Internal audit’s success with analytics depends on strategy, planning

As a whole, internal audit has embraced the power and speed of data analytics in performing audit functions.

But the specific strategies and applications of data analytics help play a role in separating high-performing auditors from their lower-performing peers. The internal audit groups viewed as more valuable are finding more uses for data analytics while putting processes in place to adapt to ever-changing business conditions.

Two recent survey reports underscore the importance of data analytics in effective internal auditing that goes beyond basic assurance. The Institute of Internal Auditors (IIA) released its annual North American Pulse of Internal Audit survey, and PwC unveiled its annual State of the Internal Audit Profession Study.

Fewer than half of audit leaders in the IIA survey say they use data analytics extensively or occasionally in developing a department audit plan. A far greater percentage use data analytics for risk assessments in specific audit engagements or direct testing of internal controls.

Those who are frequently using data analytics are, essentially, better planners than those who use analytics sparingly.

“You need to have the right people, you need to plan this out, and you need to pick the right technology,” said Doug Anderson, the IIA’s managing director for CAE solutions. “If you don’t, you can easily fall in the trap of wasting your time.”

Wasting time on poor design of data analytics is common in the survey: 58% said it had led to extra work.

Part of that concern is related to the fact that technology is changing quickly. Organisations must continue to invest in tools and staff training, or they risk falling behind. The internal audit skill that is most often cited as one in which staff need more training is data mining and analytics, chosen by 67% of respondents.

“There’s a correlation with how effective they are with how much they invest time and resources in using these tools,” said Richard Chambers, the CEO of the IIA.

Internal audit functions that regularly use data analytics can provide a greater degree of assurance, he said. Just 31% of chief audit executives said they extensively or frequently use data analytics to fully test the accuracy of transactional or other data.

Becoming more agile auditors

PwC’s survey showed that high-performing internal audit functions take a more strategic approach to the use of data mining and analytics: 47% of “agile” internal audit functions have increased the use of data mining and data analytics for continuous auditing, monitoring of trends, and assessing potential impacts of disruption. That’s compared with 35% of lower-performing peers.

PwC defined “agile” internal auditors using two criteria: They have provided significant value to their stakeholders related to helping them deal with disruptive events, and they provide value beyond just executing the internal audit plan on a basic level.

As few in the PwC survey (9%) believe their internal audit departments have achieved trusted adviser status, PwC asked one critical question: What does internal audit need to do to disrupt itself?

“If you keep doing what you’re doing and making incremental change, even if the incremental change provides improvement, is that enough?” said Mark Kristall, a partner in PwC’s Internal Audit, Compliance & Risk Management Solutions practice.

One way to stay at least on pace with a changing business environment is to stay up to date on industry trends. In the PwC survey, 55% said subject-matter knowledge was lacking amongst internal audit to address disruption. That’s not necessarily because of a failure on the part of internal audit leaders, according to Kristall.

“Because of the pace of disruption, it’s hard for internal audit groups – from a staffing perspective – to be able to keep pace with that change,” Kristall said. “One disruptor we talk about is changes to the business. If an organisation is going to change its business strategy … internal audit has to make sure it has the skillsets to be able to address the risks associated with that change. That’s a very hard thing.”

That fast-changing environment is one reason the perceived value of the internal audit function has dropped. In the 2016 PwC survey, 54% thought that internal audit offered significant value. In 2017, that perception was shared by just 44% of respondents in the global survey of nearly 1,900 executives.

The IIA survey showed that:

• 29% of respondents said they increased internal audit staff in 2016, compared with 14% who decreased staff.
• 30% of respondents expect to increase internal audit staff in 2017, compared with 5% who plan a decrease. That’s up from 25% who planned for a staff increase in 2016.
• Internal audit focuses 19% of its time on operations, compared with 14% on financial reporting (including Sarbanes-Oxley testing) and 13% on compliance not related to financial reporting.
• The top five internal audit skills that need more training are data mining and analytics (67%), cyber-security and privacy (52%), analytical or critical-thinking skills (49%), communication skills (45%), and industry-specific knowledge (36%).

—Neil Amato (Neil.Amato@aicpa-cima.com) is a CGMA Magazine senior editor.