Audit
September 28, 2016

A Strategy to Drive Internal Audit Analytics

The new world demands a data-driven business process design and monitoring. There is a clear opportunity for internal audit to formally invest in cross-cutting data management communities of practice.

Responding to the growing demands for departments to gain greater insights on their programs and operations using data, internal auditors are tasked to find ways to apply data analytics to drive effective and efficient client consulting and auditing. Audit that uses data to assess and identify risk, test controls and report issues, adds value and provides extensive risk coverage and insights to exceptionally complex issues.  When drawing a successful analytics roadmap, the ability to navigate through vast quantities of data is essential.

Analytics Maturity and Strategy

The most important first step is to formalize a strategy.

Understanding the current state (see Figure 1), documenting the strategy and translating the strategy into an actionable roadmap are critical to any analytics initiative. Applying a program-level approach to identify, plan and manage analytics can promote a client/internal audit partnership and help enhance relevant reporting and monitoring practices. The goal is to bring analysis closer to decision-makers.

key-risks

Raising profile and momentum of the analytics strategy can include conducting one or two analytics-enabled pilots to serve as a proof of concept. Focusing on “low hanging fruit”, such as accounts payable or time and expense reporting will facilitate momentum.

Improving the level of data quality can lead to a smoother start of the pilot project.  The following steps are an example of how data quality can be enhanced:

  • put external reports into usable formats for analysis and extract relevant information;
  • sort, attribute and aggregate data; and
  • identify inter-relationships and data outliers.

However, the speed and confidence at which data cleansing and categorizing can be done, grows with experience and familiarity with the data and tools in use. Most of the effort has to be focused on creating the data foundation upon which the analytics will be applied. If data foundation is the engine, data analytics is the steering.

Using data analytics concepts and tools in the planning process will accelerate all subsequent steps of the audit cycle. For example:

  • risk identification and key controls can be tested for violations;
  • scope can be tightly focused to assess the violations and in particular the root cause.

The Institute of Internal Auditors [IIA] says,

Public sector auditors are in a unique position when it comes to serving their stakeholders. Not only do they need to satisfy the needs of their leadership and governance processes, they often have to balance those requirements with their political and public stakeholders.” (Auditing the Public Sector–Managing Expectations, Delivering Results by The Institute of Internal Auditors Research Foundation)

In this environment, data analytics is a necessary and powerful tool for assessing risks and controlling violations. Expense management is a high risk optics category for public sector operations. As such, considerable effort has been invested in the past through controllership, costly and prolonged substantive auditing, and client training to ensure appropriate compliance.

With a data analytics approach, expense concentration, consistency across periods, and deviations from the required limits or the mean, are all relevant elements used to identify patterns, trends and outliers to expense limits. The governance function at all levels remains highly visible, while the analytics expertise supports a cost effective monitoring culture.

Client/Audit Interface

Internal auditors and their government and public sector clients have a shared interest in improving their cost-effective control environments. The clients can use these techniques to develop their data use capacity to assess risks in complex program delivery, and to allocate compliance/control resources, accordingly.

A logical progression for internal audit’s role in the organization is to consult, encourage and support client groups to adopt these techniques. Data analytics applied directly by clients to policy and operations can provide improved control design and governance monitoring. Audit’s role under the COSO model also tests the effectiveness of new controls developed with data analytics to ensure they operate effectively. Both consulting and assurance roles require strong working knowledge of the business dynamics, data elements and linkages, and analytical tools necessary for assessment.

Case Example: Client Data Analytics Applied to Service Provider Performance and Compliance Monitoring

The Ontario Internal Audit Division (OIAD) worked with its client, a division in the Ministry, to establish risk profiles reflecting key data elements, performance indicators and outcomes relevant to a class of service providers. The client assessed their data holdings and other related best practices to refine risk profiles and compliance options. Additional monitoring tools were considered and tested for efficacy using actual data in controlled tests. The outcome of this client-driven process provided faster insight into performance and focused specialized resources on higher risk providers and mitigations. It also allowed for targeted, high impact and cost effective monitoring and interventions.  Audit, with its advanced knowledge of data analytics, can provide further assurance of control and decision making integrity within the governance model.

The above processes resulted in mitigated risk, conserved resources and limited intrusion to those service providers who do not merit regular in-depth compliance assessment.

Evidence-Based Decision Making

For both the public and private sectors, analytics plays a critical role in evidence-based decision making. Today, it is vital that management focuses on reducing mountains of collected data into digestible insights that will drive clear and effective business practice. Legislative Officers, including Auditors General, Financial Accountability and Budget Officers, are already applying data analytics with direct access to huge data bases to perform their mandates toward value-for-money assessments and effective oversight.

In the 2015 Budget, the Ontario government announced their new Centre of Excellence for Evidence-Based Decision Making to build capacity to assess how programs are performing, using evidence to inform choices and lead change in critical public services with increasing transparency and accountability.

Communities of Practice

The Ontario Public Service (OPS) has also established a Communities of Practice (COP) process. The goal of the COP is to “advance the knowledge of those within government who pursue analytics and are looking to discover new methods, trends, techniques and understanding of the field.” The ability to convert data to practical knowledge will strengthen user group skills and confidence, and result in clear and insightful program management.

There is a clear opportunity for internal audit to formally invest in cross-cutting data management COP. The need to apply relevant consulting expertise and ensure cost effective assurance opinions are supported by the application of control assessments that mirror innovative business process. Data intimacy allows for horizontal links, across seemingly disparate programs, which in fact are quite similar in structure, to which tested techniques can be applied and leveraged.

Data Drivers: Key Success Factors for Auditors and Clients

The strategic approach and the examples outlined above reflect the following guiding principles when embarking on your own internal audit journey:

  • Treat the endeavour as an investment, and establish collaborative linkages
  • Define the initial objective. Establish a Plan. Define the ROI.
  • Start with a critical mass of dedicated, adequately experienced enthusiasts
  • Establish an intimate knowledge of key business processes
  • Define success factors to test a hypothesis
  • Gather data from multiple sources and DO NOT BE DETERRED
  • Organize data, noting interrelationships, and quality/integrity controls
  • Document the process
  • Respect the present culture and barriers to change

Data visualization can be an additional critical guiding principal as it facilitates understanding of data sets and provides ability to drill down and get to the transaction in question. “Visualization tools provide visual representation of the data, facilitating organization of complex information, driving insights from the data and optimizing user needs. Within the agile world of identifying risks, the art of visualization is a strategic asset for internal audit teams.”

Conclusion

Recognizing that the internal audit profession is evolving, effective leaders are innovating processes by investing in data analytics and technological tools. Sophisticated decision making is not simply about analyzing more variables, crunching larger data sets or running complex models. It requires a fundamental change in mindset that begins with senior managers and continues throughout the entire organization. Data analytics must be seen as an investment with consistent, continuous improvement that requires sustained commitment under focused leadership. The benefits of advanced data management support improved risk assessment, focused control design, monitoring, and timely corrective measures. Change is happening all around us and it will take constant capacity building, supported by leading-edge resources to transform the way internal audit functions and supports its clients.

 

warrenWarren McCay is Director of Internal Audit, Ontario Public Service, Treasury Board Secretariat. He is grateful for the support of the Government Internal Auditors Council of Canada

 

 

 

 

courtneyCourtney Brown is a Director within the Data Assurance and Analytics group at PriceWaterhouseCoopers. 

0 comments

There are no comments for this post yet.

Be the first to comment. Click here.

Audit
 
The Annual Financial Report of the Government of Canada Fiscal Year...
 
The role of internal audit in the public sector has changed...
 
We are excited to share with you the October/November 2018 edition...
 
Over the last several months, as a participant in the OCG’s...
 
Management in the Government of Canada is continuously searching for new...
 
We are happy to share with you the September 2017 issue...
 
In 2016, Deloitte undertook a global internal audit research study on...
 
We are thrilled to offer the July/August issue of Canadian Government...
 
We are happy to share with you the May/June issue of...
 
In today’s world of heightened focus on good governance and accountability...
 
At a recent meeting, a colleague asked me how I became...
 
In this special episode of CGE Radio, your host John Jones...
 
In the latest issue of CGE, the cover story is based...
 
Risk is always present in any undertaking, no matter the size...
 
The latest issue of Canadian Government Executive is currently available. Some...
 
The non-profit sector is operating within an era of increased accountability,...
 
The latest issue of Canadian Government Executive is now available. In...
 
While internal auditing has been considerably strengthened in most jurisdictions in...
 
The October issue of Canadian Government Executive on Focusing on Customer...
 
Responding to the growing demands for departments to gain greater insights...
 
In a little more than a year, Canadian banks and lending...
 
As an executive you’ve probably experienced frustration when you ask for...
 
Veterans Affairs Canada is not adequately managing the drug component of...
 
Whether responding to emergencies back home or assisting regular troops abroad,...
 
Canadians expect their public services to be delivered in a way...
 
Q: Where is Comptrollership going? Comptrollership in the Government of Canada...
 
Performance auditing can lead to more efficient, effective, and economical program...
 
The latest Auditor General’s report on Shared Services Canada (SSC) and...
 
Written By Chris Brown To deliver results that senior executives value,...
 
The government of Canada has implemented several measures over the past...
 
Whether at the territorial, provincial or federal government level, internal audit...
 
An organization’s reputation can take years to build but it can...
 
Today’s business environment changes rapidly to adjust to evolving conditions and...
 
Most professionals don’t need more than a sentence at a cocktail...
 
Recent research by the Institute of Internal Auditors Canada aims to...
 
After the Auditor General’s (AG) report was released on April 30,...
 
CGE Vol.13 No.1 January 2007 IT projects Ms. Fraser, your recent...
 
CGE Vol.13 No.9 November 2007 Independent audit committees are an integral...
 
In 2006 the world was feeling the aftershocks of a number...
 
Some title Some author
Some excerpt
 
Some title Some author
Some excerpt
 
Some title Some author
Some excerpt
The Annual Financial Report of the Government of Canada Fiscal Year...