It’s official: ACL is changing its name AND its spots.
I’ve claimed several times that ACL has left its first love (analytics) and doesn’t put enough work into their flagship product, ACL Analytics.
Correction: their FORMER flagship product.
At least they are publicly admitting it finally–they NO LONGER are an ANALYTICS company!
Rumors have it that ACL will no longer be available on the desktop (laptop, or other local machine) in 5 years.
That is, according to an ACL user who attended the 2018 ACL Connections conference.
To increase the amount and depth of the analytics performed, steal some agile methods, and apply them to your audits.
If you’re not familiar with agile methods, check out the first 5 topics listed here (just click Next at the bottom of each page; the topics are quick to the point and full of pictures).
Briefly, agile projects are performed in cycles, or iterations, rather than in a long, linear-waterfall fashion, which is: do all planning, then field work, then reporting. Each iteration of the project creates some value and includes feedback, which is used in the next iteration to increase the value of the project.
In the previous post, Create a Team for Audit Analytics? Part 2, I explored the pros and cons of expecting all auditors to develop a level of data and analytic proficiency.
These auditors would continue to do audit testing that involves analytics as well as testing that does not involve analytics. In addition to keeping up their business skills, they would be learning and upgrading their data analytic skills.
In the first post of this series, I reviewed some of the pluses and minuses of creating a dedicated analytics team.
However, a third option exists, which is sort of a hybrid between having dedicated analytic auditors doing all the analytic work and requiring everyone to increase and develop their data and analytic skills.
Let’s explore the hybrid method in this post, and wrap up the series with a few final thoughts.
This is the third post of a 3-part series…
In the previous post, Create a Team for Audit Analytics? Part 1, I explored the pros and cons of developing an analytics team.
This team consists of analytic auditors who are dedicated to analytic projects; they would NOT typically manage audits or testing that did not include analytics.
In this post, let’s explore another option for managing and growing analytics in an audit department — expecting all auditors to develop a level of data and analytic proficiency.
This is the second post of a 3-part series…
Once your audit team has proven the value of doing analytics consistently, the next question is: Do we create an analytics team and have the team do all (or the majority) of the analytics?
Or should we expect all auditors to develop some levels of analytics proficiency?
Of course, this question often comes a bit further down the trail on the analytics journey, but I think the sooner it is decided, the better.
This is the first post of a 3-part series…
Here’s the 5 things I’m hoping will change in 2018 regarding ACL.
They are all related to each other and feed off each other…
A recent IIA article on building an analytics function in internal audit is dead wrong.
At least on one major point, anyway. And it’s a big one.
As the tombstone reads, this point is D.O.A (dead on arrival, or more specifically, dead on analytics).
The article, Building a data analytics program, requires IIA membership to view, and is located at https://iaonline.theiia.org/2017/Pages/Building-a-Data-Analytics-Program.aspx (that’s actually good, as it means a lot fewer people will ever read it).
If YOUR audit department doesn’t embrace data, analytics, and automation eventually, your audit department will NOT exist.
No data, no analytics. No analytics, no automation. Eventually, no audit department.
Editor Note: This post really applies to all departments in a company, but mainly I’m addressing auditors, but you might want to read between the business lines….
By embrace, I don’t mean have one or two auditors working on this. I mean the entire department.
Before you cite all the regulatory requirements mandating the existence of an audit department in companies, having an audit department in name only won’t cut it.
Having an inept audit department will not be acceptable to regulators, and it shouldn’t be acceptable to company management either. Or Audit Committees!
Companies need skilled and efficient auditors that can do the heavy lifting, and this need will only increase.
Some Chief Audit Executives (CAEs) and audit managers tend to think that audit automation is a set-it-and-forget-it process. NOT.
In this post, I want to expand on a problem I mentioned in an earlier post , 10 Signs Mgmt Doesn’t Really Support Analytics.
Audit management too often thinks that once a process or an audit is automated, ALL auditor/staff hours previously spent performing that process can be reassigned elsewhere.
That is not the case at all.
If your department doesn’t track metrics on your analytics, you are probably not doing analytics or you are making little progress in analytics.
In either case, its obvious that analytics isn’t very important to your management.
Which is one of the points I made in my post, 10 Signs Mgmt Doesn’t Really Support Analytics.
So far, I have encountered very few audit departments that track meaningful metrics about their analytics.
Counting the number of projects that include analytics isn’t enough.
Passing the CISA exam does not make you a good IT auditor anymore than passing a driving test makes you a good driver.
Passing either exam says that you know the basics, but you still have a lot to learn.
Most likely, you still don’t know how and when to use what you know and apply it to the current situation. That’s why experience is necessary. Lots of it.
I’m going on a rant here, so reader beware. If you read on, make sure you hang in there until I make my main point in the end.
You just won’t feel the love right away…
Unless your department is still in the early stages of your analytics journey, analytic skills should be one of your hiring and promotion criteria.
In an earlier post I outlined 10 Signs Mgmt Doesn’t Really Support Analytics.
One of the signs is that hiring and promotion decisions are made without reference to a person’s analytic skills.
To create a successful analytics program in internal audit, you must have a plan. A plan that points to analytic North.
That requires WRITTEN goals.
In an earlier post I outlined 10 Signs Mgmt Doesn’t Really Support Analytics.
One of the signs that indicates management isn’t really serious about analytics is that management does not require every staff member to have measurable analytic goals.
To create a successful analytics program in internal audit, you must dedicate a person to serve as an analytic champion.
In an earlier post I outlined 10 Signs Mgmt Doesn’t Really Support Analytics.
The first sign I noted was the lack of a full-time analytic champion.
Your management says it wants more analytics, but does it really support analytics? Here’s 10+ signs that indicate that your mgmt:
- Does NOT knows what it takes to get analytics off the ground
- Believes that analytics multiply like rabbits, naturally
- Is NOT willing to make the adjustments required to deliver and sustain real value.
If you’re an auditor, you need data analytic skills or you will die.
Or put another way, if you don’t acquire them in the next 1-5 years, you will no longer be an auditor.
Pretty bold statement, isn’t it?
Whether you script your projects or use menu commands, you need to review your ACL log carefully.
Good analysts review their results and the log as they work in ACL, after they think they are done, and have others review their log before the ACL project is relied upon.
(You can’t imagine the dumb mistakes my team and I found that saved us a lot of embarrassment later.)
Over the years, I think that Skyyler and I have penned some pretty funny lines.
If you’re in the mood for some humor, read on and discover why these lines appeared in these posts.
Usually, we were making a serious point in a comical way.
Do you know the #1 reason auditors don’t do data analytics (DA) much?
It is so simple, so obvious, I hesitated to blog about it. Let me know if you agree.
Here’s a way to automate the download of data from Active Directory (AD), specifically group members, into ACL using adfind and the ACL Execute command.
I’ll walk you through it step-by-step.
This was posted before ACL released their own Active Directory driver, which I still haven’t figured out.
Even if you don’t use ACL, you might gain a better understanding of AD and LDAP in general….
Whenever you use OR and AND operators in ACL (or other software, for that matter), be careful to ensure that you receive the results that you are looking for.
Assume you have Table1, which contains 100 loan transactions. 10 of those transactions have a loan rate of 5% and 10 transactions have a rate of 6%. The remaining transactions have rates above 10%.
Recently, I ran an import script to import a delimited file into ACL, but the last 10 fields were not imported. And I didn’t know it right away, because I received no error message.
In addition (or should I say, in subtraction), the log did not indicate anything was wrong. Continue reading
You might be an Audit Command Language (ACL) freak if more than 2 of the following are true:
- At work, you have a second computer (or virtual machine) just for running ACL.
When I ‘m trying to work with text files that are so big I can’t even open them with programs like Excel, Notepad, or PSPad, I reach for the FREE file-splitter program.
If you have ever wanted to go to an ACL conference, this is the year to do it.
If you’re trying to learn ACL on your own, Teach Yourself ACL, the widest read post on this blog, has been updated.
ACL revised their website, which broke many of the links. Those are now fixed.
Until ACL does the dirty deed again (they like to change links for some reason, without redirecting the old ones).
I also updated other items that ACL has changed since the last blog update in 2012.
In ACL, a conditional computed field (CCF), is basically a regular computed field with some fireworks.
It looks and acts much like a regular computed field, but has some extra parts that do some extra work. Fortunately, the extras are NOT complicated, and after reading this post, you will find that will you use CCFs frequently.
So what’s the difference?
Next time you get the cannot perform export to Excel error in ACL, try one of the 3 solutions described below. The full text of the error is:
Cannot perform the export.
You can export fields with maximum of 254 characters to Excel.
If you’re new to the blog in 2013, you might think that Skyyler is only an ACL gear-head. But he DOES write about non-ACL topics. Occasionally.
Once you’ve mastered creating computed fields, you’re ready to add computed fields to a table via script. It is easier than it sounds.
If you need some background on computed fields, see my previous posts, What is a Computed Field? and How to Add a Computed Field (manually). Now let’s explore writing a script that adds computed fields to a table.
As soon as you create an ACL script, you often have to add to it or edit it. There’s an easy way to do it.
Creating scripts (and editing them) is not as hard as many of you believe them to be.
Sure, it takes practice and time to learn the basics, but YOU can do it.
If you don’t learn scripting, you are NOT using ACL to it’s fullest, nor are you making the best use of your time.
Have you been following the “Optimizing Script Performance” series on the ACL Blog? aclkevin has been offering some great tips.
In case you missed them:
Adding a custom view to an ACL table comes in handy when you want to 1) change the order of the fields in an ACL table, or 2) view a select number of fields.
You can add a custom view manually or via script. We’ll tackle the script version first.
This post is in response to Les’ question about reordering fields in a table.
If you’ve been wondering how to add a computed field to an existing ACL table, you’re at the right place. I’ll take you through it step-by-step.
In ACL tip: What is a Computed Field?, I defined computed fields and provided 2 examples. I suggest you read that post before you dive into this one.
That post also explains expressions and functions, which you need to understand when creating computed fields. Both that post and this one are long ones, complete with graphics. You might want to print them both out first…
In this post, I’ll show you how to add the c_Region field that is described in the computed field post. It’s not as hard as it looks.
The profile article of the new ALC CEO, Laura Schultz, indicates a new direction at the company, but I’m not sure what that direction is. Here’s why:
1. ACL tweeted that Schultz is “fiercely determined” (see below), and in the profile, she talks about being “hell-bent” and “extreme” and taking vacations that involve “starving” and “afraid”. This is not your grandmother’s CEO, and maybe that’s the point. Either way, it doesn’t give me any comfort.
Did you know that you can create a script to import a file into ACL? That you can automate loading a table?
I’m talking about the File > New > Table command in ACL, also known as the Data Definition Wizard. Yes, you can create such a script, and I’m going to teach you how!
The good news is that it’s so much easier than you think. The bad news is that it doesn’t APPEAR easy, but it really is, because ACL does the heavy lifting for you. I promise that if you hang in there, you’ll so be a pro. Just try it once, and you’ll be hooked!
On occasion, I have received the following ACL error: The working directory does not have write access permission (see below).
Simply said, it means: the working directory is not working; something is not write. :)
Seriously, the working directory is the directory in which the application wants to start, which is why it is also called the starting directory. This is the directory to which ACL expects you to save your ACL projects. That’s why ACL needs write access to that directory.
When you’re trying to load a new file into an ACL table, you’ll sometimes get this error:: “Application error. ACL Desktop cannot complete this function…contact ACL Technical Support…” (see below).
Here’s the situations in which I’ve encountered this error, and how I’ve fixed it (most common and easiest to fix situations are first).
To make it easier to read articles on the Internet that span multiple pages, look for a Print button or link on the page.
Most of the time, the link is at the bottom of the page, but sometimes the Print link is at the top (of course, not all web sites offer this, but most of the online magazines do).
I haven’t been able to find any reviews of ACL Acerno, so I decided I better get to it.
What is Acerno?
According to ACL’s website, ACL Acerno is a Microsoft Excel Add-in that allows you to efficiently and easily investigate the results generated by ACL software or other sources and share your findings.
For a quick overview, watch this video or check out the quick reference sheet (pdf)—-This info must have been removed when the software was updated.
Acerno is $250 per user.
Even if you don’t read the rest of this, if you’re an auditor, please take the poll at the end of this post.
It’s a best practice to prefix all computed fields with “c_” (e.g., c_Region) for the following reasons:
1) Computed fields are not original data, and you should always keep this in mind. You should scrutinize the values in computed fields carefully, especially when you discover data or relationships that you were not expecting.
A computed field is a field in an ACL table that you create using expressions.
An ACL expression is similar to a Microsoft Excel formula [e.g., =SUM(A1:A2)] in that it contains at least one function [like SUM]. Excel formulas operate on cells (like A1 and A2), but computed fields operate on fields.
You can kill an auditor in 10 easy steps. If you’re a manager, it’s even easier. Here’s how:
1. Insist that all periods are followed by 2 spaces. Those days are long gone and so are typewriters. But some managers who review workpapers still insist on this. No kidding!
A little help for non-auditors: a workpaper describes 1) the control being tested, 2) the steps used to select samples and perform the test, 3) the evidence gathered and how it was analyzed, 4) the conclusion, and if the test failed, usually 5) a broad recommendation of what might be done to resolve it.
2. When reviewing workpapers electronically, question an obvious mistake instead of correcting it. For example, I numbered my test steps 1, 2, 3, 5. Just fix it and move on. Don’t waste your time and mine writing things like “is this number correct?” and then sending it back to me to fix it, especially when it’s the only correction in the workpaper. Just fix it! If multiple errors exist, say something to me or send it back and ask me to review all numbers and references. By pointing out a single error, you are wasting shareholder dollars. I sure hope you feel better now!
If you’re an ACL user, I sure hope you read your ACL project logs and approach the JOIN command carefully. I recently received a good reminder. For an explanation of ACL, see this post.