Painting a picture: Integrating advanced analytics into Internal Audit

With opportunities and risks around every corner, leveraging data to help make the right decision at the right time has never been more important. That’s particularly true in a business world that is increasingly becoming more volatile, uncertain, and complex—which explains why a growing number of Internal Audit (IA) functions are embracing advanced analytics as a way to audit smarter and increase the impact and influence of their functions in the process.

According to Deloitte’s Global Chief Audit Executive (CAE) report, The innovation imperative: Forging Internal Audit’s path to greater impact and influence, the number of Canadian respondents fully leveraging the power of advanced analytics tripled between 2016 and 2018, jumping from seven percent to 21 percent. While these enlightened IA functions are still the minority, the number is growing quickly and there are countless lessons to be learned from these early adopters.

For instance, innovative IA leaders have learned that effective adoption requires a deliberately integrated mindset and methodology. This holistic approach involves defining a robust IA analytics strategy, building a sustainable process framework to support the strategy, defining the right technology and data elements to answer the “crunchy questions”, and aligning roles and responsibilities organizationally to support strategy achievement.

At the same time, the most influential and impactful IA functions are using advanced analytics and visualization across the entire IA lifecycle, starting with risk assessment and planning and continuing through scoping, testing, and reporting. Innovative IA leaders challenge their teams on every assignment to incorporate additional data sets (both internal and external) and further expand their analysis.

Early adopters of advanced analytics are realizing the benefits of these investments and changing the rules of the game. Specifically, these leading IA functions are using advanced analytics to:

• Create and deliver more impactful and dynamic reports that allow users to “drill in” to explore hypothesis and drive deeper and more pertinent insights;
• Better identify and concentrate on the risk areas that matter most;
• Facilitate executive level discussions about the insights that have been gleaned;
• Create tools that the second line of defense can subsequently use to improve their monitoring and oversight capabilities, and enable continuous control monitoring;
• Dramatically reduce testing efforts for Sarbanes-Oxley (SOX) and similar compliance programs, while increasing coverage;
• Become more forward-looking, predicting where future control breakdowns may occur.

Fortunately, those IA functions that have not yet embraced advanced analytics can realize similar benefits. In our experience, it is never too late to begin the journey. Deliberate actions and strength of leadership can produce quick results, and a purposeful shift in leadership commitment to "do things differently" can set the wheels in motion to achieve the desired culture change. Whether you are just beginning the journey or well on your way, the following tips can help you achieve success:

1. Build your purple skills
   To successfully embed advanced analytics into the IA function, it is essential to engage the right team members in the pilot by building teams that possess the right mix of skills. The key is to integrate “red” skills (e.g. technical and analytical skills such as data scientists, technology architects, and software developers) with “blue” skills (e.g. business and communication skills such as IA and finance) to solve complex business problems. This collaboration between red and blue skills results in “purple skills” that enable effective audit execution by focusing analytics efforts and insights on the risk areas that matter most.
2. Adopt a questioning mindset
   When conducting integrated audits, encourage your teams to start asking “crunchy questions” or hypotheses that simplify the data to be extracted, identify the data’s location(s), and allow the team to uncover the insights that are most valuable to the business. Crunchy questions are developed during the planning phase of the audit and can be developed by encouraging business stakeholders to participate more broadly in audit planning, IA functions that have embraced analytics use brainstorming sessions with stakeholders at the start of the engagement to ensure the audit asks the right questions, such as, “I wonder if there is a correlation between...”.
3. Perform a pilot
   The shift to advanced analytics does not happen overnight. For Internal Audit to reap its true benefits, implementation must be approached strategically—one step at a time. Rather than starting with everything at once, perform pilots on specific audit projects where data is readily available and use team members who are passionate about embracing the potential of advanced analytics. Examples of processes that could be part of a pilot project include areas of the business where data is effectively structured and standardized, and which consist of repeatable processes. Typical pilot candidates that early adopters of analytics have tackled include employee travel and expenses, p-cards, procure-to-pay, overtime, credits and rebates, and productivity analysis.
   
   From experience, engaging the right team members and focusing in the right areas is critical to the success of the pilot.
4. Reflect on progress
   Once the project is complete, assess what did and did not work, share those learnings, and apply the lessons learned to future projects. This iterative method will help identify critical success factors, such as how to identify available data sets, how to approach IT with your data needs, or how early in the audit process you need to begin scoping.

Here, again, there are lessons to be learned from early adopters. Notably, the IA functions that grew their capabilities the quickest:

• Engaged in facilitated exploratory sessions that allowed inquisitive team members to roll up their sleeves and learn the tool;
• Used real organizational data from previous or current audits to make training more impactful;
• Challenged pilot participants to use advanced analytics on their next assignment and report back to the group on their successes and challenges;
• Worked with their stakeholders to maintain organizational support, create momentum, and ensure timely access to data.

The analytics advantage

When done right, advanced analytics can offer IA functions—and their respective organizations—a host of benefits. These include:

• Better coverage of risk across transactional processes. Rather than testing random samples, advanced analytics allows for better profiling of the population of transactions to focus audit efforts on the areas of greatest risk. For instance, companies that incorporate more effective risk sensing can gain the ability to determine drivers for problems such as chronic absenteeism, excessive overtime, and travel and expense claim abuse.
• Enhanced report quality and improved comprehension. Advanced analytics allows IA to deliver results based on data-backed findings—which, when combined with appropriate assumptions, earn a higher degree of management confidence in audit findings. Incorporating data visualization tools to tell a story further enhances confidence. Visualization tools and streamlined dashboards make it easier for managers and board members to review and understand the audit results.
• More impactful recommendations. Not only does advanced analytics allow IA teams to review larger data sets, but it enables them to identify anomalies and underlying root causes faster, achieving greater insights.

For proof, one only needs to look at some real world examples. One organization, for instance, wanted to tackle its growing overtime rates and determine if there was a correlation between rising overtime activity and a recent increase in health and safety incidents. Leveraging data from the time entry system and the health and safety system, the IA team uncovered distinct patterns of behaviour stemming from poor staff planning, resulting in an increase in overtime costs and in health and safety incidents related to those areas of the organization.

Another organization that wanted to understand key drivers for chronic employee absenteeism turned to its IA function to help build and visualize data from its attendance management systems and external data sources to identify patterns of behaviour that could be antithetical to the organization’s attendance program. The audit produced data visualization dashboards that helped management identify attendance trends across a multitude of factors (e.g., demographics, geography, external and internal events, commute distance, etc.) and design attendance support programs targeted to groups or individuals requiring the greatest support. This helped management save costs associated with homogenized attendance support programs that would not have addressed the core issues.

IA at a third organization used analytics to explore health and safety concerns and a worrying increase in lost time injuries. Harnessing multiple data sources—including accident reports, weather data, crew schedules, personnel information, training records, work orders, and social media—enabled IA to better understand causal factors and predict employees at highest risk. Recommendations from this review resulted in improved training, modified work practices, enhanced safety requirements, and, most importantly, a dramatic reduction in lost time injuries.

As these examples show, the benefits of advanced analytics are real. IA teams that leverage advanced analytics consistently as part of a structured program, build specific integration points and procedures into their audit methodology, and make sure they are equipped to ask the right questions to effectively process information stand to gain more targeted and expedited insights into audit risk patterns—laying the foundation for more impactful and in-depth audit analyses.