Adding insight to audit

Adding insight to auditTransforming InternalAudit through dataanalyticsWhy analytics? Why now? embedding analytics into the culture of the Internal AuditTraditional internal audit methodologies have served their function, and aligning the analytics implementation withpurpose well for decades. However, as the business land- the planning process and overall organizational operationalscape for most organizations becomes increasingly complex and strategic objectives.and fast paced, there is a movement toward leveragingadvanced business analytic techniques to refine the focus Before analytics can be successfully implemented, however,on risk and derive deeper insights into the organization. it is critical to understand what analytics is — and isn’t.Leading Internal Audit functions are embracing recent Analytics is not a technology; it’s a concept. It refers toenhancements in data mining technology and data visual- the use of certain technologies, skill sets, and processes forization tools to deliver results more dynamically in response the exploration, evaluation, and investigation of businessto risk, dive deeper into organizational data, and deliver operations. It can be used to drive planning, gain insight,profound fact-based insights. Business analytics holds in- and optimize the internal audit lifecycle. The practice ofcredible promise to enhance the internal audit process. Key analytics makes extensive use of data, statistical and quan-to delivering on this promise is asking the right questions, titative analysis, explanatory and predictive modeling, and

fact-based management to drive decision making. There are data to capture all relevant facts for analysis — not justseveral disciplines contained within the scope of an analyt- samples that might not accurately reflect the underlyingics initiative: analytics methodology, analysis tools, perfor- reality or risks. Analytics can evolve the internal auditmance management, descriptive statistics, exploratory data process from episodic to more forward-looking dynamic andanalysis, confirmatory data analysis, as well as data manage- continuous reviews.ment. Used together, the disciplines of analytics providehindsight, insight, and foresight. Analytics — which is already used in many areas of the business, such as finance, workforce management, supplyThere are several factors that have really fueled the rise in chain management, and customer relationship managementthe use of analytics in Internal Audit functions. The first — can help meet these expectations. Applying analytics tois the explosion of data volumes — both structured and the internal audit process can facilitate moving beyond theunstructured. With this explosion have come innovations traditional internal audit activities toward an environmentin the capture of, and reporting on, that data. The next is of more sophisticated risk analysis and monitoring. Bythe increasing expectations of key stakeholders vis-à-vis the leveraging the power of analytics, the internal audit processnature and value of reported information that the internal can produce insights and conclusions that help decisionaudit process produces. As the business environment grows makers take action quickly and make more effective, timelyincreasingly complex, stakeholders require deeper insights decisions.and clearly stated facts to support decisions, build greatervalue, and create a more dynamic focus on risk. The business case for audit analytics Analytics provides answers to decision makers from threeAnother factor driving the adoption of analytics in the perspectives: historical, current, and future — i.e., it pro-internal audit process is the limitations inherent in tradi- vides hindsight, insight, and foresight. It can help users asktional techniques. Historically and even today, techniques such questions as, “What happened, and why?”, “Whererely heavily on sampling data resident in enterprise sys- is the problem, and what actions do I need to take to solvetems, thereby only providing the capability for episodic, it?”, “What will happen if these trends continue?”, andretrospective, and limited views of exceptions, control finally, and perhaps most importantly, “What’s the best/breakdowns, or risk. In today’s more complex environment, worst that could happen?” This predictive capability ofhowever, it’s essential to dive deeper into organizational analytics supports the shift toward dynamic risk-focused 2

audit planning and audit execution over static traditionalplanning approaches. Optimization “What’s the best that can happen?” Degree of intelligence Predictive and Predictive modeling/forecasting “What will happen next?” prescriptivePerhaps one of the biggest challenges that the internal Randomized testing “What happens if we try this?” analysis (the “so what”)audit process faces today is the expectations of the C-suite Statistical analysis “Why is this happening?”and Audit Committee, that Internal Audit should supportthe business by delivering deeper insight and greater value Alerts “What actions are needed?” Descriptivemore efficiently and effectively. Some of the more challeng- Query/drill down “What exactly is the problem?” analysising expectations of Internal Audit include: (the “what”) Ad-hoc reports “How many, how often, where?”• Being more efficient and achieving more with less Standard reports “Why did it happen?”• More effectively identifying and responding to risk• Delivering more robust and effective analysis of key Figure 1: The value of information issues• Providing more meaningful actionable insights• Driving change within the business By applying analytic tools and techniques, internal auditors can help their business partners obtain deeper insight intoThe solution to these challenges lies in the application of their data, systems, and processes and gain the ability to askanalytic techniques to the internal audit process. Indeed, we — and answer — new and more complex questions aboutbelieve that analytics will be transformational for Internal their business. They can move from asking “What do weAudit. need to do?” to “What do we need to know?”One example of this is the use of analytic techniques to The shift is subtle, but powerful. For example, insteadevaluate compliance with controls, business rules, and of simply asking about what happened, companies thatorganizational policies that can deliver long-term cost employ analytics can look forward and gain insight andsavings and increase audit efficiency. This allows internal foresight into what might happen, and they can formulateauditors to focus their efforts away from manual auditing new questions to ask in order to get the information theyprocesses and toward the areas of greatest benefit to the need to model the future. They can accomplish this byorganization. using their data, coupled with simple analytics tools, to build models and perform scenario or “what if” analysis. 3

Leading organizations are deriving a wealth of benefits The process of integrating analytics into the internal audit process is one ofthrough the application of analytics to the internal audit continuous improvement. The figure below represents an illustrative maturity model for Internal Audit analytics.process. These benefits include new and deeper operationaland strategic insights gained through using analytictools and techniques to answer questions about what ishappening — and what might happen — in an increasinglycomplex environment. Using analytic technologies, internal Leading Efficiency, Insightaudit teams can enhance value delivered by driving downcost, while expanding audit coverage and improving the Advancedfocus on risk. In the process, audit efficiency is dramatically Defined Initial Developingimproved.The process of integrating analytics into the internal audit • No or limited • The organization • Capabilities • Capabilities are • Capabilities areprocess is one of continuous improvement. The figure below capabilities exhibits a basic are developed well-developed well-defined andrepresents an illustrative maturity model for Internal Audit • Ad-hoc activities set of capabilities and adopted and practiced institutionalizedanalytics. resulting in • Processes are consistently with appropriate • The department unpredictable rudimentary and • Capabilities are governance has performance loosely woven used to drive • Processes are differentiatedRisk management is one of the leading areas in which • Success is based • Success is some audit used to drive itself based onorganizations choose to apply analytics. Analytics provides on individual repeatable activities audit activities its capabilitiesbetter “radar” on risk via the application of exploratory and competence with similar • Management • Processes and • Continuouspredictive techniques, as well as through the automation of and not on application and defines goals practices are improvementroutines that speed up the evaluation of risk. This ability repeatable scope, but not and objectives routinely methodologies processes consistent across for standardized analyzed for are used toto focus intensely on more complex and significant risks organization processes and effectiveness adapt to futurehelps companies identify and address current and emerging confirms they are and efficiency changesrisks more quickly, and it provides them with more — communicatedand more timely — information that can be used to makedecisions and take action to raise and report those risks. Figure 2: A maturity model for audit analyticsThis, in turn, gives management the ability to monitor and 4

mitigate these risks promptly, and to execute more timely A great example of this is the application of inductivequantitative and qualitative risk-related decisions. analytics delivered via a Self Organizing Map (SOM). Techniques that utilize SOMs, and other clusteringCompanies that implement analytics in the internal schemes, can be employed against a wide variety ofaudit process can use the enhanced information and variables to categorize benchmarks for audit entities withindecision-making capabilities analytics provides to move the organization. Anomaly detection algorithms based onaway from episodic static plans to dynamic planning neural network techniques can then be applied to examineutilizing continuous monitoring and predictive modeling entities that are risk outliers to these benchmarks withinapproaches. That is, they can optimize resource allocations their categories.as needed, and they can view potential problems in greaterdepth to move from reactive to proactive decision making. Analysis of this nature will highlight behavioral outliers and help direct audit activity toward areas of greatestAnalytics also provides companies with the ability to risk. This is a particularly effective analysis for risk acrossperform the internal audit process with lower costs geographic locations and overseas operations, but it has alsothrough the use of automation. By using analytics to been used to analyze areas as diverse as revenue leakage andautomate the more routine activities of the internal audit occupational health and safety risk.process and to dive more deeply into the more complexinternal audit issues, companies can perform more timely Another example where analytics can be applied is in fraudand less costly testing of compliance with policies, detection and exception identification algorithms; theseprocedures, and regulations. are often based upon anomaly detection schemes. Myriad techniques can be employed from logical risk scoringAnalytics applied to decision trees to stochastic link analysis. ApplyingInternal auditors and their business counterparts these techniques in combination detects transactions thatincreasingly need to see the data. Data is the basis for are the most likely to exhibit fraudulent or exceptionaldecision making and spreadsheets are no longer sufficient characteristics. Further automating and scheduling thesetools to get the point across; analysts need color, shape, routines helps Internal Audit to move toward automatedand movement in space and time. Various technologies detection and exception-based auditing.are available today that put information into the hands ofthe user — the goal is to bring the analysis closer to thedecision makers. 5

Figure 3: Dashboards over sustainable analytics 6

The final challenge: Sustaining analytics going forward • Practice “right-fit” analytics: Match statistical andAs the application of continuous monitoring to the analytics techniques to the job at hand.internal audit process illustrates, analytics is a journey, nota destination. Organizations that have mastered applying Sustainable analytics is a journey, not a project. Ifanalytics to support enhanced process efficiency, analysis, organizations are to truly sustain their analytics efforts, theyand decision making can extend the power of analytics should be ready for, and embrace, change. Analytics must beto attain ongoing competency. This can be achieved by woven into the very fiber of the organization. Analytics toolsapplying the seven principles of sustainable analytics. These and technologies must support and be embedded in high-principles, listed below, help to accelerate the adoption of impact areas that drive value. It’s also important to listenanalytics throughout the enterprise and capture the value of to all available signals that flow into the organization on aorganizational data. daily basis and use information from those signals to deliver• Start where you are: Assess your current capabilities, and hindsight, insight, and foresight to understand what’s reallyget a clear picture of the gaps. Focus on low-hanging fruit happening across the enterprise.and develop a long-term analytics road map.• Ask “crunchy” questions: Know which questions matter Management must be able to think outside the box whenmost to your industry, strategy, and priorities. problem-solving. They must ask the right questions,• Enhance signal detection: Detecting and responding and they must be willing to use new inputs and weighto signals better and faster are the keys to achieving facts against gut feelings when making decisions. Finally,competitive advantage. analytics tools and technologies must align with and support• Accelerate insights through automation: Automate the overall organizational strategic direction, and they mustdelivery of the information — to management, operational, help the organization recognize, confront, and manageand analytical processes. the challenges and constraints that inhibit growth and• Engage and visualize: Output must deliver insights performance.people need — in whatever forms required — to makefact-based decisions.• Develop a fact-driven culture: Embed analyticscapabilities into decision-making processes matching yourapproach with your style. 7

Contacts Contributors John Peirson Vivek Katyal Sunita Suryanarayan Partner Principal Robert Liu Deloitte & Touche LLP Deloitte & Touche LLP Arslan Khan +1 612 397 4714 +1 612 397 4772 jpeirson@deloitte.com vkatyal@deloitte.com Neil White Steven Henchock Principal Principal Deloitte & Touche LLP Deloitte & Touche LLP +1 212 436 5822 +1 404 220 1689 nwhite@deloitte.com shenchock@deloitte.comThis publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment,legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basisfor any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult aqualified professional advisor.Deloitte, its affiliates, and related entities shall not be responsible for any loss sustained by any person who relies on this publication.About DeloitteDeloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, eachof which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte ToucheTohmatsu Limited and its member firms. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and itssubsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.Copyright © 2011 Deloitte Development LLC. All rights reserved.Member of Deloitte Touche Tohmatsu Limited 8

Adding insight to audit

by Deloitte Analytics

Accessibility

Categories

Upload Details

Usage Rights

Statistics

Adding insight to audit Presentation Transcript