Graham Liddell: Data analytics and the internal audit evolution
0
Graham Liddell
There is a 94% probability that our audit jobs will be replaced by robots over the next 10 to 20 years (Frey and Osborne: The future of employment. How susceptible are jobs to computerisation? September 2013).
All those traditional manual compliance checks can be taken over by increasingly sophisticated automation and then by artificial intelligence. And we can see some of that already: do you remember when auditors assiduously checked a sample of 20 purchase invoices to check whether they were supported by properly authorised order forms? Now we can find out this information for all purchase invoices just by running a business objects report.
But internal audit is so much more than just reporting compliance levels. A good internal auditor provides valuable, evidence based, insights and practical recommendations to management by using their professional expertise and local knowledge. Sooner or later artificial intelligence will be capable of taking on this role, but this is still some way off. Computers aren’t great at interacting with people or making creative leaps of imagination. And the human brain still retains an edge in our ability to make sense out of patterns. So how do we use these advantages to keep internal audit relevant? In other words, how do we increase the 6% chance of retaining human auditors?
Here’s my 5 point plan
- Embrace the change
Let’s get excited by the opportunities that better and more sophisticated data analysis provides us. This is our space and we need to be taking the lead. We should be using data analysis techniques as a matter of routine and internal audit should be seen as leaders in the way we use and interpret data.
- Get to grips with the subject matter
There is a confusing array of terms: big data, data analytics, data matching, data science and so on. We need to understand the terminology and be able to talk, in plain English, about what these terms mean and how they apply to internal audit and our clients. I recommend setting aside some spare time with some Google and then talking through with some trusted colleagues. The only snag is that quite a few of the articles out there seem intent on trying to confuse rather than enlighten. Here is a great article to get you started: big data and analytics.
- Set out your stall
We need to be clear about what we want to achieve in a simple terms as possible. Which are the key areas we want to expand and integrate into the way we carry out our audits? These might include:
- moving beyond NFI to use data matching as part of our everyday work to identify and investigate potential fraud
- testing compliance by interrogating the whole population rather than by sampling techniques
- exploiting and presenting data imaginatively to:
- identify trends and themes to direct audit work (e.g focussing on services that are showing high levels of non-compliance)
- demonstrate the impact of audit findings (e.g showing that there is a correlation between overspending services and failure to follow routine financial control procedures)
- challenging the way our clients use data to manage their services.
And to give the implementation a bit of bite, we also need to establish some performance measures with some SMART targets which we can track over the next two to three years.
- Provide team members with the skills and time to develop
Critically we need to give our teams the skills, confidence and space to change the way we carry out our audit work. All auditors will need to develop their skills. In addition we need to:
- identify our data analytics evangelists and provide them with the specialist training and time to support other team members
- make sure that auditors have time when scoping their audits to consider how to use data analytics. We also need to spend time evaluating and the effectiveness of each audit as part of the completion stage. It has never been acceptable to simply copy what was done last year, but the stakes are getting higher and we need to see radical change
- celebrate and learn from our successes.
- Don’t throw the baby out with the bath water
Finally, we need to remember that this isn’t just about processing and examining large volumes of data. Yes, we can make big gains by using data in a much more sophisticated way but this doesn’t remove the need to look at the detail, for example through in-depth case studies. We may be able to move away from statistical sampling, but audit insight comes from understanding the way an organisation works in practice.
Graham Liddell is head of Internal Audit at Brighton & Hove City Council.
