A recent IIA article on building an analytics function in internal audit is dead wrong.
At least on one major point, anyway. And it’s a big one.
As the tombstone reads, this point is D.O.A (dead on arrival, or more specifically, dead on analytics).
The article, Building a data analytics program, requires IIA membership to view, and is located at https://iaonline.theiia.org/2017/Pages/Building-a-Data-Analytics-Program.aspx (that’s actually good, as it means a lot fewer people will ever read it).
The article states that
When an internal audit function decides to reassign a technical resource as the team’s analytics champion, problems often ensue.
The authors claim this can lead to analytics being a “purely technical exercise” instead of making it an integrated part of the department’s culture.
In my opinion, whether analytics is practiced “in pretense or in truth,” at least it would be practiced in those departments. I would wager it would be easier to change and weave a “purely technical” analytic effort into a useful, integrated audit process than to start an analytic effort from scratch.
At least you’d have some technical acumen in internal audit, which is too often more refreshing than it should be.
Or perhaps you should assign a non-technical champion? Each audit team has plenty of those.
Also, the article alleged that establishing analytic leaders too soon may cause auditors to not spend the appropriate amount of time and effort understanding the business process and the associated data.
Wait a minute – you can start analytics in internal audit too soon? Let’s wait another decade then!
The authors suggest that once the entire department has the right understanding of processes and data, then the “analytic teams then layer in their view and capabilities.”
This is so messed up.
Yes, I agree you need to understand process and data before doing analytics.
However, if internal audit hasn’t figured out by now how to understand business processes, the systems behind them, and the data produced, and how that data is used (or should be), then what the heck has internal audit been doing all these years? And where is audit management’s ‘supervision’?
So for decades, auditors have not audited business processes and data? If so, they have done that without understanding the process and data? And audit management hasn’t cared? This is nonsense.
Furthermore, if you shouldn’t establish analytic leaders before this understanding occurs, how will those “analytic teams layer” in their expertise? Where will those teams appear from?
If audit isn’t already understanding data, then don’t bother with analytics. You have much deeper issues.
Basically, this article implies that if internal audit doesn’t know what to do with data today, don’t move forward with analytics.
I agree. The first thing you need to do is fire the audit department management, especially the chief audit executive (CAE). And maybe a few others.
Because management is not doing its job.
Once that is accomplished, and better audit management is hired, then you need to hire an analytic champion.
If internal audit doesn’t understand processes and data, an analytic champion can help increase this understanding while building an analytics worldview. Otherwise, who is going to lead it? Especially since analytics IS technical and requires skills that even many IT auditors don’t have, much less the average internal auditor.
If you need this data understanding built, why would you not want a dedicated leader for it? And who would be better at it than an analytics champion? Some big 4 bloke? Not.
What if Audit Understands Process/Data?
Assuming that internal audit DOES have an appropriate approach to business processes, systems, and data, and you don’t appoint an analytics champion, who is going to blaze the analytic trail and train others?
You need a champion who can devote all their time figuring out what the issues are and how to solve them. You need someone who can educate and mentor the rest of the department in its journey. You need someone to lead the first couple of projects to success, and help cheer the rest of the department on.
You need one focus, one voice, one message. One leader. Dedicated.
Otherwise, you tend to end up with a little progress here, a little there, but no central focus, driving force, or consistency. Without a leader, you expect auditors that have a full audit load to develop an integrated audit and analytics practice? It just won’t happen.
When will Audit Management Manage?
No, I’m not done beating this drum yet.
It’s the only instrument in the band.
How come whenever auditors find an audit issue, they ultimately blame management? Management didn’t establish the proper tone of the top, didn’t establish proper guidelines and procedures, didn’t ensure progress was monitored, and so on.
But when internal audit fails at analytics, it’s because the business process and data isn’t fully understood, an analytic champion was appointed too soon (thus warping everyone’s data vision), auditors don’t have the time and expertise to do analytics, or all of the above.
No one ever points the finger at management, which is where all of this blame belongs.
If management doesn’t set the expectation (tone at the top), provide guidelines and direction (analytics champion), ensure the audit plan includes time and training for analytics (tactics), and measure progress (via performance management reviews and during hiring/promotions), then isn’t management to blame?
Yes, management is to blame.
In fact, I believe audit management, and ultimately audit committees, are responsible for analytics not being mainstream in internal audit yet. Everyone blames everything and everyone else but management.
And no one, not even the IIA, can bring itself to admit it–it’s really management’s fault.
No wonder our profession struggles.
Other posts on this blog regarding building analytics in audit (or not)…
10+ Signs Mgmt Doesn’t Really Support Analytics
Dedicate an Analytics Champion
Auditors, Do Data Analytics or Die
No Analytics, No Audit Department
And don’t forget this one…
Audit Management Sometimes Sucks
ITauditSecurity 
Nice. I had also read the Ia Journal piece, with wild indifference. This post is more fun, though I have yet to take a side.
Missing from both sides of this ‘debate’ are some good illustrations of how analytics can feed into the established IA function. The more usual picture is of how analytics can grow IA into something else.
A piece on the link between analytics and existing IA practice would be very refreshing.
The other roaring silence is around the role of validation in analytics.
Keep it up!
LikeLiked by 1 person
Roger,
Thanks for the input. Audit Monkey, Mack, and I debated how analytics feeds into internal audit and what it can provide. See the ‘Analytics Blog Debate Heating Up’ link at upper right. Someday, we should do a formal article on it.
We have also touched on validation in analytics in this blog. Just search ‘validation’ in the search box. Just like an audit, you first need to ensure your data is valid and complete, otherwise you’re conclusions will be wrong.
Personally, I don’t see many auditors do a decent job of validation on the data they tested before analytics reared its challenging head. Validating data used for analytics is often more complicated because you:
1) are obtaining a much larger volume of data
2) typically use many more sources of data
3) have more formatting and transforming to do to get all the data normalized and working together
4) have many more joins to validate (how do you know that adding the commission paid on an account in source A to the same account in source B gives you accurate data? And how do you know the calculation used to derive the commission payment in source A is the correct amount for your audit? These days, companies have multiple files with similar data that they alter one way or another to meet their specific business needs, and the commission amount that one department uses isn’t always the same amount another department uses; e.g., the first department includes first year commissions in their calculation, but the second does not for whatever reason–I’ve seen this many times and in both cases the calculation is correct in terms of how the final amount is used by the department)
5) have many more tests/analyses to verify are performed correctly, and typically those analyses/calculations are much more complicated that a simple Excel vlookup.
LikeLiked by 1 person
Great post, the way of business has changed, We (1 of big 4) in my region really put a large “Kreshendo” on the Audit data analytic, personally, I think that if you are not using analytic and try to do old fashion audit, in many cases you are not doing a good job, or you really put your reputation at risk. The methodology and tools will keep evolving, simple tasks are going towards robotic processing, and human input needs more rational judgemental analytic.
LikeLiked by 1 person
Eli,
Thanks for your comments. Not doing analytics is plan stupid. Unfortunately, people believed the world was flat for a looong time. An audit without analytics is also flat, but as long as CAEs and audit committees accept this, things will not change until internal audit is no longer relevant, but then it might be too late.
LikeLike