To create a successful analytics program in internal audit, you must have a plan. A plan that points to analytic North.
That requires WRITTEN goals.
In an earlier post I outlined 10 Signs Mgmt Doesn’t Really Support Analytics.
One of the signs that indicates management isn’t really serious about analytics is that management does not require every staff member to have measurable analytic goals.
This is often due to the lack of management having any solid analytic direction of their own.
What is Analytic North?
By analytic North, I am referring to what the Chief Audit Executive (CAE) wants to accomplish with analytics; in other words, why do you need analytics, what is your vision for the future, and how are you going to get there?
Because every company and audit department is different, has different needs, systems, and talents, analytic North can vary in each instance.
The key is that you need a WRITTEN plan. Don’t be afraid to start small, if you have to.
An Initial Plan
If you’re just starting out, your initial goals may include:
- Designate one or more people to do the initial pilot and testing (not the same as an analytics champion).
- Learn new ways to do analytics in Excel (like using Quick Analysis, Fuzzy Lookup, or Pivot tables).
- Determine what data you can use across multiple audits (employee info, financials, etc.).
Analytics is not like trickle-down-economics; it will not just happen all by itself. Like anything else worthwhile, you have to direct and measure its progress.
Expand Your Plan
Later in the process, depending on how your progress is going, you may expand your plan later to include items such as:
- Designate someone as the analytic champion.
- Hold a meeting to teach other auditors what you’ve learned, using real data that attendees can relate to.
- Request IT generate one or more data sets (that can be used across multiple audits) automatically on a periodic basis, and save it to a secure LAN folder.
- Join two or more data sets you’ve never combined before, and run analytics on that data.
- Select a data-rich audit that you are already doing manually and automate it via macros/scripts.
Pick a few goals that make sense to you and are achievable.
As the Data Turns
Too many auditors think that analytics is only for analytic auditors or the ‘data team’.
While not every auditor needs to be a scripting guru who can create, query, and manage databases, I firmly believe every auditor needs to be able to do obtain, validate, transform, and analyze data at some level (I’ll debate this in a future post).
After management fully supports the analytic program and wants to make serious progress, every auditor should have one or more analytic goals that she is working toward.
Those goals should have deadlines, and the auditor needs to be given opportunities to learn and practice the skills that she is trying to build.
This requires audit leaders to work together and do more effective planning of the annual engagements.
Skills Assessment
However, before auditors can set goals, and leaders can plan work to facilitate that learning with appropriate assignments, you need to know what the analytic competencies of each auditor are.
Start with your analytic goals and the analytic/data skills you need to build in the department.
Make a list of them and then have each auditor rate herself as to where she is with each one (with audit lead or manager input).
Yes, this takes time and effort, and all of this is easier if you have an analytic champion.
When management protests the investment, ask them these defining questions:
- How far do you want to go, and how soon do you want to get there?
- What’s the risk of staying where we are?
Auditors that don’t master analytics will soon become irrelevant.
It will be like watching movies on DVDs when everyone else is streaming them across the Internet.
ITauditSecurity 