- Does NOT knows what it takes to get analytics off the ground
- Believes that analytics multiply like rabbits, naturally
- Is NOT willing to make the adjustments required to deliver and sustain real value.
- Not a single person is dedicated to leading the analytics program, or that ‘dedicated’ person is assigned occasional audits or special projects.
If you don’t have a dedicated person leading analytics, your department is not dedicated to doing analytics.
- During planning, mgmt requires every audit engagement to document the analytics to be performed, but doesn’t consistently challenge auditors when the plan is “Analytics will be explored during the audit”.
Talk is cheap. Requirements are one thing; follow-though is another.
- Mgmt doesn’t require all data sets used in audits to be profiled.
If you’re not looking at outliers, counts, percentages, distribution, and other statistics, how are you scoping your audit? How are you checking data quality? How valid are the questions you are asking your data?
- Mgmt doesn’t require every staff member to have measurable analytic goals to ensure the department continues to mature and stays relevant. Those goals play no part in the promotion process.
For some reason, mgmt thinks analytics is like trickle-down-economics. It will just happen all by itself. Mgmt refuses to plan AND manage the process. If it isn’t doing that, what IS mgmt doing?
- When mgmt interviews candidates for hire, analytics is never mentioned.
You certainly don’t want to scare off a good candidate by asking about analytics; a good analytic auditor from the outside might demoralize the rest of the staff, ya know.
- Mgmt does not provide staff the time to regularly determine what key data is used across multiple audits and then work toward obtaining, cleaning, and formatting that data into usable form.
If you don’t plan some hours to do something different and more efficient, don’t expect miracles to happen.
- Mgmt wants analytics automated before they lay the foundation of good analytic practices across the department. They want one analytic person to run before most of the department learns to walk.
Unfortunately, too many CAEs are interested in getting ‘automation points’ on the audit board rather than building a solid process and team. While some auditable units will eventually have great analytics and automation, the majority of the audits and auditors will continue to walk down the Same As Last Year path, sans analytics (I will write an entire post about this eventually).
- Mgmt thinks the role of analytics is to speed up the current test procedures, not transform the audit process. Little or no focus is spent on how planning, risk analysis, obtaining data, scoping the audit, designing test procedures, communicating audit results, and tracking audit issue closure can be transformed by analytic processes.
If faster testing or automated testing is your CAE’s goal, then your CAE does not grasp the true capability of analytics. It is so much more than speed.
- Mgmt asks for metrics to track the department’s analytic progress, but does not require auditors to complete the metrics tracking spreadsheet after each engagement (auditors complain that it takes too long). Or management doesn’t support keeping metrics.
So far, I have encountered only 1 other audit department that keeps meaningful metrics about their analytics. Counting the number of projects that include analytics isn’t enough. I’ll explain more in a future post.
- Mgmt refuses to acknowledge that every continuous auditing/ monitoring application you create, AS WELL as each analytic server, database, virtual machine, and analytic application used by the audit department requires occasional user access changes, updates, and troubleshooting. But you are still expected to be even more productive due to all the great tools and automation you’ve implemented.
CAEs tend to think analytics and automation appears out of thin air and don’t require care and feeding.
- Mgmt never asks about or reviews who has access to the analytic infrastructure (network drives and databases where scripts and data is stored, etc.) and whether that access is appropriate.
Mgmt hates to eat it’s own dog food. Just because CAEs don’t think about it doesn’t mean YOU can ignore it.
- After the analytics champion has been designated and the growing analytics program has demonstrated its value, management ignores the next huge risk that it is facing: departure of the analytic champion, who has no backup.
If you think it’s hard getting one person dedicated to analytics, wait until you try to get a second person–even in a large department.
Are you facing any of these challenges? If so, what are you doing about it?
In future posts, I’ll tackle some ways to deal with these problems.