In an environment of growing data usage it becomes imperative for the Internal Audit function, through its holistic version of the organization, to invest in a data analytics process so that it can convert data into relevant insights that are complete, prospective and can add value to the business.
The DA process can be defined as a structured data population query with the aim to provide information that can help the organizations to improve their performance, mitigate their risks and maximise business value. The DA usage maturity level can be assessed using the business value as the main criteria which includes using a maturity growth scale (from lowest to highest):
- Descriptive: identifying the main trends based on historic relevant records
- Predictive: simulating scenarios based on past trends as to anticipate and predict behaviours and business risks
- Prescriptive: defining action plans that can impact the business future in a favourable way
The DA process should be integrated across the full audit cycle namely:
(1) Risk Assessment – dynamic identification of relevant risks and unknown risks as well as their potential impact across the business;
(2) Audit Plan – assessment and identification of DA to maximize the width and relevance of each planned audit, allowing usage of Key Performance Indicators (KPIs) and a quantitative perspective in the audit plan setup. This combination offers an added degree of reliance in resource usage efficiency and focus in key topics for the organization;
(3) Execution – development of audit actions that combine full population analysis, sample analysis and scenario simulation allowing for a quicker execution of repetitive tasks, mitigating human error risks and increasing tasks efficiency which in time can generate cost savings;
(4) Reporting – the DA tools should allow for (i) automatic and systematic generation of reports related to the Internal Audit function, (ii) follow up on the findings and respective impacts and (iii) transforming the data into insights to identify key problems and their respective root causes;
(5) Action Plans – Identifying trends, risks and opportunities as well as recommending course of action leading to timely and more effective decision making;
(6) Monitoring – Continuous follow up on the performance indicators, risks and controls which can in turn identify deviations and emerging risks;
An effective embedment of DA within the Internal Audit functions requires defining the activities that are within the above listed scope areas which should cover: i) identifying the auditable universe to use DA that represents a greater risk/reward ratio considering the investment; ii) defining the necessary competencies to effectively use the DA tools and iii) prioritizing DA training for the team members for maximum usage and impact.
The review of the audit methodologies reliant on data analytics is an inevitable evolution as to strengthen the role of Internal Audit functions and the value they generate across the organizations.
