cmc/cleberg.net

  1#+date:        [2019-09-09 Mon 00:00:00]
  2#+title:       Internal Audit Analytics
  3#+description: Let's talk about data analytics and its use cases within the Internal Audit function.
  4#+slug:        audit-analytics
  5#+filetags:    :audit:
  6
  7* What Are Data Analytics?
  8
  9A quick aside before I dive into this post: =data analytics= is a vague term
 10that has become popular in recent years. Think of a =data analytic= as the
 11output of any data analysis you perform. For example, a pivot table or a pie
 12chart could be a data analytic.
 13
 14[[https://en.wikipedia.org/wiki/Data_analysis][Data analysis]] is a process that utilizes statistics and other mathematical
 15methods to discover useful information within datasets. This involves examining,
 16cleaning, transforming, and modeling data so that you can use the data to
 17support an opinion, create more useful viewpoints, and gain knowledge to
 18implement into audit planning or risk assessments.
 19
 20One of the common mistakes that managers (and anyone new to the process) make is
 21assuming that everything involved with this process is "data analytics". In
 22fact, data analytics are only a small part of the process.
 23
 24See *Figure 1* for a more accurate representation of where data analysis sits
 25within the full process. This means that data analysis does not include querying
 26or extracting data, selecting samples, or performing audit tests. These steps
 27can be necessary for an audit (and the same associates may perform these steps),
 28but they are not data analytics.
 29
 30* Current Use of Analytics in Auditing
 31
 32While data analysis has been an integral part of most businesses and departments
 33for the better part of the last century, only recently have internal audit
 34functions been adopting this practice. The internal audit function works
 35exclusively to provide assurance and consulting services to the business areas
 36within the firm (except for internal auditing firms hired by different companies
 37to perform their roles).
 38
 39#+begin_quote
 40Internal Auditing helps an organization accomplish its objectives by bringing a
 41systematic, disciplined approach to evaluate and improve the effectiveness of
 42risk management, control and governance processes.
 43
 44- The IIA's Definition of Internal Audit
 45#+end_quote
 46
 47Part of the blame for the slow adoption of data analysis can be attributed to
 48the fact that internal auditing is strongly based on tradition and following the
 49precedents set by previous auditors. However, there can be no progress without
 50auditors who are willing to break the mold and test new audit techniques. In
 51fact, as of 2018, [[https://www.cpapracticeadvisor.com/accounting-audit/news/12404086/internal-audit-groups-are-lagging-in-data-analytics][only 63% of internal audit departments currently utilize data
 52analytics]] in North America. This number should be as close as possible to 100%.
 53I have never been part of an audit that would not have benefited from data
 54analytics.
 55
 56So, how do internal audit functions remedy this situation? It's definitely not
 57as easy as walking into work on Monday and telling your Chief Audit Executive
 58that you're going to start implementing analytics in the next audit. You need a
 59plan and a system to make the analysis process as effective as possible.
 60
 61* The DELTA Model
 62
 63One of the easiest ways to experiment with data analytics and gain an
 64understanding of the processes is to implement them within your own department.
 65But how do we do this if we've never worked with analysis before? One of the
 66most common places to start is to research some data analysis models currently
 67available. For this post, we'll take a look at the DELTA model. You can take a
 68look at *Figure 2* for a quick overview of the model.
 69
 70The DELTA model sets guidelines for areas wanting to implement data analytics so
 71that the results can be as comprehensive as possible:
 72
 73- *Data*: Must be clean, accessible, and (usually) unique.
 74- *Enterprise-Wide Focus*: Key data systems and analytical resources must be
 75  available for use (by the Internal Audit Function).
 76- *Leaders*: Must promote a data analytics approach and show the value of
 77  analytical results.
 78- *Targets*: Must be defined for key areas and risks that the analytics can be
 79  compared against (KPIs).
 80- *Analysts*: There must be auditors willing and able to perform data analytics
 81  or else the system cannot be sustained.
 82
 83* Finding the Proper KPIs
 84
 85Once the Internal Audit Function has decided that they want to start using data
 86analytics internally and have ensured they're properly set up to do so, they
 87need to figure out what they will be testing against. Key Performance Indicators
 88(KPIs) are qualitative or quantitative factors that can be evaluated and
 89assessed to determine if the department is performing well, usually compared to
 90historical or industry benchmarks. Once KPIs have been agreed upon and set,
 91auditors can use data analytics to assess and report on these KPIs. This allows
 92the person performing the analytics the freedom to express opinions on the
 93results, whereas the results are ambiguous if no KPIs exist.
 94
 95Note that tracking KPIs in the department can help ensure you have a rigorous
 96Quality Assurance and Improvement Program (QAIP) in accordance with some
 97applicable standards, such as IPPF Standard 1300.
 98
 99#+begin_quote
100The chief audit executive must develop and maintain a quality assurance and
101improvement program that covers all aspects of the internal audit activity.
102
103- IPPF Standard 1300
104#+end_quote
105
106Additionally, IPPF Standard 2060 discusses reporting:
107
108#+begin_quote
109The chief audit executive must report periodically to senior management and the
110board on the internal audit activity's purpose, authority, responsibility, and
111performance relative to its plan and on its conformance with the Code of Ethics
112and the Standards. Reporting must also include significant risk and control
113issues, including fraud risks, governance issues, and other matters that require
114the attention of senior management and/or the board.
115
116- IPPF Standard 2060
117#+end_quote
118
119The hardest part of finding KPIs is to determine which KPIs are appropriate for
120your department. Since every department is different and has different goals,
121KPIs will vary drastically between companies. To give you an idea of where to
122look, here are some ideas I came up with when discussing the topic with a few
123colleagues.
124
125- Efficiency/Budgeting:
126  - Audit hours to staff utilization ratio (annual hours divided by total annual
127    work hours).
128  - Audit hours compared to the number of audits completed.
129  - Time between audit steps or to complete the whole audit. E.g., time from
130    fieldwork completion to audit report issuance.
131- Reputation:
132  - The frequency that management has requested the services of the IAF.
133  - Management, audit committee, or external audit satisfaction survey results.
134  - Education, experience, certifications, tenure, and training of the auditors
135    on staff.
136- Quality:
137  - Number and frequency of audit findings. Assign monetary or numerical values,
138    if possible.
139  - Percentage of recommendations issued and implemented.
140- Planning:
141  - Percentage or number of key risks audited per year or per audit.
142  - Proportion of audit universe audited per year.
143
144* Data Analysis Tools
145
146Finally, to be able to analyze and report on the data analysis, auditors need to
147evaluate the tools at their disposal. There are options available, but the most
148common ones can easily get the job done. For example, almost every auditor
149already has access to Microsoft Excel. Excel is more powerful than most people
150give it credit for and can accomplish a lot of basic statistics without much
151work. If you don't know a lot about statistics but still want to see some of the
152more basic results, Excel is a great option.
153
154To perform more in-depth statistical analysis or to explore large datasets that
155Excel cannot handle, auditors will need to explore other options. The big three
156that have had a lot of success in recent years are Python, R, and ACL Analytics
157(ACL). You can use ACL as either a graphical tool (point and click) or as a
158scripting tool, where the auditor must write the scripts manually. Python and
159the R-language are solely scripting languages.
160
161The general trend in the data analytics environment is that if the tool allows
162you to do everything by clicking buttons or dragging elements, you won't be able
163to fully utilize the analytics you need. To create the most robust solutions,
164you should write the scripts manually. Note that as the utility of a tool
165increases, it usually means that the learning curve for that tool will also be
166higher. It will take auditors longer to learn how to utilize Python, R, or ACL
167versus learning how to utilize Excel.
168
169* Visualization
170
171Once an auditor has finally found the right data, KPIs, and tools, they must
172report these results so that readers of their results can take action.
173Performing in-depth data analysis is only useful if the audience can understand
174the results. The best way to create this understanding is to visualize the
175results of the data. Let's take a look at some of the best options to visualize
176and report the results you've found.
177
178Some of the most popular commercial tools for visualization are Microsoft
179PowerBI and Tableau Desktop. However, other tools exist such as JMP, Plotly,
180Qlikview, Alteryx, or D3. Some require commercial licenses while others are
181simply free to use. For corporate data, you may want to make sure that the tool
182does not communicate any of the data outside the company (such as cloud
183storage). I won't be going into depth on any of these tools since visualization
184is a subjective and creative experience, but remember to constantly explore new
185options as you repeat the process.
186
187Lastly, let's take a look at an example of data visualization. This example
188comes from a [[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog post written by Kushal Chakrabarti]] in 2018 about the percent
189of entry-level US jobs that require experience. *Figure 3* shows us an
190easy-to-digest picture of the data. We can quickly tell that only about 12.5% of
191entry-level jobs don't require experience.
192
193This is the kind of result that easily describes the data for you. However, make
194sure to include an explanation of what the results mean. Don't let the reader
195assume what the data means, especially if it relates to a complex subject. /Tell
196a story/ about the data and why the results matter.
197
198* Wrap-Up
199
200While this is not an all-encompassing program that you can just adopt into your
201department, it should be enough to get anyone started on the process of
202understanding and implementing data analytics. Always remember to continue
203learning and exploring new options as your processes grow and evolve.