The other day I was in a meeting to discuss a new analytics project and discovered the team had no end goal.
When the discussion started with the software to be used, I knew they were already off track.
I stopped the discussion and asked the following questions:
- What is the business problem that you are trying to solve?
- What will the end result of this analysis be? A report, a dashboard, a widget?
- Who will use the end result and what decision will be made based on it?
I was told those items would be figured out as they went along. Yikes!
Whenever you hear that answer, relay that to your audit management and get input.
Oh, did I mention that the project team consisted of my colleagues in the audit department? And that those same auditors create audit issues when we see the business side of the house do just that? And that audit management is part of the project team AND was the one who said, “We’ll figure it out…”?
Sheesh.
It frustrates me to no end that auditors think they are above the requirements that they expect the rest of the business to follow….so much for audit integrity.
ITauditSecurity 
Always enjoy reading your blog posts! I’d enjoy chatting with you, if you’re interested.
LikeLike
Hi Paul,
Thanks for the kind words. I think our paths did cross once, as I recognized your name. I’d enjoy talking with you too, no doubt, but I’d rather remain somewhat anonymous, which is my policy. Keep up the good work!
LikeLike
Whenever I lead ACL-related projects or trainings, I always focus on this point first. In trainings, I tell participants to close their laptops or turn off their screens and convey the importance of knowing what you want to do before you even open the tool (or choose the software to use in a project). The blessing and curse of technology today is that practically anything CAN be done using cheap or free tools, so having scope be driven by the accessible tech is begging for scope-creep and an unfocused project with unclear objectives and often less valuable deliverables.
Sadly, this is the same problem with FAR too many audit departments’ vision and strategy, which consistently starts with answering questions like “how much budget do we have?” rather than “what do we need to do for effective assessment and management of risk within the org?” (with risk prioritized based on org mission/vision/objectives and continually monitored and managed…not just covered with words in a PowerPoint slide for the Board once a year!).
LikeLike
Paul,
I agree. I am concerned with our profession as a whole. The fact that data analysis lags so far behind in many audit departments (some departments do poor analysis even in Excel) is indicative of a larger leadership problem. This is despite the constant reminders from organizations like IIA and the big 4 that they need to step up.
If the data analysis fundamentals are weak on a team, I would insist that means the audit fundamentals are also weak, as auditing in today’s world cannot be effectively or efficiency done without a robust data analysis culture, especially when all other departments besides audit are doing it.
I know you, as I, will keep beating our drums.
Good to hear from you! Cheers.
LikeLike