IT Insights Overcoming Hurdles in Analytics
The hurdles of implementing audit analytics and how to overcome them DATA ANALYTICS HAS BECOME the business buzzword du jour over the past few years. Analytics has been hailed as the next technology-enabled revolution that will bring numerous benefits to all organizations. In the world of audit, practitioners have known of analytics for quite some time. Tools such as ACL (Audit Command Language) have existed since at least the early 2000’s, even before the recent media fascination with data analytics. Despite the awareness of these tools, though, and the fervent desire to deploy analytics across the business world in general, adoption of analytics within internal audit is decidedly mixed. According to a survey in 2013, only 31 percent of internal audit functions employ data analytics with regularity even though the majority of chief audit executives surveyed understood the value of analytics.1 It is clear the audit profession has been reluctant to fully embrace the analytics revolution, but what causes this reluctance? What obstacles commonly prevent auditors from starting the path to adopting a fully realized analytics function? Based on our own experience, the main obstacles tend to be: 1. No strategy in place 2. Training employees to use analytics effectively 3. Challenges acquiring data and preparing it for use 4. Identifying where to start once the tools have been installed
Acquiring Data INCORPORATING ANALYTICS IS NOT MERELY a matter of buying the right software or a set of tools. It starts with laying a road map of what the internal audit function wants to achieve with analytics and setting metrics to measure if the goals have been met. A strategic plan should contain milestones so that progress can be measured and corrections can be made if progress is lacking. The initial milestones should involve modest goals since audit staff are in the early stages of becoming familiar with the analytical tools and learning how to use them for basic data capture and preparation. Later phases of the plan can expand the application of analytics to: 1. Implement continuous monitoring 2. Derive deeper and actionable insights for all departments of the organization 3. Create dashboards and visualizations from which others can generate their own insights
1
PwC’s State of the Internal Audit Profession 2013
IT Insights: Overcoming Hurdles in Analytics THERE’S NO DOUBT that using analytics effectively requires auditors to think differently and outside of their comfort zone. Auditors will have to know how to find trends within a data set and test whether correlations exist between two different data sets. Tools such as scatter plots, for example, can be used to determine if a potential relationship between two data sets exists. Colleges have picked up on the analytics trend and are actively providing classes in analytics. This enables students to develop an analytical mindset along with knowledge using tools of the trade, such as ACL or IDEA. In the near future, it’s expected that auditors will have some analytics experience from day one. For working professionals, there are online courses in business analytics that are relatively inexpensive and are of high quality. Coursera is one well known online platform. As for analytics software and tools, training options range from vendor-provided training to third-party training. Many vendors provide some free online training for their products as well as paid training courses. Training from independent third party consultants is also an option and can be less expensive than vendor-sponsored training. Whichever methods of training are used, the best training comes from daily use of the software. The benefits of formal training erode over time if the practitioner only sporadically uses the software every few months. There’s benefit to just taking 30 minutes every couple of days to try and practice a function or feature that hasn’t been used before. In audit departments with larger staff, a small number of staff typically become the power users. The power users in turn create the analytical processes and allow others to be more effective in their roles. It makes sense for an organization to identify such individuals early and focus on building them up quickly. Deploying analytics for the first time requires a significant amount of resources as well as a lengthy period of training and analytics development. Many audit departments’ analytics initiatives often stall out during the initial phases. As a result and as an alternative, some organizations have turned to outside consultants to help jump start their analytics operations. A co-sourcing relationship can greatly reduce the time it takes to implement strategies. Audit staff can benefit from learning best practices from the consultants as well.
2
‘‘
The buzz around data analytics has bestowed a futuristic cachet on data
‘‘
Developing Analytics Talent and Training
analytics jobs and their attendant titles.
Acquiring Data THE BUZZ AROUND DATA ANALYTICS has bestowed a futuristic cachet on data analytics jobs and their attendant titles. Underneath the glamour though, there is the mundane and tedious job of acquiring the data, inspecting it for errors and omissions, and preparing it for analysis, all of which are critical for success. In this stage, planning goes a long way in smoothing potential bumps in the road. Most auditors will likely have to work with other departments like accounting, HR and/or IT to attain the data reports needed. Auditors should know and ask for exactly what is needed to produce the results desired. It will take time up-front to figure out what data is available and in what file types. Knowing the file type options will allow one to choose the kind that is easiest to work with. If the data set is time consuming to generate due to volume, an option is to simply collect samples for evaluation purposes. This reduces wasted time and effort in getting the full data set each time through a trial and error process. For instance, a general ledger detail that lists all the transactions that have been recorded in an accounting system is a great source of information that auditors commonly try to attain. But the general ledger detail can be very large even for small organizations, and pulling the report for an entire year can tie up an accountant’s computer for quite some time. Starting with a sample of a single month, an auditor can verify if the report will have the fields required. An auditor can also check the import of the data into the analytics software for integrity and completeness. If there are issues, it is much easier to identify where the problem is in a smaller population than one twelve times larger. This highlights a very important step in the data acquisition process – verifying data integrity and completeness. The auditor must verify that the report contains the information the auditor thinks it should contain. The auditor should consider asking the owners of the data what the various fields are so that auditor’s understanding of those fields are correct.
IT Insights: Overcoming Hurdles in Analytics
CONTACT US
If the report has subtotals, use those subtotals to check that what was imported into the analytics software is accurate. Most analytics software allow the data import process to be automated by creating a small script or program. The auditor may have to build the subtotal verification routine into the script, but doing so up-front is well worth it.
Reema Parappilly, CISA Partner, IT Advisory Services reema.p@weaver.com
Since data acquisition and preparation can be a significant ongoing cost of performing analytics, minimizing the effort will be critical. Fortunately, the scripting features of most analytic tools are quite capable in turning the data import and preparation phase into a push of the button. Once the data content and the file type is deemed satisfactory, how the data was acquired should be documented. The documentation should detail from whom the data was acquired, what application was used to generate the data and the name of the query if one was created. For example, if IT created an SQL query to generate the report, document the query name and its location. For absolute safety, perhaps get a copy of the SQL query code and save it in a safe, documented location.
Taking the Initial Step AFTER ALL THE EFFORT to convince stakeholders that data analytics is worth the time and money, a frequent stumbling block is what to do once the tools have been acquired. Having a strategic plan in place will help kick-start things. If the strategic plan is too high-level in nature, though, it may not identify specific areas or tasks where analytics will be first deployed. Here it is good to start with a risk assessment and previous risks encountered from past experience. Has there been fraud or errors uncovered in recent audits where application of data analytics is a good first-use case? Typically most practitioners initially apply analytics to expenditures cycles such as accounts payable and payroll. These areas are good candidates as duplicate or erroneous payments are common risks for almost all organizations. Finding and recovering a large duplicate payment or preventing such provides recognition of and confirmation for the value of analytics.
Parting Thoughts ANALYTICS OFFERS A MEANS FOR AUDITORS to improve the quality of their assurance and even provide efficiency gains. Analytics can also help transform auditors to become valued consultants to their organizations by providing deeper insights into issues and trends within the organization. To reach this vision, auditors must have a strategic plan for how to incorporate analytics, train and develop the people and skills required, and maintain forward progress to the destination where they want to go.
Tom Winson, CPA, ACDA Manager, IT Advisory Services tom.winson@weaver.com
Weaver’s IT advisory services group focuses on delivering performanceenhancing consultations that address your IT and business agendas. We work directly with CIOs and others to create a more risk-aware, effective IT organization that can drive process efficiencies throughout your company and better support and deliver transformational business change. Specific services we provide include: • • • • • • • • • • • •
Application controls review Business continuity/disaster recovery Cloud computing assessment Data analytics Data privacy Information security and vulnerability assessment ISO27001 reviews IT audit IT governance and organizational effectiveness IT risk assessment Pre- and post-implementation application reviews System and Organization Controls (SOC) reporting
Disclaimer: This content is general in nature and is not intended to serve as accounting, legal or other professional services advice. Weaver assumes no responsibility for the reader’s reliance on this information. Before implementing any of the ideas contained in this publication, readers should consult with a professional advisor to determine whether the ideas apply to their unique circumstances. © Copyright 2017, Weaver and Tidwell, L.L.P.
3 www.weaver.com | 800.332.7952