Data analytics in internal auditing

 

Data proliferation

Data plays an increasingly vital role in our daily personal and professional lives. Individuals, companies, and organizations are continuously generating and collecting vast amounts of data. With the ongoing digitization and the rapid expansion of the Internet of Things, data generation is growing exponentially¹. An article from Forbes in 2018 revealed that 90% of the world's data was created in the two years leading up to that point. In 2018, data centers consumed approximately 2% of the world's electricity, and due to the exponential growth in data generation, it is estimated that by 2030, data centers will be responsible for 8% of global electricity consumption.²

Within Internal Audit, the use and processing of data are gaining severe significance. How companies and their Internal Audit departments adapt to the new possibilities offered by data analytics is of crucial importance.
 

Data utilization

According to a more recent Forbes article from 2022, we have entered an era of data democratization. This means that data is becoming increasingly accessible to organizations of all sizes. However, this also implies that data analytics is no longer seen as a secondary or optional activity but as a key driver for businesses. Nevertheless, experts worldwide agree that a substantial portion of the generated data remains unused.³ In 2021, Ryan Wilkinson from TWDI, an organization providing education and research on data-related topics, estimated that 80% of the data generated by companies went unused.⁴
 

Use of data analytics in internal audit

"Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization to accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes." (IIA Definition) Given the rapidly growing volume of data and the fact that much of its potential goes untapped, internal audit departments of companies of all sizes must reevaluate their approach. Are they making the most of the data they produce? The "Global Technology Audit Guide 16, Data Analysis Technologies", issued by the Institute of Internal Auditors, highlights the increasing pressure on audit departments to offer more assurance and transparency.⁵

Wolters Kluwer, a global provider of professional information, software solutions, and services, recognizes significant benefits in using data analytics in internal auditing. According to Wolters Kluwer, risk gaps can be identified by analyzing a complete dataset instead of relying on sample testing, resulting in greater assurance and accuracy. Findings are no longer confined to a few sampled cases. Data analytics eliminates the need for sample testing, a less meaningful practice in today's digitalized and data-abundant landscape. The application of data analytics allows for the scrutiny of large datasets to uncover irregularities and anomalies, ultimately enhancing the accuracy of audit results.⁶

Moreover, data analytics significantly enhances efficiency by saving time. Large datasets with numerous entries can be reviewed, and hundreds of built-in tests can be executed instantly. Custom-designed tests can be run on the same dataset from different periods within seconds. Many manual and repetitive tasks and processes can be automated through data analytics techniques, enabling internal audit departments to focus on more complex tasks, conduct more audits, or address the ongoing skilled labor shortage. The potential for data analytics in internal auditing is clear, but the real challenge lies in the practical application of these techniques and tools to realize the previously discussed advantages.
 

Initiating data analytics in internal audit

In December 2021, the Institute of Internal Auditors published a guide titled "Four Steps to Commencing the Data Analytics Journey in Internal Audit." The first step recommended by the IIA is data governance, as the availability of data is essential. The IIA acknowledges that data governance is a complex subject, encompassing data policies, classifications, master data management systems, and more. While data governance can be daunting, the IIA encourages to start small and to improve gradually. The IIA emphasizes that perfection is not the starting point, and that data governance is an ongoing effort.

The second step subtitled "If You Want It, You Can Find It", deals with the challenges faced by internal audit departments when trying to obtain the necessary data. This point is intricately linked to the first chapter on data governance. It emphasizes the importance of collaboration between internal audit and other departments to ensure reliable data sources. Additionally, the chapter discusses the possibility of internal audit departments creating their own data for analysis, for example through the use of questionnaires.⁵

The third step highlighted by the IIA is the need for data literacy within the internal audit department.⁵ The Harvard Business Review also describes data literacy as the ability to analyze, interpret, and question data as a major challenge. This chapter delves into the methods of developing the required data analytics skills, either by hiring new employees or providing training to existing staff. The IIA recommends learning from the experiences of others and seeking external input and advice.⁷

The fourth step is securing the support from the top management, which is essential for the successful implementation of data analytics. It involves direct investments in tools and employee training, thus enabling the internal audit department to embark on the data analytics journey. Therefore, it is crucial to have convincing arguments ready to demonstrate the enormous advantages of data analytics in internal audit.⁵
 

Conclusion

Despite the major challenges that organizations and internal audit departments may face, failing to manage and use data not only represents missed opportunities but also poses significant reporting risks. Managing and utilizing the increasing amount of data is imperative for the success of organizations and internal audit departments.