At least on one major point, anyway. And it’s a big one.
As the tombstone reads, this point is D.O.A (dead on arrival, or more specifically, dead on analytics).
The article, Building a data analytics program, requires IIA membership to view, and is located at https://iaonline.theiia.org/2017/Pages/Building-a-Data-Analytics-Program.aspx (that’s actually good, as it means a lot fewer people will ever read it).
The article states that
When an internal audit function decides to reassign a technical resource as the team’s analytics champion, problems often ensue.
The authors claim this can lead to analytics being a “purely technical exercise” instead of making it an integrated part of the department’s culture.
In my opinion, whether analytics is practiced “in pretense or in truth,” at least it would be practiced in those departments. I would wager it would be easier to change and weave a “purely technical” analytic effort into a useful, integrated audit process than to start an analytic effort from scratch.
At least you’d have some technical acumen in internal audit, which is too often more refreshing than it should be.
Or perhaps you should assign a non-technical champion? Each audit team has plenty of those.
Also, the article alleged that establishing analytic leaders too soon may cause auditors to not spend the appropriate amount of time and effort understanding the business process and the associated data.
Wait a minute – you can start analytics in internal audit too soon? Let’s wait another decade then!
The authors suggest that once the entire department has the right understanding of processes and data, then the “analytic teams then layer in their view and capabilities.”
This is so messed up.
Yes, I agree you need to understand process and data before doing analytics.
However, if internal audit hasn’t figured out by now how to understand business processes, the systems behind them, and the data produced, and how that data is used (or should be), then what the heck has internal audit been doing all these years? And where is audit management’s ‘supervision’?
So for decades, auditors have not audited business processes and data? If so, they have done that without understanding the process and data? And audit management hasn’t cared? This is nonsense.
Furthermore, if you shouldn’t establish analytic leaders before this understanding occurs, how will those “analytic teams layer” in their expertise? Where will those teams appear from?
If audit isn’t already understanding data, then don’t bother with analytics. You have much deeper issues.
Basically, this article implies that if internal audit doesn’t know what to do with data today, don’t move forward with analytics.
I agree. The first thing you need to do is fire the audit department management, especially the chief audit executive (CAE). And maybe a few others.
Because management is not doing its job.
Once that is accomplished, and better audit management is hired, then you need to hire an analytic champion.
If internal audit doesn’t understand processes and data, an analytic champion can help increase this understanding while building an analytics worldview. Otherwise, who is going to lead it? Especially since analytics IS technical and requires skills that even many IT auditors don’t have, much less the average internal auditor.
If you need this data understanding built, why would you not want a dedicated leader for it? And who would be better at it than an analytics champion? Some big 4 bloke? Not.
What if Audit Understands Process/Data?
Assuming that internal audit DOES have an appropriate approach to business processes, systems, and data, and you don’t appoint an analytics champion, who is going to blaze the analytic trail and train others?
You need a champion who can devote all their time figuring out what the issues are and how to solve them. You need someone who can educate and mentor the rest of the department in its journey. You need someone to lead the first couple of projects to success, and help cheer the rest of the department on.
You need one focus, one voice, one message. One leader. Dedicated.
Otherwise, you tend to end up with a little progress here, a little there, but no central focus, driving force, or consistency. Without a leader, you expect auditors that have a full audit load to develop an integrated audit and analytics practice? It just won’t happen.
When will Audit Management Manage?
No, I’m not done beating this drum yet.
It’s the only instrument in the band.
How come whenever auditors find an audit issue, they ultimately blame management? Management didn’t establish the proper tone of the top, didn’t establish proper guidelines and procedures, didn’t ensure progress was monitored, and so on.
But when internal audit fails at analytics, it’s because the business process and data isn’t fully understood, an analytic champion was appointed too soon (thus warping everyone’s data vision), auditors don’t have the time and expertise to do analytics, or all of the above.
No one ever points the finger at management, which is where all of this blame belongs.
If management doesn’t set the expectation (tone at the top), provide guidelines and direction (analytics champion), ensure the audit plan includes time and training for analytics (tactics), and measure progress (via performance management reviews and during hiring/promotions), then isn’t management to blame?
Yes, management is to blame.
In fact, I believe audit management, and ultimately audit committees, are responsible for analytics not being mainstream in internal audit yet. Everyone blames everything and everyone else but management.
And no one, not even the IIA, can bring itself to admit it–it’s really management’s fault.
No wonder our profession struggles.
Other posts on this blog regarding building analytics in audit (or not)…
And don’t forget this one…