Data and analytics have added a new dimension to Internal Audit, offering more comprehensive and valuable insights into organisations and helping to anticipate what’s on the horizon.
There is no question that technology and data are changing businesses in unprecedented ways, and the way Internal Audit (IA) operates is no exception.
Thanks to advanced technology, IA can now have both a broader and more detailed view of how an organisation operates, with a better scope to find patterns and anomalies, predict risk and improve value compared to traditional manual sampling methods.
Ross Tilly, Partner, Internal Audit at KPMG Australia says IA can run analytics across an organisation’s entire environment, which can highlight where attention needs to be focused to prevent risk.
“I have the mantra, ‘if not why not’ when it comes to data and analytics in IA,” he says. “Turn off the manual testing and turn on the DA.”
However despite the benefits, IA groups need to upgrade their skills and tools to make the best of the opportunity, and to meet evolving stakeholder expectations. Chief audit executives are now viewing these skill gaps as an area that must be addressed as a priority.
The power of data and analytics for IA is immediately clear in fieldwork and reporting. Katie Williams, Partner, Internal Audit at KPMG Australia says the ability to delve deeply into large datasets is the key benefit.
“Previously we used a more traditional audit methodology and used a sample set of around 20 to 30 transactions,” she says. “Now with technology we can conduct audits across entire datasets, which can be tens of thousands of records.”
The ability to continuously audit and monitor trends, and conduct automated testing on selected sections of data are just some of the advantages.
“The broadening of the data population brings management more assurance and increases the impact and influence of IA,” Williams says.
Once the deep insight is gathered, reporting information to executives and management can be enhanced through data visualisation methods. This approach enables the IA function to clearly demonstrate the issues, patterns and trends influencing a business.
Williams gives the example of a government organisation for which KPMG conducted an internal audit. Data on the agency’s social housing portfolio was used to create a geospatial map that demonstrated ‘hot spot’ areas where rent payment was an issue. This visual representation was invaluable in helping the client understand the depth of the issue at hand.
All organisations would like to know what is around the corner that could impact their success. While the world of economic uncertainty, global competition and disruption can make forecasting challenging, new predictive data and analytics technologies can help.
Williams says predicting emerging risks is one area where the IA function can embrace data and analytics, and use it to see trends and help to anticipate a client’s future risk profile. It can also help to measure how effective predictive controls will be based on past control successes or failures.
“We can gain retrospective data and insights from a client’s risk profile and use it to predict different levels or flows of sales and segments of customer sales revenue,” Williams says.
Datasets based on this information can help organisations to inform their IA strategy, as well as help with the overall business strategy. They can help management understand and plan for the expected performance of their business. The data can also be filtered to a key performance indicator (KPI) dashboard that can be easily accessed and monitored for continual assessment.
Engaging sophisticated data and analytics in IA brings the enhanced ability to find inconsistencies and areas of risk in an organisation. For example, Tilly deep-dived into data for an organisation that had concerns about its payroll. Previously, IA would have gathered a sample of timesheets and pay slips to compare manually. With data analytics, IA was able to do a full check of payrolls for the entire staff across a 12-month period.
“It highlighted that they had five or six employees that we wouldn’t have come across normally, that had a whole series of anomalies in their superannuation. There were some very technical issues in the way their super was being deducted – it was wrong and it forced the company to go back and see how they could get it right.”
In recent years, KPMG has invested significantly in technology and data and analytic skills. This has included the development of specialist data analysis services, solutions and training to upgrade the skills of KPMG’s current IA team.
Carmel Mortell, Partner in Charge, Internal Audit at KPMG Australia says this focus, as well as investment in new tools and technology remains a key priority for the KPMG National IA team.
“It is the future,” she says.
Internal Audit is increasingly being engaged to diagnose operational inefficiencies. Find out more in our article – Lean in Internal Audit – a different perspective.