Take-aways from EY s series of Internal Audit Analytics roundtables over 2016

Transcription

1 Take-aways from EY s series of Internal Audit Analytics roundtables over 2016

2 2

3 Amsterdam Roundtable on Data Analytics for Internal Audit Over 2016 EY hosted a series of roundtables with key executives in Internal Audit (IA). The aim was to discuss the use of data analytics as support for the internal audit function in accomplishing its purpose. The debate helped shape the development of the Internal Audit practices and contributed to the broader ongoing discussion over the future of control and technology in the audit landscape. The roundtable sessions, hosted in Amsterdam, were attended by thirty heads of Internal Audit from major companies operating in over 10 industries including Energy & Resources; Consumer Products; Chemicals; Technology, Media & Telecommunications. This article summarizes the main questions, concerns and successes raised during the roundtable sessions and reflects the importance, and urgency, of using data analytics to reduce the cost of control, increase risk coverage and drive value for the internal audit practice. Data Analytics - DA is the manipulation of a complete population of data to obtain insight and foresight to improve performance, reduce risk and maximize business value. 3

4 4

5 Take-aways from EY s series of Internal Audit Analytics roundtables over 2016 Who is using IA analytics, and how Two thirds of companies present in the room did leverage data analytics in their Internal Audit function, this is less than the global norm, according to EY s 2015 Global governance, risk and compliance survey¹ over 90% of audit departments globally use analytics in one or more phases of the audit lifecycle. Although most internal audit departments do use analytics, it is often used on a basic level. The participants recognized this and expressed a general intention of increasing the level and expanding the use or analytics in the future. Figure1: use of IA Analytics at each phase of the audit lifecycle 1 Why use IA Analytics? The participants had different reasons to use analytics: Reducing the cost of control Increasing the audit scope Reducing the time on site Releasing time to deep dive on the most critical items They report to have achieved these advantages through automation of audit procedures, identifying exceptions prior to testing, performing analytics during the scoping phase to sharpen the audit program and doing analytics to scope geographies that need it which cuts travel expenses and minimizes the disruption for the auditees. 10% 90% IA Analytics deployed IA Analytics not yet deployed Using analytics saves us time on site, and lets us test 100% of the population as opposed to sample testing. The use of analytics can focus audit efforts on high risk areas, it enables the testing of 100% of transactions for many controls and opens the door to continuous control monitoring 13% 10% 18% 23% [Using analytics] to test 100% of the population lets our audit teams focus their full energy on testing the exceptions to the rule as opposed the rules themselves. 36% Risk assessment Planning Execution and testing Reporting IA effectiveness/performance [n=1196 CAE s] 1 EY s global governance, risk and compliance (GRC) survey 2015 ( 5

6 Take-aways from EY s series of Internal Audit Analytics roundtables over 2016 What are the challenges of deploying IA analytics? Despite the recognition of analytics as a value driver for internal audit, using it effectively comes with serious challenges. One of the major challenges in deployment is obtaining meaningful data. One participant stated that business processes and underlying data are often not clearly defined, this restricts the auditors ability to define and produce meaningful analytics. IT systems in general are becoming better integrated but the variety and quantity of data generated increases at a fast rate. In a sea of data, it can be difficult to identify the data that really matters. For auditors in organizations with an inheritance of legacy systems it can be more challenging to access key data sources. In this case, it is a sea of systems that prevents the auditors from obtaining the key data to run analytics. Business processes, and underlying data are often not clearly defined. This makes using analytics a challenge The majority of participants uses analytics but not in all audits. In some organizations analytics are deployed in as little as in 10% of all audits. One of the most common constraints to using analytics are time limitations. Data analytics are most efficient when performed in advance of the audit, arming the auditors with insights to follow up during the audit. To fully benefit from analytics, auditors need to plan ahead of the fieldwork and estimate how long the data analysis will take. One participant stated The time required to get access to data has prevented [the audit team] from defining their analytics needs before starting fieldwork. In these cases a common response is to skip the analytics and rely on familiar manual testing procedures. The time required to get access to data has prevented us from defining our analytics needs before starting fieldwork. An additional challenge is data literacy, we address this challenge on page 8 below. 6

7 Internal Audit Analytics Deployment Experience has taught us that the best way to view the challenge of integrating analytics into the audit is through the following model comprising four components: Define Analytics Defining the objective of IA analytics in terms of the information and output that IA needs, which controls and processes need testing, and what to do with this information once IA receives it; Produce Analytics The key elements for produce are data, technology and analytics data refers to the associated data models based on the defined tests, technology is the appropriate tech environment to deploy the analytics in, analytics is the actual analytics that needs to be run to fulfil the objectives and be used as a basis for the insights; Consume Analytics Audit teams consume the analytics, drawing conclusions from the information gathered and turning the data into insights and recommendations for future. Govern Analytics Determining who does what, when and where analytics are integrated into the overall audit lifecycle. How are skills, training and continuous feedback built into the process. These components can be integrated into the Internal Audit delivery model as shown in the diagram below. Figure 2. The define-produce-consume model of internal audit analytics 2 Without attention to each of these phases, as well as the process of governing analytics, the analytics program risks being misaligned with the objectives of the internal audit department, or worse yet misaligned with the objectives of the wider organization. The key challenges and leading practices of each component is discussed below. 2 Harnessing the power of data, 2014 ( 7

8 Take-aways from EY s series of Internal Audit Analytics roundtables over 2016 Define Analytics Defining the information IA needs with regards to analytics output is one of the most commonly overlooked components of analytics deployment and one of the most challenging to get right. Of the top 50 risks encountered during large scale analytics deployment, the highest ranked risk is the lack of alignment between the implementation and the overarching business objectives 2. One of the biggest challenges to clearly defining analytics needs is data literacy, in other words how well does your audit team speak analytics? This is key for the audit teams to understand what analytics are available given their scope and for them to clearly articulate their needs to the analytics professionals producing the output. The auditors themselves must have a basic level of analytical proficiency. One of the audit functions was in the process of embedding the analytics back into the audit teams. Analytics like pivots and joins can be done onsite. Developing strong analytical skills within the audit teams improves the connection between the analytics produced off-site and analytics actually used during the audit. How fluent are your internal auditors in speaking analytics? Another key challenge in the define component is keeping open lines of communication between the users and producers of the analytics. One participant pointed out that having one person [DA expert] is not enough. [Defining analytics] requires analytical skills, professional audit skills and knowledge of the business and system, all working together. In many cases no one person in the team has all three of these skills sets. It requires open and ongoing communication to define the right analytics for the audit. 8

9 Another leading practice is providing feedback from those using the analytics to those producing the analytics. After finishing [an audit], the team sits together with the analytics professionals to see which analytics added value, and to deciding which analytics to repeat in future. After finishing [an audit], the team sits together with the analytics professionals to see which analytics added value, and to deciding which analytics to repeat in future. Defining analytics requires analytical skills, professional audit skills and knowledge of the business and system, all working together The most common challenge for companies that do not clearly define their analytics needs is output that is not used. One participant mentioned that continuous monitoring using data analytics delivers ±250 reports per month, of which almost none are used by the IA team. On the risk of not defining analytics: data analytics delivers ±250 reports per month, of which almost none are used [ ] Participants agreed that objectives and requirements of data analytics have to be fully defined up-front to produce tailored output that can be used effectively. Producing analytics without predefined objectives results in analytics for the sake of analytics. Participants that were further along in the analytics journey provided several examples of leading practices used to overcome the challenges of defining analytics needs, including the use of mixed teams, defining an analytics library, developing analytical skills, and analytics feedback loops. The highlights of the discussion are described below. [Having a library of analytics] helps the audit teams pick and choose which analytics will best suit their needs during the audit There was consensus that a mixed team of analytics competencies, with a clear division of roles and responsibilities helps to achieve your analytics goals. This typically involves a team with both traditional manual audit expertise and auditors with analytical skill sets. 9

10 Take-aways from EY s series of Internal Audit Analytics roundtables over 2016 Produce Analytics The produce component involves the activities most people think of when they think of analytics specifically, the technical steps involved in the production of the analytical results. The approach towards the production of analytics has the largest direct impact on the quality and efficiency of analytical output. From the top 50 risks of large scale analytics deployment almost three quarters of the risks identified by implementation teams relate to the production component. Figure 3. Percentage of risks identified per phase of analytics deployment 3 12% 14% Define Produce Consume 74% Respectively the produce component also comes with some of the most technical challenges and requires the greatest shift in the way-of-working from pre-analytics deployment. One such challenge shared by almost all participants is gaining access to the data required. As discussed above, access is often limited due to data privacy policies, limitations in access and administrator rights, or simply not knowing who owns and manages data within the organization. One participants expressed that complex organizational structures and lack of consistency across entities in scope results in limited and inconsistent access to data. Complex organizational structures and lack of consistency across entities in scope results in limited and inconsistent access to data Access to data is made more difficult when the IT system landscape is fragmented and the use of legacy systems prevalent. the biggest challenge is accessing data from the ERP systems, especially with a mixture of legacy and customized systems. The biggest challenge is accessing data from the ERP systems, especially with mixture of legacy and customized ERP systems 3 Big Data, Big Risk? The top 50 risks of big data deployment (Jack Mills), EY,

11 Another commonly faced challenge with producing analytics is the issue of data quality. Data quality, or integrity, impacts the reliability of analytics outputs, garbage in, garbage out. As one participants observed, Data that is not produced for analytics is often polluted, sometimes you spend more time on fixing the pollution that on the actual testing. One of the major consequences of data pollution is the time it takes to extract and transform data into a usable form. This often requires technical skills and in some cases specific tools that may not be readily available to audit teams. Data that is not produced for analytics is often polluted, sometimes you spend more time on fixing the pollution that on the actual testing Producing reliable, fit-for-purpose analytics requires finding the right mix of people, processes and tools. From a people perspective, the majority of participants considered Data Analytics to be a key skill for Internal Audit staff. This is in line with the results from a global survey of 1196 CAE s. When asked what skills are most important to enhance their internal audit function data analytics ranked second highest after critical thinking ¹. Three quarters of participants however also stated that their internal audit departments currently lack analytical skills. What skills or knowledge do you believe are most important to enhance your Internal Audit Function? Critical/analytical thinking Data analytics Audit Risk management Deep industry experience Process improvement Business strategy Compliance/regulatory Fraud prevention/detection Technology Accounting Internal communication Project management Change management # responses 11

12 Take-aways from EY s series of Internal Audit Analytics roundtables over 2016 As described earlier a library of analytics containing a master list of analytics and queries is also an effective way to support the production of analytics. Typically an analytics library is organized around processes or functions and can be used, firstly by the audit teams as a menu of analytics to pick and choose their requirements, and secondly by those producing the analytics as a recipe or instructions for generating the analytics. Deploying an analytics library is the first step to simplify, standardize, & automate the analytics process. Another consideration expressed was that audit functions should ensure that Data Analytics capabilities grow in line with the business, meaning that internal audit function should keep pace, and even set the tone for how the business operates. The analytics capabilities of internal audit should be in balance with the analytics used in the first and second line of defense. To have analytics that are fit-for-purpose the audit function should avoid producing analytics for the sake of analytics, but also must not fall behind the business. Audit functions should ensure that Data Analytics capabilities grow in line with the business Consume Analytics The consume component involves turning analytics output into insights, that can be followed up by the audit teams to generate observations, root causes and recommendations for improved operations. The consume component is the bottom line of the analytics journey. Internal audits approach towards the consumption, or use, of analytics output directly determines how much value has been generated by the analytics process. A commonly shared challenge with using analytics, is a lack of analytical skills amongst the audit teams. Without an understanding of how the analytics are produced, it is difficult for the audit teams to follow up on the observations generated by the analytics. As expressed by one participant [having] a data analytics specialist in the Internal Audit department is not enough, analytical skills should be integrated in the whole department for it to work. [having] a data analytics specialist in the Internal Audit department is not enough, analytical skills should be integrated in the whole department for it to work In some cases using analytics is a big change in way of working, this requires a change in mind-set for analytics to be used effectively. As we move away from traditional auditing, we use audit planning to look were data is used and where data analytics would be useful. We first do high level analytics to see where the focus needs to be during the audit and where not. This approach requires a huge mind-set change for the team. Using data analytics requires a huge mind-set change for the team The biggest pitfall that almost all participants recognized regards the identification of false positives. Without asking the right questions and having the right data, analytics can produce false positives. It was highlighted that it is often better to rely on a mix of analytical and manual audit procedures before drawing conclusions and audit findings. Overcoming these challenges if often left to trial an error. But this need not be the case. Participants highlighted the following key lessons learned from using analytics. 1. Get the analytics on time. When you get the analytics can be just as important as what you get. The aim should be to deliver the right analytics to the right team at the right time. 2. Make room for learning. Training efforts are typically focused on those producing the analytics, training for the teams expected the use the analytics is sometimes forgotten. 3. Keep open lines of communication between those producing the analytics and those using the analytics. Two way feedback is critical for the analytics to be truly adopted. 12

13 Govern Analytics The Govern component of the analytics model brings the other components of define, produce and consume together and ensure they are effectively integrated into the overall internal audit lifecycle. Governing analytics is about making sure that the team has the skills it needs, that the right technologies are in place, and that the right policies and roles have been defined. It involves the management of skills and assets to make sure that the insights are delivered to the Board and the C-suite as promised. Crunching the numbers Integrating analytics into the audit function is no longer a nice to have it is a must have for the internal audit to fulfill its mandate. Firstly analytics is a key enabler in providing assurance to management and the audit committee through its ability to identify transactional level risks across 100% of a population. Secondly, through its ability to detect irregularities and inconsistencies in operational data analytics enables audit teams focus on the exceptions to the rules and get more quickly to the root of an issue. Over the course of two round table sessions with CAE s from 10 industries the participants were brought together through the shared challenges faced along the analytics journey. We thank the participants for their openness and willingness to share these challenges as well as their approaches to overcoming them. The overarching conclusion of these sessions was that, yes, integrating analytics is challenging, but also key to meeting the objectives of today s internal audit function. 13

14 Take-aways from EY s series of Internal Audit Analytics roundtables over

15 We invite you to continue the conversation with us For more information contact: Amaya Anton Gago Jack Mills

16 EY Assurance Tax Transactions Advisory Over EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate Legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com Ernst & Young Accountants LLP. All Rights Reserved. ED None This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax or other professional advice. Please refer to your advisors for specific advice. ey.com/nl