WIXLIB

DATA ANALYTICSIs it time to take the first step?

ForewordOrganisations are seeingincreasing digitisation oftheir operations, resultingin an exponential growthin the generationof data across allbusiness functions. Inits proper place, dataanalytics is a powerfultool freeing up internalaudit time to add valueto their organisations. Internalauditors must, however, still apply judgement inits application and skill in its interpretation.Contents3Executive summary5Understanding how data analytics can help6Applying data analytics to internal audit7Common uses of data analytics byinternal audit8Benefits of using data analytics8The path to maturityThe case studies which form the core of this reportfeature three internal audit operations which havesuccessfully established data analytics as a part oftheir practice. These provide some valuable lessonsfor considering the potential use of data analytics ininternal audit methodologies, and some pointers forintroduction and advancing along the maturity path.9Key questions to discuss with your auditcommittee chair9ConclusionsFor these three organisations, data analytics increasedassurance and enabled the internal audit team to focusincreasingly on strategic risk, but time and investmentwas required to up-skill audit staff and embed themethodologies to deliver such significant benefits.15 Annex B – data analytics in the NHSIncorporating the use of data analytics into the auditprocess enhances the ability to do whole populationtesting and continuous auditing, which in turn canenhance the assurance provided to the board on themanagement of risk and controls. In this way, someaspects of internal audit practice are likely to change,which will require new skillsets and new thinking.We are very grateful to the heads of internal auditat these organisations and others who havecontributed to this project.Dr Ian Peters MBEChief ExecutiveApril 2017Page 2 Data analytics – is it time to take the first step?10 Annex A – full case studies

Executive summary The purpose of this report is to enable the head ofinternal audit (HIA) to have a strategic discussionwith their board/audit committee to help determinethe value add of introducing data analytics into thefunction’s methodology. Most medium and large organisations aregenerating big data1 – huge volumes of dataranging from financial transactions to key metrics.Internal auditors, particularly in larger organisations,are making use of data analytics to both guide theiraudit plan and test controls. Data analytics in internal audit is becoming moreprevalent as time goes on. For some, it is nolonger a question of when to implement it in theirmethodologies but how. The report contains three case studies of internalaudit functions ranging from large to small –Coca-Cola Hellenic, Credit Suisse and DublinAirport Authority – that have incorporated the useof data analytics into their methodologies in orderto reap the benefits of data analytics. The three case studies (see summaries in the nextsection) show that the key benefits for the internalaudit function are to:– Increase efficiency. For example, scripts can bere-used for periodic audits, resulting in efficiencybenefits through using analytics vs performingthe analysis manually;– Increase effectiveness by performing wholepopulation testing instead of random orjudgmental sampling;Data analytics case studysummaries – adding value tointernal audit functionsCoca-Cola Hellenic[Increased assurance using whole-populationtesting and secondments to the data team toincrease the requisite technological skills] The internal audit function leverages theorganisation’s (Enterprise Resource Planning)ERP system. The ability to test 100% of the sample invarious audits is where the real value lies asinternal audit is able to provide muchgreater assurance. Increasing use of data analysis is becomingmore common but there is still a need to goout and meet the business to get the intuitivefeel that is necessary in an audit. The challenge of getting people with acombination of internal audit leadership anddata analytics skills will be an increasinglyimportant issue to overcome in the future. The HIA seconds members of his team into thedata team in order to help up-skill them in themore technological side of data analysis, suchas scripting.– Improve assurance;– Enable a greater focus on strategic risks bymoving away from the more routine tasks whichcan be automated to a greater degree;– Provide greater audit coverage; and– Realise significant savings, in terms of time andmoney, over the longer term.You can see the full case studies in annex A.1“Big data” is the term used to describe the huge portfolio of data that is growing exponentially. It is becoming clear that big data will have asignificant impact on operational processes and risk management in organisations. Big data in itself, however, yields limited value until it hasbeen processed and analysed.Data analytics – is it time to take the first step? Page 3

Credit SuisseDublin Airport Authority[Data analytics is used in most auditsincluding non-financial strategic risk areassuch as culture][Enables the team a greater focuson strategic risk] Adopting data analytics transformed thefunction from a traditional judgementbased, sample-driven, manually intensiveand reactionary audit process to one that istruly risk based, continuous/real-time anddata centric. Buy-in from the function’sleadership and every auditor in the teamwas crucial. Sponsors should also recogniseand accept that a period of incubation isnecessary before tangible benefits can bedelivered. Data analytics is integrated into all parts of the internal audit cycle. Itis, however, mainly used in fieldwork. The ideal auditor who uses data analytics asstandard in their audit methodology needsa blend of core analytics skillsets, businessexperience and a solid understanding of risk. They go beyond making use of data analyticsin financially oriented audits by utilising it instrategic risk areas such as the ‘risk and controlculture’ aspects of their audits.Page 4 Data analytics – is it time to take the first step? Prior to applying data analytics, 90% of thefunction’s time was spent on financial audits.Since incorporating data analytics the focus hasshifted, with 50% of audits now concerningnon-financial risks. This shift of focus improvedthe function’s overall effectiveness, as thekey risks in the organisation are largely nonfinancial and the overall direction of internalaudit is to operate on a more strategic level bylooking at strategic risks. Data analytics enables continuousauditing on specific business cycles butnot necessarily all of them, especially inthe case of smaller audit functions. It isimportant to weigh up the costs and benefitsof introducing continuous auditing. Data analytics can be applied in all auditfunctions regardless of size. Sophisticatedapplications require larger investment,but the basic application of using adesktop function can be incorporatedinto all internal audit functions withrelatively low levels of investment.

Understanding how dataanalytics can helpIntroducing data analytics into the audit functionis a journey that HIAs need to embark on only afterconsidering the specifics of their organisation: its size;the industry it operates in; and engagement from theboard/audit committee. HIAs need to determine howthe use of data analytics will assist them in meetingtheir strategic needs. They also need to determinewhich specific areas of the audit population analyticscan be used in rather than incorporating it into theaudit plan without a clear purpose or strategy.As with most areas of internal audit, HIAs must ensuretheir department has the right mix of people, process,technology and structure to realise the greatestbenefits from data analytics. Without some team members who are conversantin data analytics, internal audit may not knowwhich data sources to secure; Without the right process, the data that thedepartment obtains may be incomplete orcompromised; and Without the right technology, internal audit maylack tools to retrieve data or glean insights.Audit teams who decide to introduce data analyticsinto their functions need to do two things first2:1 Define the function’s data analytics objectives –The primary goals of data analytics for HIAs aremore efficient, enhanced assurance and strongermonitoring capabilities across the business.2 Evaluate what skillsets and technology will berequired to achieve those goals and assess whereyou will be on the data analytics maturity journey(see p.8). Before investing in time and resources,check that the objectives you laid out are realisticbased on the team’s skills and experience, theorganisation’s technological capabilities and levelof assurance required.23The ability to uncovertrends in large volumes of dataenables the internal auditorto provide greater insight.However, this alone is notenough; internal auditors muststill use their softer skills suchas talking to the business andtechniques such as root causeanalysis (RCA) to explore whatis causing those trends.InsightThe ability to uncover trends in large volumes of dataenables the internal auditor to provide greater insight3.However, this alone is not enough; internal auditorsmust still use their softer skills such as talking to thebusiness and techniques such as root cause analysis(RCA) to explore what is causing those trends.One of the ways which could enable internal auditorsto provide more insight could be to incorporate dataanalytics into their audit methodology.Identify trends andconnectionsAudit software and reporting tools enablestatistical analysis to reveal issues people maybe unaware of. Traditionally this has been usedto identify gaps or duplications in records.However, the existence of huge quantities ofdata (big data) and powerful analytical tools nowmakes it possible to mine data and assess theresults from different angles and perspectivesto establish new relationships, patterns andcorrelations. This is a very technical field butthe emergence of big data provides scope forinternal auditors to develop specific skills and/or work with IT experts to provide insight.First steps in data analytics, CEB Risk and Audit blog, April 2016The term ‘insight’ is now included in the International Professional Practices Framework (IPPF) Mission Statement that describes the role ofinternal audit as ‘to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight’Data analytics – is it time to take the first step? Page 5