The explosion in the use of digital channels and the data they produce have caused a corresponding rise in the use of data analytics by the risk management and internal audit functions within financial services firms seeking to streamline their processes to gain efficiency and adopt a more agile approach to risk management. The internal audit function has been using data analytics for some time but it remains in its infancy in terms of maturity.
Our data analytics experts recently took part in a joint webinar with the Institute of Internal Auditors’ (IIA) Financial Services Audit Center (FSAC), which focused on some of the benefits and main challenges firms are encountering as they attempt to ramp up their use of internal audit data analytics.
The majority of the IIA webinar audience (68 percent) confirmed that they were already using data and analytics as a part of their internal audit processes, in some form. This is consistent with findings for the industry in our Internal Audit Capability and Needs survey, where two-thirds of respondents said that they are using analytics, while the remaining one-third said they weren’t currently using them but indicated that they plan to implement them in the next one to two years.
Despite the many accepted benefits of data analytics – increased efficiency and effectiveness, increased breadth and depth of coverage, continuous monitoring, real-time response, and the ability to discover the unknown unknowns – more than half of the audience (57 percent) indicated that they do not have any dedicated analytics staff, and only a third have a small team of between one and five people dedicated to analytics.
For those internal audit functions that are using analytics, their capabilities remain at the low end of the maturity spectrum. Only six percent of the webinar audience considered their capabilities to be at the higher end of the spectrum, and just one percent considered their capabilities to be optimized. The focus of many internal audit functions remains on process improvement – a quarter of attendees confirmed that they have a process which is documented sufficiently so steps can be repeated, with 16 percent saying that the process is defined as a standard business process.
Currently, the use of data analytics for internal audit purpose is primarily in the audit execution phase, according to 46 percent of the webinar audience, and more rarely in the audit planning phase (26 percent). Again, these results are consistent with our survey. However, we would expect all firms to be using analytics for execution purposes, which is a stepping stone to broadening analytics capabilities throughout the entire internal audit process.
What seems to make a difference in the level of maturity is the presence of analytics champions in the IA function. Our Internal Audit Capabilities and Needs survey confirmed that organizations with analytics champions perceived a higher level of value from their use of data analytics than other firms. We have found that this perceived value directly correlates with the maturity of the department’s data analytics capabilities.
Barriers to Implementation
According to nearly half of the webinar audience, the most common barrier to implementation of data analytics is data access and data quality. Internal audit functions need to partner with the technology functions to develop robust processes for data acquisition. Requests for data must be specific and easily understood by the technology and business functions. There is a growing trend for internal audit functions to have their own data stores or access to external data warehouses. In fact, more than 40 percent of the webinar audience indicated that they do have continuous access to one or multiple data warehouses or are able to access data on request when needed. Having to request access to data can slow down the audit analytics process but enhanced planning can ensure this is not a significant impediment.
Another barrier to data analytics adoption is that many internal auditors continue to think of their job in the terms of full population testing. Instead, they need to move away from that old-style indicator to embrace dynamic risk assessments, monitoring trends, fraud and risk and performance indicators, and deviations from acceptable performance levels. Fifteen percent of the webinar audience believed that narrow thinking was deterring their adoption of analytics.
A change in mindset towards using analytics to understand how data is used across the organization to drive business activity and decision-making is essential to ensure that the analytics function is not created in a silo. That was a concern for a small proportion of the webinar audience. Some organizations, often smaller firms, allocate responsibility for data analytics to one person or a small team within the internal audit function. It can be more effective, however, to establish an analytics mindset within a broader group of individuals in the function to help foster better understanding of how data is created in their business area, how it is processed, stored, transmitted and used to develop insight and drive decision making. This requires little technical acumen but elevates awareness about existing data and how it could be used for internal audit purposes.
Insufficient planning as a barrier to implementation resonated with 13 percent of respondents. The effective use of analytics requires pre-planning, sometimes taking several weeks, to gain a clear understanding of the kind of data internal audit would need to test the areas it needs to test. Often, firms rush to buy an analytics tool before they know how they plan to use it. Ideally, firms should spend 80 percent of their time determining the kind of data they need, the business process it supports, and the activities and decision-making that it drives, along with the business value the analysis of that data would deliver; only 20 percent of time should be spent on the technical aspects of the analysis, including the analytics tool.
Last but not least, firms that have adopted data analytics often feel let down by uninspired reporting. Protiviti has found that using visualization tools that present results in a dynamic manner with real-time reports and drill-down capabilities can help the internal audit function, as well as its stakeholders, the board and internal audit committees, to quickly draw insights from data, validating the value of the effort.
Our latest survey provides a wealth of information on this topic, in addition to the highlights discussed here. You can download it, free, from our website. IIA FSAC members can access the IIA webinar on demand here.
