ISACA Journal Author Blog

ISACA > Journal > Practically Speaking Blog > Posts > The Keys to Using Analytic Techniques

The Keys to Using Analytic Techniques

Spiros Alexiou, Ph.D, CISA
| Published: 11/14/2016 12:45 PM | Category: Audit-Assurance | Permalink | Email this Post | Comments (2)

Modern companies routinely collect a large amount of data, which are used for a variety of purposes, including audits. Analyzing the data and deciphering the story that they are telling could be done with very simple techniques or can require quite complex and sophisticated techniques. A number of software packages, some of them free, perform such complex analyses. These techniques can be applied by most auditors, provided they understand what the techniques do, not necessarily how they work. In my recent Journal article, I present a number of such techniques that have proven useful in audits. These techniques have different scopes and purposes, e.g., clustering automatically finds groups of similar behavior, while case-based reasoning finds the most closely related data instance in the database. 

These sophisticated techniques can be invoked with the command “run technique A on data set X”. The keys to using these techniques are:

  • Understand the problem and make sure the data include all relevant information—One needs to understand the data and fields, e.g., expenses, bytes and exceptions, that are material to the audit in question and include them in the analysis data. No computer program or technique will produce reliable results if key data are missing; for example, monetary fields are essential if financial issues are investigated, and traffic fields are indispensable if network intrusion is being investigated. Whether one uses advanced techniques or not, some field expertise is needed to identify relevant data fields and answer the question “What information do I need to check?”
  • Prepare/preprocess the data—Many methods, such as clustering and case-based reasoning, require the concept of distance. This concept means that all fields must be—or must be converted to—numerical and scaled so that they are commensurate, because they will be added. For example, non-numerical fields, such as yes/no or male/female, can be converted to 0/1. Numerical fields are more complex, because their scale must represent the relative importance of the fields. Hence, domain expertise is necessary, because the question “What is the relative importance of one unit in field X vs. one unit in field Y?” must be answered.
  • Interpret the results—For example, after a number of clusters, i.e., groups of data with similar behavior, are identified using the clustering technique, one must interpret the corresponding characteristics of each group, e.g., high and frequent procurement expenses.

Read Spiros Alexiou’s recent Journal article:
Advanced Data Analytics for IT Auditors,” ISACA Journal, volume 6, 2016.



Very interesting Paper. Can you name some Software  packages implementing these thechniques?
Stavroula951 at 11/24/2016 3:46 AM


Reference 5 in the article provides a list. You may also wish to look at a more recent list of top tools in
Spiros782 at 11/25/2016 2:42 PM