Internal Audit Data Analytics for Beginners

Data mining. Data transformation. These are all synonyms for data analytics. But what exactly does data analytics mean and how can internal auditors utilize data analytics in their work?

Data analytics is defined as, "The science of examining raw data with the purpose of drawing conclusions about that information…"¹ .With the vast amount of information upon which internal auditors must rely to perform their work, it can be overwhelming to determine the best available data (if they are available at all); how to filter data to the best usable format; and how to use data to identify trends, inconsistencies, potential fraud or process improvements to add value to the organization. Essentially, it must be asked, “How can internal audit best utilize and manipulate data to help the organization make decisions?”

With an increase on the reliance of data analytics in engagement fieldwork, scoping, and planning, determining where to begin and how to identify with which projects to start can be challenging. There are 2 phases and associated steps that auditors can take to begin the journey of utilizing data analytics.

Phase 1: The Setup

To begin incorporating data analytics into audit work, an auditor should aim to divide implementation into 3 steps rather than tackling it all at once. Phasing the setup into 3 parts makes implementation more manageable. The auditor may realize that they are further along in the data analytics process than they anticipated.

Step 1: Assessment
To start, auditors should complete an audit score for audit and data analytics assessment. There are tools available to evaluate an audit department's current data and analytics performance. Some tools offer insight into where to focus efforts and help identify the necessary resources. Additionally, some tools assess responses provided against benchmarks. As an output, a report is provided that helps auditors understand how well their teams are currently performing, short- and long-term goals, and resources needed to meet strategy and business needs.

Step 2: Embedding
Based on the audit team’s existing knowledge of data analytics, trainings should be identified and conducted to increase knowledge. From there, the use of analytics can be embedded. Auditors can begin by building a bank of questions or inquiries to incorporate into their audit programs. Without understanding the desired outcome from gathering data, it is challenging to gain much from data analytics.

A proof of concept can be developed to identify where in the organization data analytics may provide the greatest return, whether it is accounts payable, journal entry evaluation, access management, vendor management or help desk ticket analysis.

In addition, audit teams should adapt and reinforce. Current audit processes can be adapted to incorporate data analytics into any phase of the audit. Those efforts should be reinforced for each audit.

Step 3: Utilize
Fortunately, most audit teams do not have to start from the beginning. Resources such as a data analytics example library can be used to gather information and inspiration. Such libraries are collections of practices intended to help users understand how data analytics can be used in audits, consulting and continuous monitoring.

In addition, audit teams should identify which tools they wish to use to gather data analytics. It may seem that sophisticated software programs such as Audit Command Language (ACL)² or Tableau³ are required to perform data analytics, however, more commonly available applications such as Microsoft Excel and PowerBI⁴ can also help teams achieve their data analytics goals.

Step 4: Data Extraction
Before data analytics can be performed, there are 7 steps that should be taken to ensure that the data are reliable and that objectives are achieved:

1. Identify the source of the data. Data may come from a variety of sources such as a data warehouse, application or spreadsheet. Whomever pulls the data and from where they pull it depends on who manages the data—is it the IT department, the business owner or a vendor?
2. Identify the desired outcome of the data. For example, if using analytics for accounts payable analysis, one would want the data to tell them whether there are duplicate vendor numbers, names or addresses.
3. Determine what the results should look like. The results could be displayed in a chart, a spreadsheet or in a Word document in paragraph format. The appearance of the results should be customized based on what is being reported and who is using the information.
4. Are the data available and accessible? One may know what type of information they want to complete their analysis, but it must be determined whether the information is readily available or it requires additional resources and time of other teams.
5. Know which tools to use at each phase of work. Prepare the tools to obtain and analyze the data based on what information is needed. There are various tools available, but it is important to understand which tool can provide results in a timely, easily absorbable manner.
6. Ensure that tools and data are repeatedly tested. This provides assurance that the outputs meet the needs.
7. Validate the output with organizational operations. If it looks good, then it is time to begin.

Phase 2: The Analytics

Once Phase 1 is complete, audit teams can dive deeper into the “how” of data analytics.

Step 1: Analysis
Auditors can combine their training, the embedding of data analytics, their proof-of-concept models and adaptation methods into a single audit. They should obtain feedback from management and the business area about what worked and what did not work to determine whether the analytics met expectations.

Once all parties involved agree that the data provided valuable insight, audit teams should record the steps taken and make the process repeatable.

Step 2: Reporting
Once the data have been gathered, a dashboard that shares the analytics’ outcomes with business owners and management should be created. Dashboards and reporting can help tell a data analytics story and educate teams so that data analytics becomes ingrained across all areas of the organization. One such example is journal entry testing to determine if journal entries were made outside of regular working hours, if manual changes or inputs were made or if the same memo was used on a nonrecurring entry. This type of analysis can assist in identifying and preventing potential fraud. Additionally, the business area can be educated on the analysis and use it to inform a continuous monitoring process.

Conclusion

While collecting data analytics may seem mysterious or difficult, it does not have to be. By utilizing the available tools, starting small, and setting goals for gathering data analytics, the analytics can be incorporated into each audit and results can be shared with management. Audit teams can become the educators—and cheerleaders—for data analytics one audit at a time. The outcome(s) of data analytics have the potential to reduce manual operations, shorten the time needed to complete a task, help identify trends to monitor for potential fraud, increase business ownership in continuous monitoring and highlight the value of internal audit.

Endnotes

¹ Stedman, C.; “Data Analytics (DA),” TechTarget, May 2023
² Diligent, “Automate Processes and Deliver the Insights That Drive Strategic Change”
³ Tableau, “Welcome to Tableau”
⁴ Microsoft, “Turn Your Data Into Immediate Impact”

Deneen Richard, CISA, CRISC, CRMA

Is the assistant vice president and chief internal auditor at LWCC. She has more than 20 years of audit experience including operational, financial, and IT audit assurance and advisory services; enterprise risk management; and enterprise policy. Additionally, her experience spans multiple disciplines such as project management, Service Organization Control (SOC) 1 and SOC 2, Model Audit Rule (MAR), data analytics, and management.