In the previous post, Create a Team for Audit Analytics? Part 2, I explored the pros and cons of expecting all auditors to develop a level of data and analytic proficiency.
These auditors would continue to do audit testing that involves analytics as well as testing that does not involve analytics. In addition to keeping up their business skills, they would be learning and upgrading their data analytic skills.
In the first post of this series, I reviewed some of the pluses and minuses of creating a dedicated analytics team.
However, a third option exists, which is sort of a hybrid between having dedicated analytic auditors doing all the analytic work and requiring everyone to increase and develop their data and analytic skills.
Let’s explore the hybrid method in this post, and wrap up the series with a few final thoughts.
This is the third post of a 3-part series…
Create an Analytic Hybrid?
A third option is to create a hybrid solution that involves 1) increasing the analytic skills across the department while 2) creating a virtual audit team for each audit, which consists of business auditors and more skilled analytic auditors.
A virtual team is formed just for each audit that can benefit from analytics, and dissolves after the audit is complete (sounds a little agile, doesn’t it?).
PROs
- The entire team is involved in all analytic steps. As a result, they not only cross-train each other in business knowledge and analytics, but the additional and different perspectives of each team member enriches the audit.
- The entire process is more efficient as each member contributes more heavily in their area of expertise and less in other steps. For example, while the entire team discusses and brainstorms how to develop the analytics, generally only one person performs them. As the analytics progress, the analytic auditor should review the progress and results at key points with the team, gather input, and update the analysis.
- The entire department steadily increases its business knowledge and analytics skills every year (the focus of the first bullet was the team; this bullet focuses on the department as a whole).
- Over time and across the department, analytics increase, and audits tend to be more in-depth, which adds more value to the company.
- No auditor is left behind.
CONs
- One or more dedicated analytic auditors are required to guide the analytics program, help train auditors, provide ideas and insight, and work on the virtual teams. [In my mind, this is a CON only in the expense category, as dedicated analytic auditors can quickly help others to get moving or solve issues.]
- Managers have to manage their people across multiple teams.
- Creating, managing, and delivering an audit is harder when more people are involved.
- More time is required for each audit, especially when auditors have not worked with each other before, or in the area being audited. Or when some are new to analytics.
- Training costs increase as more auditors get trained in technology and analytics.
- In the early stages, when few experienced analytic auditors exist, one or more people have to be fully or partially dedicated to serving as the analytic expert on these teams.
- Auditors who enjoy working alone and are not interested in analytics will find another job (in the long term, isn’t that a positive?).
So Which Method is Best?
Well, that depends on your goals, your budget, the skills of your current auditors, and your management.
I have worked in departments that have tried all three methods.
I think the hybrid approach is more flexible, more inclusive, and ultimately benefits the auditors and department more in the long run.
However, the hybrid approach requires highly motivated and involved management and auditors.
Takeways
- The earlier you determine which of the 3 methods to use, the greater focus you can have in your analytic journey.
- Regardless of what method you chose, trade offs exist, and in the end, all of them require a lot of work.
- Having a least one dedicated analytics auditor or champion will make any of the 3 methods easier and more successful.
- Auditing is evolving, and analytics is not going away. You can either deal with it proactively, or when you are forced to.
- If your audit management team is weak, it will be much easier to form and manage a small, dedicated analytics team.
As always, I’m interested in your feedback.
I think there is a practical 4th option: a few strong PMO oriented and the performance and actual work is on Analytic as a service based.
by subcontractors or one of the big4. sure data security should be a consideration, but in that approach you have a few best of breed in the field that best suites you. and always looking at the result level and not on the process itself (not mentioned hardware, license managment and cost)
LikeLike
Eli,
While that’s an option, a third party would not understand your business or your data like internal folks. So like the other 3 options, PROs and CONs exist.
Thanks for mentioning it!
LikeLike
Pingback: Create a Team for Audit Analytics? Part 2 | ITauditSecurity
Great job, i have been looking for an IT auditor job for a while, i am a CISA and live in Nigeria. Been trying to get my foot in the IT audit door but no luck yet, any ideas? I do not even mind relocating or volunteering for the experience…and yes, i passed the CISA exam with next to no IT audit knowledge.
LikeLike
IFY,
Did you see my post https://itauditsecurity.wordpress.com/2017/03/21/how-to-get-an-it-audit-job-with-little-or-no-experience/? That’s the best I can provide, given that you’re across the sea.
LikeLike
Great post Skyyleracl. Well all the 3 options outlined have its advantages and disadvantages.
Personally I prefer the second option where everyone on the team is involved in analytics.
As I see the only limitation of analytics is your imagination. The more creatively you think the more insights you can gain from data analytics. And more members bring more thoughts to the table (quality of thoughts do matter).
LikeLike
Audit Monk,
Thanks for your input.
Is your team all involved in analytics? If so, how big is the team? The smaller the team, and the newer the audit department, the more likely this is to work.
I’ve found trying to get a larger team in a dept that’s been around for decades to all do analytics on a standard level of competence can be hard. It requires a lot of change, especially when you have a bunch of auditors who worked in public accounting.
I like your imagination comment. I think that’s a big issue, but even with analytic leaders providing lots of that to a dept, mgmt still has to have the willingness to act.
LikeLike