This post contains my response to my earlier post, ChatGPT Analyzes Internal Audit!
First of all, most of the article sounded like it was written by external auditors; it sounds important, but really doesn’t say much.
It’s interesting how in paragraph 2, “Chatty” says that he (it?) notes that the ‘question remains‘. You’re only 1 paragraph into the article, so of course you haven’t answered the question yet. Hmmmm.
Then Chatty almost tells you it won’t be really answering the question, but instead will do some ‘exploration’ while looking at ‘key considerations’.
I liked that ChatGPT defined data analytics. I would have included something about predictive analytics, but at the same time, I don’t see predictive analytics as being central to internal audit’s charter, but some audit teams are doing it.
Even Chatty realizes that modern internal audit processes include data analytics. I guess many audit teams aren’t very hip or modern.
I loved this sentence: The benefits of data analytics for internal audit are numerous.
Then it asks the original question again, as if it KNOWS it isn’t getting the job done and needs to remind itself to get moving.
The answer DOES depend on a variety of factors, and I agree with most of them, but ‘the nature of the risks they [the organizations] face’ in my mind is NOT a factor. Every company, big or small, faces similar risks. People can steal from the company, mess with payroll, not work very hard, cheat on expense reports, etc.
Okay, if we’re a 2-person company, either you are stealing the product or I am, or maybe both of us. You may not need analytics to determine that, but for the most part, that’s not the case in most businesses. Plus we’re talking about companies big enough to need an audit team.
The need for analytics doesn’t change with the type of risks.
Then Chatty talks about striking a balance between analytics and analysis paralysis. I haven’t seen any auditors (spread across 3 large organizations I’ve worked at) struggle with paralysis in regular auditing or analytics. The main problem I’ve seen is that auditors get paralyzed when they are asked to review/test a data set,can’t do it, and don’t want to learn.
Another issue I noted in the article was how auditors “should prioritize the most critical risks and focus their analysis on the areas where they are most likely to find issues.”
On the surface, this makes sense, but it also sounds like auditors should shy away from areas where no issues are expected. Sure, you always audit the highest risks, but long-term frauds are committed often by people that are trusted using processes that seem just fine. When you analyze an area and don’t find anything (assuming you did a good job), that’s call assurance that a process is working, and that’s valuable also.
Chatty says analytics isn’t a panacea, but a lot more analytics could go a long way to highlight the problems plaguing many companies. While I agree that some processes can’t be reviewed by analytics, a bigger problem is that most can, but auditors don’t do it.
In conclusion, Chatty never answers the question, but regurgitates what other people (and itself) have already said and calls it a day.
Now there’s a lot of material on the Internet bemoaning the low adoption of analytics in internal audit, and for several years (Chatty didn’t read this here blog in preparation, evidently).
Or the recent Caseware State of Internal Audit Trends Report 2023 that states that only slightly more than half [I think it was 56%] of audit teams today do regular analytics (page 25).
Had Chatty been trained on that or all the IIA or Big 4 articles that said the same, it would have probably been less positive in its tone and actually answered the question.
Not that I really expected a good answer, but it gives you an idea of what to expect from ChatGPT (and auditors).
So what did you think?
– – – – –
Next up, something related to Elon Musk…
ITauditSecurity 