How to find new ways to add value to your audits

HOW TO FIND NEW WAYS TO ADD VALUE TO YOUR AUDITS

IIA GAM CONFERENCE

PRESENTER

Aaron Boor, CISAIT Audit & Project Automation Manager Internal Audit DepartmentDonegal Insurance Group

CORPORATE CHALLENGES

• Use of technology for more processes is causing more data to be created• Data is compiled and available but not documented or

communicated• Minimal training on how to interpret data• Proper tools are unavailable to analyze data• Data analysis skills are lacking in individuals with

institutional knowledge

“The Internal Audit function must embrace analytics to keep pace with or outpace the business; it must become a natural

part of the thought process. This will involve not only the adoption of new tools and techniques but also a

change in mindset.”- Ernst & Young

TERMINOLOGY

• Data Analysis• Data Analytics• Business Analytics• Business Intelligence• Big Data Analytics

“Data analytics is the application of statistical models and techniques to business information to derive conclusions that

are beneficial to that business.”- ISACA

OPPORTUNITIES

• Traditionally, auditors attempt to understand populations and build a representative sample that can be extrapolated - with analytics IA can now examine entire populations • IA can identify and focus on attributes that previously were

out of reach, and discern relationships and correlations that were never before visible

Source: Ernst & Young

OPPORTUNITIES

• Internal Audit has a unique perspective into how data is compiled for financial reporting purposes• Process walkthroughs

• Control identification• Understanding of data generation• Understanding of dataflow between systems

• Data security measures• Financial report testing

“… innovation in audit is essential… This is about what business and investors really value in audit and,

in the light of the opportunities data analytics presents, how that might be achieved.”

- ICAEW

SKILLS TO CAPTURE OPPORTUNITIES

• The Harvard Business Review cites “Data Scientist” (a specialized role with a hybridized blend of technical and statistical skills) as the Sexiest Job of the 21st Century• Increased knowledge of data analytics technology and how

it interacts with financial data • Bridge between Information Technology and Accounting

departments utilizing a wealth of company and industry specific knowledge• Ability to communicate data analysis results to management

effectively utilizing visualizations

“These already-scarce and in-demand skills are likely to remain challenging to acquire for the future. A survey from The Data

Warehousing Institute (TDWI) cites ‘inadequate staffing or skills for big data analytics’ as the current top barrier for

implementation of big data analytics in enterprises.”- ISACA

ANALYTICS AND AUDIT QUALITY

• Audit quality increases by having the ability to:• Analyze full datasets• Identify outliers in a population for which to sample• Find the needle(s) in a haystack• Visualize datasets• Ask better questions regarding financial data• Conduct more effective follow-up interactions with

Management

GOALS OF ANALYTICS

• Bolster audit quality through increased company specific knowledge derived from a more detailed understanding of financial data• Provide more precise reports to management specifying

root causes to exceptions• Conduct effective interactions with management more

frequently• Stronger relationship with Management generating

additional buy-in on future analyses

“ … efficiency isn’t about “cutting hours”, it’s about getting to the things that matter quicker and spending more time on

them instead of ploughing slowly through random samples that often tell you very little. These techniques shrink the

population at risk. It means we’re fishing in a smaller pond and we can often go straight to the high risk areas.”

- ICAEW

QUESTIONS FOR AUDIT SCOPE

• What is the scope of the data analysis project?• What are the audit objectives?• Is data available to be analyzed?• How much data will be analyzed?• Is the data organized/documented?• Where is the data located?• What authorizations are required to access the data?• What data types are available from these systems?• To not hinder production, when can the data be

imported?

QUESTIONS ABOUT ANALYSIS TOOLS

• What data analysis tools are available to handle the scope of this project?• Data integrity is maintained• Record/Size limitations• Does the data need to be “polished” for further use? • Speed of data availability for use in the tool• Does the project require data from multiple systems?• Speed of data calculations (automatic statistics)• Visualization capabilities

DATA ACQUISITION

• Added value becomes possible in the data acquisition stage • In the planning stage it is determined what data is needed, where it

comes from, how to access it, how it will be analyzed, and what the expected outcome of the analysis will be.

• Do not exclude fields from data requests. These additional fields provide valuable insights for further analysis

• Look into datasets acquired in other areas of the audit, they have the potential to provide valuable insights as well

• Take the time to understand the data obtained across all audit areas and find commonalities between them for which to provide additional insights

STEPS FOR VALIDATING DATA

• Ensure data to be analyzed was fully received without errors• Complete data acquired (record count and control totals

of key amount fields)• Empty data where there should be data• No data import errors

• Ensure original production environment was not harmed during the import process

DATA ANALYTICS PROCESS

• Using process documentation (walkthroughs, flowcharts, contracts, etc.), organize parameters by which data will be analyzed• Mirror these parameters using the selected data analysis

tool. (Could be one step, could be hundreds)• Continue to look for added value opportunities in your

dataset(s)• If considered a repeatable task, look into scripting• If scripted, look into scheduling for continuous monitoring

capabilities

Most people stop looking when they find the proverbial needle in

the haystack. I would continue looking to see if there were

other needles.

DATA ANALYSIS PITFALLS & ACTIONS

• Data analysis pitfalls• False positives• Flawed analysis logic• Out-of-date software• One-offs!

• Human judgement and follow-up regarding results is a must!• Practice makes perfect – get the proper training

GET MANAGEMENT’S ATTENTION

• Provide powerful insights gained by analyzing the detail behind the summary information management is used to analyzing

• Utilize visuals like graphs and dashboards to make the statistics standout

MORE PRESENTATION TIPS

• Add drill down capabilities – Show that detail!• Utilize a tool that inherently delivers insights

CONCLUSION

“IA must integrate analytics into its audit process to keep pace not only with the business, but also with the organization’s

competitors. Analytics, properly developed, can help IA provide business insights and act as a strategic advisor while holding the line on costs or even reducing them. When it comes to big data

and analytics, the future for internal audit is now.”-Ernst & Young

RESOURCES USED

Ernst & Young Financial Executives Research Foundation

(FERF)

Institute of CharteredAccountants in England

& Wales (ICAEW)Information Systems

Audit & Control Association (ISACA)

HOW TO FIND NEW WAYS TO ADD VALUE TO YOUR AUDITS

IIA CONFERENCE PRESENTATION

Visit casewareanalytics.com Email [email protected]