How to Build a Data Science Team Within the Internal Audit Function

Data science is a growing and evolving force in different functional areas of business, and the internal audit function is no exception. While internal audit functions strive to build an in-house data science team or already have one in place, they should take extra care not to perceive it the same as building any other functional or technical team. Instead, there are some specific considerations to take into account, including:

Organizational Context and Considerations
A data science team is not a technology team, but more like an internal consultancy to internal auditors. Data scientists moving into internal audit may meet with initial request to build more “fancy” reports or dashboards, but those with the right “consultant” mindset should be aware that their analytics solutions must make the job of their “clients” (peer internal auditors) more productive and/or valuable, beyond looking more “fancy.”

The initial projects executed by data scientists are just opportunities to trigger discussions for longer-term digital transformation and changes needed for internal auditors to make a greater impact organization-wide. Built on these discussions, data scientists should assess readiness and accessibility of required data resources along with the validity of applicable analytical methods, and then communicate possible paths of change for the internal audit function. In accomplishing these goals, data scientists in effect act as agents of change, but they should be astute in driving for changes at a scale and scope that the internal audit function as a whole can understand and undertake without experiencing traumatic disruption. This is especially true considering that data scientists are mostly brought in without prior auditor experience and budgets/resources have to be justified between existing and transformative projects.

As data scientists are brought in, a key decision has to be made on how data scientists are structured to work with incumbent internal auditors. There are usually three available options as illustrated below:

1. Decentralized. Individual data scientists are allocated across different audit teams targeting specific business functions and are reporting to their dedicated team leads.
2. Centralized. A siloed data science team consisting of data scientists provides analytics services to different audit teams.
3. Hybrid. Individual data scientists are allocated to each audit team while a siloed data science team serves as a center of excellence on shared analytics solution to avoid duplicate efforts.

Any of above team structures can work and each has pros and cons, some of which are specific to the internal audit function:

Integration and collaboration. Internal auditors have to acquire and keep up to date a diverse range of professional knowledge into business processes of audit interest. Sitting in a specific audit team makes it easier for data scientists to maintain the same level of business and professional context and to foster greater ties with individual auditors. This will help data scientists better customize their analytics solution for audit needs and push for more seamless adoption of data insights into audit results. On the contrary, a centralized data science team provides more opportunities for teamwork and collaboration among data scientists.

Data sourcing. Data sourcing and acquisition have certain nuances with respect to internal audit functions: most data for audit purpose have to be requested from respective business owners, and the scope and meaning of data is subject to change as underlying business, technologies and processes change. Data scientists then need to keep close contact with business owners and their supporting technology teams. Data scientists in the decentralized structure are better positioned to leverage existing connections between auditors and auditees to accomplish such goals.

Scalability. Though a data science team is not a tech team, the process of data science still includes technical tasks such as data platform migrations, incorporating new technologies, and adopting experimentation platforms, which are more efficient to be delivered by a centralized data science team and performed by different data scientists together.

The Evolving Approach
No approach to data science is perfect; it has to evolve along the way. For small internal audit functions staffed with limited full-time data scientists, they may start with the decentralized approach by pairing data scientists and specialized auditors to quickly understand the problem of audit concern, model the problem, and offer solutions and insights in a quick turnaround. As teams take on larger and more complex problems, it may warrant the start of evolution toward structuring data scientists in the hybrid approach or even in the centralized approach mentioned above.

Whichever the approach, the key to success is finding the right data scientist talent (which can be a challenge!) to kick off the data science journey – the “seed” players who are both able and willing to commit to the internal audit field.

Editor’s note: Learn about ISACA’s Data Science Fundamentals Certificate here.