There exists a lot of hype around the phrases “Data Analytics” and “Continuous Monitoring” in the audit world today. Most audit conferences and workshops include sections on both topics, often combined under the same theme. The reality of developing a data analytics program geared towards the future for an organization and for audit depends on achieving success in three categories:

1. Management Support
2. Understanding the Systems in use by the Organization
3. Employee Talent and Tools Available

Management Support

It will not be possible to develop a data analytics program that adds real value to an organization without the support of management. This includes management within the audit department as well as upper management and key stakeholders. All parties must have an understanding of the amount of time and resources that such an endeavor requires, and understand these constraints grow exponentially as the complexity of the systems within the organization grow. Management, in the initial stages, will be a key player in helping the organization realize the benefits and growing necessity of a data analytics program. This is a crucial point in time, and it is important for persons in charge of managing data to understand that data analytics is separate from the other audit activities taking place. While the requests personnel receive may be similar to audit requests, such as document requests and explanations of the functionality of systems, reports, and databases, they are of a different nature entirely. It is important for the people providing the data in the organization to understand they are not being audited in the classical sense.

IMPORTANT:

A key point that management can drive home is while the organization may be working towards providing “continuous monitoring” with data analytics, this should not mean employees will constantly be presented with thousands of issues that need their attention. Nor should it mean the sole purpose of the data analytics program is to continuously find transactions that are in error. Management should paint continuous monitoring as the poster child for identifying risk. Data analytics should be used in determining the root cause of errors and non-compliance, being careful not to become a detective control and therefore part of the control framework. The audit objective should be something along the lines of “to assess whether the controls over the business process are adequate and effective.” If the data analytics result in identifying and correcting issues in the control environment or business process, then continuous monitoring (re-testing) can be performed as long as the risk warrants it.

As always, management should help the organization perceive audit as risk-focused and a valuable source of information to senior management.

Understanding the Systems in use by the Organization

Whether the organization hosts all of its data in the cloud or has hundreds of locations each housing its data on decentralized systems, understanding the data architecture of the organization is vital to the success of developing a data analytics program. In the case of decentralized systems, the process of extracting and compiling the data into a single source can be complicated and time-consuming, requiring the attention and focus of many key personnel. Custom reports may need to be written to extract the appropriate data from legacy mainframe systems and then compiled into an analytics tool. The data may need to be formatted, cleansed, and harmonized before it can be imported for use in the analytics program. All of these steps will need to be tested and implemented in the most efficient way possible and they MUST be repeatable.

Employee Talent and Tools Available

Obviously, the most important piece of establishing a data analytics program within an organization are the employees. Having basic knowledge of IT systems and Microsoft Excel power queries is no longer sufficient. With the amount of data each organization is producing growing at an exponential rate, auditors need to understand how that data is generated, stored, and ultimately representative of the business. Auditors, now more than ever, need to have a deeper understanding of big data concepts such as relational datasets, structured versus unstructured data, and algorithms.

With data comes power. The power to provide organizations with insights previously unknown to be possible. To provide value to an organization, it is important that the correct tools and on-going training be made available. Successful data analytics programs that are sustainable are the result of employees focused on continuous learning and implementing better tools as the organization’s data evolves.

Charles Copeland Felts III

Senior IT Audit Analyst | Data Science | Cyber Security