Final Report: Data Analytics Maturity 2016
Final Report: Data Analytics Maturity
2016
Vonya Global:
Data Analytics Maturity
Final Report
October 2016
Table of Contents
Executive Summary .......................................................................................................................... 3
Maturity Curve Explained ................................................................................................................. 4
Comparative Analysis ....................................................................................................................... 4
Internal Audit Department Charter .................................................................................................. 5
Maturity Factors ............................................................................................................................... 6
Maturity Comparison........................................................................................................................ 9
Maturity Curve ................................................................................................................................ 10
Global Comparison ......................................................................................................................... 11
Page | 3 Data Analytic Maturity
© Copyright 2016 – Vonya Global LLC – All rights reserved
Executive Summary
Vonya Global surveyed a cross-section of business professionals in order to assess the deployment
of data analytics within the internal audit profession. The participants were mostly internal
auditors, from a variety of organizations and industries. The goal of the study was to plot the use
of data analytics along a maturity curve.
The majority of the information was collected via an online survey that was open for 8 weeks and
accessible through the Vonya Global website. Respondents volunteered their time and their
responses were anonymous.
Data Analytics has been a trending topic in the internal audit profession for over 20 years and it
continues gaining momentum as the concerns around “Big Data” have grown. There are numerous
software tools ranging from desktop to cloud to enterprise applications. Many software providers
have created visualization tools to aid the presentation of data and to help executives make data
driven decisions, some of these tools are “bolt-ons” to current data analytic software while others
are stand alone applications.
A search of the Institute of Internal Auditors (www.theia.org) webiste reveals 213 entries for Data
Analytics in North America alone. This includes white papers, continuing education sessions,
opinion pieces, and entries from the IIA Common Body of Knowledge (CBOK). With all of this
information available, and the incredible investment by the software companies, many are left
wondering why more internal audit departments don’t leverage data analytics. While many
studies have been completed on the use of data analytics, this study observes data analytics on a
maturity curve.
While this is the first such study conducted by Vonya Global on the topic, the firm has released
previous reports on the Strategic Role of Internal Audit and Fraud Risk Mangement. The Strategic
Role of Internal Audit contrasts the opinions of Internal Auditors with those of Executive
Management on Internal Audit’s ability to fill a strategic role within the organization. The Report
on Fraud Risk Management also contrasted the opinions of Internal Auditors with those of
Executive Management on the effectiveness of fraud risk management strategies. Both reports
can be downloaded from the Vonya Global website.
SUMMARIZED STUDY DEMOGRAPHICS
Responses by Company Type:
Private 29% Public Large Cap 28% Public Mid or Small Cap 22% Accounting Firm / Consulting Firm 9% Not-for-Profit 5% Government 4% Higher Education 3%
Responses by Employee Type:
Chief Audit Executive 41%
Internal Auditor 37%
Other Management 10%
Consultant 7%
Executive Management 3%
Board Member 2%
Responses by Location:
North America 61% Asia 13% Europe 10% Africa 5% South America 5% Australia / Pacific 3% Middle East 2%
Average Time to Complete Study:
4 Minutes
Rounding errors may cause the numbers about to not equal 100%
Page | 4 Data Analytic Maturity
© Copyright 2016 – Vonya Global LLC – All rights reserved
Maturity Curve Explained
The term "maturity" relates to the degree of formality and optimization of processes, from ad hoc
practices, to formally defined steps, to managed results, to active optimization of the processes.
In this study, Vonya Global used a 6-level process maturity continuum - where the highest level is
“Optimized,” an ideal state where processes would be systematically managed by a combination
of process optimization and continuous process improvement, and the lowest level is “Not at all,”
where an internal audit department doesn’t use data analytics.
The 6 stages on the maturity curve included:
1. Not at all
2. Informal
3. Periodic
4. Moderate
5. Advanced
6. Optimized
Comparative Analysis
Two additional data points were collected as part of the study:
Ability of the Internal Audit Department to fulfill its charter and add value to its
stakeholders.
Whether data analytics enhances the Internal Audit Department’s ability to add value to
its stakeholders.
The expectation in this report was to compare and contrast the information collected.
“I see three key challenges after years of
working to mature our Data Analytics
(DA) application:
1. Having individuals enthused and
dedicated to conducting the DA.
2. Gaining access to the right data
at the right time.
3. Understanding the data needed
and how to use the data to meet
related objectives."
Page | 5 Data Analytic Maturity
© Copyright 2016 – Vonya Global LLC – All rights reserved
Internal Audit Department Charter
Internal auditing is an independent, objective assurance and consulting activity designed to add
value and improve an organization's operations. It helps an organization accomplish its objectives
by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk
management, control, and governance processes (source: The Institute of Internal Auditors).
An internal audit charter is a formal document approved by the audit committee that defines the
internal audit department’s purpose, authority, and responsibility. A charter establishes internal
audit’s position within an organization; authorizes it to access records, personnel, and physical
property that are relevant to internal audit work; and defines the scope of internal audit activities.
The Institute of Internal Auditors (IIA) provides a template for an internal audit charter on its
website.
The internal audit charter sets the standard for the internal audit department and corresponding
expectations. Meeting the expectations defined in the charter is the primary responsitility of
internal audit. Respondents to this study almost universally believe their internal audit
department fulfills its charter and adds value to the organization. As depicted in the chart on the
left, 70% strongly agree while another 25% slightly agree that internal audit fulfills its charter.
Is it possible to fulfill the internal audit charter without having a
robust data analytics practice?
The question above is one of the prevailing questions many data analytic software providers have
been asking for more than a decade. The answer depends on a variety of factors and will begin to
take shape on the folowing page.
Page | 6 Data Analytic Maturity
© Copyright 2016 – Vonya Global LLC – All rights reserved
Maturity Factors
The study revealed the investment into data analyics is based on:
Available time allocated to the internal audit team
Access to software tools
Mission/Vision/Strategy of the Internal Audit Department
Internal Audit Department Budget
Skills within the Internal Audit Department (#1)
Data integrity (#3)
Access to data (#2)
0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%
Data Access
Data Integrity
Skill
Budget
Mission/Vision/Strategy
Tools
Time
What is your biggest challenge with Data Analytics?
“Data analytics allows us to
identify trends and themes in
data to improve our decision
making and to identify anomalies
and outliers for further root
cause analysis. This allows us to
more efficiently deploy our
resources for maximum value.”
Page | 7 Data Analytic Maturity
© Copyright 2016 – Vonya Global LLC – All rights reserved
While internal audit can fulfill its charter without a data analytics program, a robust data analytics
program could make the process easier and also help add value to the organization.
Understanding the challenges associated with data analytics should clarify the steps required to
advance through the data analytic maturity curve. In order to advance:
1. Time must be budgeted and allocated.
“Time - The use of data analytics, especially at the infancy stage requires a significant
investment in time to identify good data sets and meaningful analytics, which are often
arrived at through trial and error. When trying to accomplish audits timely, that unknown
quantity of time required to get value of analytics is too hard to incorporate.”
2. Tools must be available.
We struggle with having the right “Resources/tools available to gather and analyze large
files timely.”
3. Data analytics must be part of the mission of internal.
“Transforming the culture, mindset, and process of Internal Audit to build data analytics
into the DNA of every auditors into every audits we do.”
4. Funding must be available to purchase the tools and provide training.
“The variety of data received for so many audits requires constant changes in our
approach to analysis as well as in the analyses themselves. It is difficult then to keep the
staff current on all the potential methodologies available.”
5. Auditors must learn the appropriate skills.
“Having someone knowledgeable who can perform analytics and thinking through what
analytics will help us accomplish the audit objective.”
“Training the audit staff on the selected data analytic software and then maintaining
proficiency with the data analytic software since it is infrequently used.”
Page | 8 Data Analytic Maturity
© Copyright 2016 – Vonya Global LLC – All rights reserved
6. The data must be readily available.
My biggest challenge is “Getting the right data. Knowing what to analyze and getting the
output. Using the right tools for analysis.”
“We have so many disparate systems that data acquisition seems to be our biggest
challenge.”
7. The data must be accurate.
“A lot of struggles within our data warehouses to accurately identify all of our tables and
what everything is mapped to.”
Page | 9 Data Analytic Maturity
© Copyright 2016 – Vonya Global LLC – All rights reserved
Maturity Comparison
Value drives decisions, especially when it comes to data analytics. Those who percieve value in
data analytics make the required investments to move up the maturity curve. Whereas those how
perceive less value in data analytics do not make the investments to move up the maturity curve.
“It allows the auditors to use a risk based approach and reduce the data sets down to the
highest risk subsets that can then be sampled/reviewed.”
As depicted in the charts on the left, the respondents to the study who are at the top of the
maturity curve find far move value in their data analytics program than those who are at the
bottom. As decribed in the previous section, there are many factors that impact an internal audit
departments ability to leverage data analytics.
“Data analytics allows us to identify trends and themes in data to improve our decision
making and to identify anomalies and outliers for further root cause analysis. This allows
us to more efficiently deploy our resources for maximum value.”
Page | 10 Data Analytic Maturity
© Copyright 2016 – Vonya Global LLC – All rights reserved
Maturity Curve
Nearly 80% of the respondents to this study classified themselves at a maturity of either Moderate
or lower, yet over 50% responded that the use of data analytics enhances internal audit’s ability
to add value.
“The use of data analytics affords us "time savings (greater testing efficiency), provides
the ability to analyze entire populations (greater testing effectiveness), directs audit focus
at high risk areas by using planning analytics, and allows more effective presentations to
audit customers as evidence of our findings.”
With proper use of data analytics, “information is more readily available in an easily
digestible format to enhance decision making” and it provides “transparency into
potential business problems.”
The use of data analyatics allows for 100 percent population testing which should increase
“audit testing efficiencies over exception analysis” and create “stronger audit evidence”
when making “process improvement recommendations.”
The AICPA released a white paper in 2014 that stated: “Although auditors embrace and make
extensive use of information technology, little has been done to consider how auditing might be
transformed by it. For the most part, IT has been used to computerize and improve the efficiency
of established processes rather than transform or replace them. Consequently, improvements
have been incremental rather than transformative.”
According to 2016 statement made by the Corporate Executive Board, “Nearly two-thirds of audit
departments recently made or are planning to make significant investments in data analytics.”
If both of the above statements are correct, more internal audit departments will be advancing
through the data analytic maturity in the near term. Internal Audit departments will then move
beyond the incremental and into the transformative.
Page | 11 Data Analytic Maturity
© Copyright 2016 – Vonya Global LLC – All rights reserved
Global Comparison
Based on the responses to the study, the global internal audit community is slightly more advanced
than audit departments in North America. However, there was not enough data collected to break
this information down further by country or region.
Conclusion
The purpose of this study was to plot the use of data analytics on a maturity curve to provide a
benchmark for internal audit departments. The reponses indicate that the mature data anlaytic
programs provide the most value. There are many options for data analytics ranging from standard
desktop applications to robust enterprise solutions.
There are many factors which limit the use of data analytics, as described on page 6, some of which
are outside the control of the internal audit department. Advancing up the maturity curve is a step-
by-step process that requires adressing each obstacle one at a time. It also requires commitment
and dedication over a long period of time. Based on the opinions expressed in this study, it appears
the reward is worth the effort.
This report is a publication of Vonya Global LLC; an international consulting firm specialized in
enhancing corporate governance by providing internal audit, internal control and risk assurance
services to a wide range of companies. Duplication without the expressed written consent of
Vonya Global is strictly prohibited. For more information about Vonya Global please visit
www.vonyaglobal.com.