerate this mindset change is to pick a small but significant problem that the internal audit function faces and then work to improve it through analytics. This problem may not be the most mission-critical one to the team but should be something that can add demonstrable value unlocked by analytics. Once successful, this approach should not be limited to only silos of audit teams but should instead be rolled out across all audit teams.
#3 Make sure goals are clearly understood
For an analytics-focused culture to deliver justifiable values, any projects or initiatives undertaken need to have clear goals and the whole audit function needs to be aligned around the goals. This alignment is not easy to achieve since internal auditors have to adapt to varying levels of data maturity in different stakeholders they deal with. Audit analytics has to be performed on data sourced from business units or upstream systems of audit interest, rather than data generated by the audit function itself.
Different audit teams may get started on different level playing fields, depending on the structure, richness and quality of data as well as data culture itself residing within respective business units. One caveat is to seek support from business units on building audit analytics together, which could provide them greater visibility into audit opinions and allows for more constructive communication for follow-up actions. Hopefully this would create win-wins between audit teams and business units.
#4 Balance transition to analytics with your gut
Instilling change in organizations of any size takes time, with both change champions and cynics coming along the way. While analytics is about proving whether people should trust their guts, it is not about eliminating guts completely. Change should start with balancing people’s instincts and guts with small, data-driven initiatives that can generate measurable results quickly. The true test to this balance lies in moving KPIs of individual audit teams or auditors so they can be integrated into the shift toward an analytics-focused approach.
#5 Ensure transparency
If data analytics is to be used for driving audit judgement, it is important that decision-making frameworks are established so that the whole audit team can find repeatable strategies for the use of analytics in audit projects. This will help to reduce the need for case-by-case deliberation by individual teams regarding whether analytics being used is sufficient and reliable for an audit conclusion. This is even more important considering that auditors may have different preconceived notion about analytics.
After all, data culture is about empowering auditors to make better informed decisions and take on more responsibility once they have the data to supercharge them. It’s a challenge to unleash new potential of auditors and their work, so have fun!