Elevating Internal Audit’s Value...Data Analytics and Risk Management Board-directed data-driven risk decisions The Perfect Storm Explosive growth in raw data, technological advances

Data Analytics Elevating Internal Audit’s

Value

Matt Petrich Grant Thornton

Mark Salamasick University of Texas System

Why Dallas IIA Chapter Is Such a

Great Chapter?

• Gives Many Opportunities to Members• Shares with Others• Gives Time and Talent• Supports University Programs• Supports the Next Generation of Internal

Auditors • Chapter Research• Donations of Significant Magnitude –

Internal Audit Foundation(IAF)

www.dallasiia.org

st Annual Dallas IIA SuperConference

October 29, 2012Creating Value Through Assurance. Insight. Objectivity.

October 29, 2012Hilton Anatole

Dallas IIA

Internal Audit Foundation 2012 – Lessons Learned on the Audit Trail (Spring 2014)

2013 - Data Analytics book - GT (Spring 2016)

2014 - Internal Auditing Textbook 4th ed. (Spring 2017)

2015 - Trusted Advisors (Spring 2017)

2016 - Cybersecurity Book (Spring 2018)

2017 -Internal Audit Consulting Book (Summer 2018)

Lessons Learned on the Audit Trail

by Richard Chambers

Data Analytics Book – Grant Thornton

Internal Auditing Textbook, 4th Edition

Trusted Advisors: Key Attributes of Outstanding

Internal Auditors by Richard Chambers

Maximizing Valuefor Internal AuditUtilizing Data Analytics

and DataVisualization

Agenda

• Data Analytics Book

• Data Analytics Maturity Model Framework

• Vision

• The Future is Now

• Next Steps

Polling Question 1

How many dedicatedresources do you have to

perform data analyticswithin the audit group?

GAM Polling Question 1 Results

How many dedicated resources do you have to perform data analytics within the audit group?

43%

24%

23%

3%

1%

7%

Dedicated Resources

Performing Data Analytics

0

1

2 to 5

5 to 10

Greater than 10

We don't have any data

analytics in our audit group

Internal Audit Foundation

Data Analytics Book

Chapter-by-chapter description

• Chapter 1: What Does Data

Analytics Mean to Internal Audit?

• Chapter 2: The Data Analytics Framework

• Chapter 3: Develop a Vision

• Chapter 4: Evaluate Current Capabilities

Chapter-by-chapter description

• Chapter 5: Enhance People,

Process and Technology

• Chapter 6: Implement, Monitor, Evolve

• Chapter 7: The Future of Data Analytics in Internal Auditing

Internal Audit Foundation

Data Analytics Book

CAE Interviews (partial-Dallas)

Internal Audit Foundation

Data Analytics Book

Key takeaways from research

1. Most IA shops are in the infancy stage of DA initiatives.

2. Accessing and understanding data is the first stepto a successful DA initiative.

3. CAEs want visualization and predictive analyticSolutions.

4. Developing in-house staff around DA is a significant challenge.

5. Momentum around DA is gained through financialresults (i.e., how much did this save me?)

Internal Audit Foundation

Data Analytics Book

2016 All Star Conference

Data analytics framework:

Understanding how data analytics

will elevate internal audit

Data Analytics Maturity Model

Framework

Strategic evaluation allows for developmentinto the "optimized" maturity level

Assess capabilities in:

• People

• Process

• Technology

Data Analytics Maturity Model

Framework

Five phases of data analytics maturity:

• Ad hoc

• Defined

• Repeatable

• Institutionalized

• Optimized

People MaturityAd Hoc Defined Repeatable Institution

-alized

Optimized

Dedicated IA

function with

limited data

analytics skillset

Capability to

“borrow” data

analytics

expertise from

other

departments

Dedicated data

analytics staff in IA

with advanced

capabilities (e.g.,

CAATs)

Dedicated data

science within IA

Dedicated data

scientist within IA

and significant

number of

internal auditors

with data

analytics skills

Use cases

understood and

prioritized by

staff

Established

success metrics

around desired

skills

Developed

strategy for

additional

capabilities

Risk coverage

profile and other

constraints

captured and

used to optimize

scheduling

Data governance

framework

established and

understood by

staff

Continual training

requirements

specific to data

analytics

Road map for

implementation

across

enterprise

Compensation

connected to data

analytics skillset

Process MaturityAd Hoc Defined Repeatable Institution

-alized

Optimized

Small sample

size

Large sample

sizes

Significant sample

sizes

Significant or all

data audited

Real-time data

monitoring with

alerts

Inconsistent

reporting

Process does

not leverage

prior audits

Consistent

reporting

Standard reporting

Process applies a

standardized

approach

Continuous

auditing

throughout the

IA function

Continuous

monitoring

throughout

business function

Heavy reliance

on IT to obtain

data

Established data

access protocol

with IT Process

leverages

historical less

learned

Data verification

and accuracy

protocol

established

Reporting

shared across

stakeholders

Real-time

reporting

accessed through

self-service

business

intelligence

Technology Maturity

Ad Hoc Defined Repeatable Institution

-alized

Optimized

Spreadsheets Other reporting

and relationship

databases

Data access on

demand

Access to central

enterprise data

store

Automated data

extraction,

transfer, and load

(ETL)

Data visualization

tools (limited

basis)

Data interrogation

scripts are defined

Automated

scripting and

testing

Advanced

analytics available

for use within

function

Workflow and

data capture

technology

Data

visualization

tools integrated

for data input,

analytics, and

reporting

System

information

management

software (SM)

Data visualization

tool for reporting

Polling Question 2

Which phase of theanalytics maturity model do you believe your audit

group is in?

GAM Polling Question 2 Results

Which phase of the analyticsmaturity model do you believe

your audit group is in?

Polling Question 3

Which phase of theanalytics maturity model would you like your audit group to be in 3 years?

GAM Polling Question 3 Results

Which phase of the analytics maturity model do you believe your audit group is in?

4%

8%

48%

26%

13%1%

Analytics Maturity Model

Ad hoc

Defined

Repeatable

Institutionalized

Optimized

Not sure

What is Data Analytics and Data

Visualization

Key Definitions

Data Analytics and Risk

Management

Board-directed data-driven risk decisions

The Perfect Storm

Explosive growth in raw data, technological

advances in data storing and analysis, looking for

data-driven decision making with a board-directed

focus on credit risk, anti-money laundering and

high-risk entity analysis

Data Analytics and Risk

Management

What the future looks like

1. The board looking for data-driven decisions

on risk

2. The C-suite looking for key risk analytics and

their relevance to the organization

3. The ability to “foresee” future risks before

manifestation

Data Analytics and Risk

Management

How can data analytics be applied to the internal audit function

• Historical Perspective – Error detection and

quantification

• Continuous Review – Continuous monitoring

and continuous auditing

• Future Perspective – Key Risk Indicators along

with predictive and prescriptive analytics

Data analytics frameworkImplementing data analytics into internal audit is no longer a question of when but how.

Vision

The

Future is Now

Actual

Examples

Polling Question 4

What is the most significantchallenge to incorporating

data analytics into the audit process?

GAM Polling Question 4 Results

What is the most significantchallenge to incorporating dataanalytics into the audit process?

Polling Question 5

Do you believe there will be agreater emphasis on data

analytics in your organization inthe next 3 to 5 years?

GAM Polling Question 5 Results

Do you believe there will be a greater emphasis on data analytics in your organization in the next 3 to 5 years?

What can you all do!

Questions?

Thank You

Contact information

Matt Petrich

Forensic AdvisoryServices

matt.petrich@us.gt.com

312-602-8648

Mark Salamasick

Executive Director Audit Academic

msalamasick@utsystems.com

512-499-4535