Canadian Government Executive - Volume 22 - Issue 7

9 / 32

September 2016 // Canadian Government Executive / 9
Strategy
This is demanding work. However, the
speed and confidence at which data
cleansing and categorizing can be done
grows with experience and familiarity
with the data and tools in use. Most of the
effort has to be focused on creating the
data foundation upon which the analytics
will be applied. If data foundation is the
engine, data analytics is the steering.
Using data analytics concepts and tools
in the planning process will accelerate all
subsequent steps of the audit cycle. For
example:
• risk identification and key controls can
be tested for violations;
• scope can be tightly focused to assess
the violations and in particular the root
cause.
The Institute of Internal Auditors [IIA]
states that “Public sector auditors are in a
unique position when it comes to serving
their stakeholders. Not only do they need
to satisfy the needs of their leadership and
governance processes, they often have to
balance those requirements with their po-
litical and public stakeholders.” (Auditing
the Public Sector–Managing Expectations,
Delivering Results by The Institute of Inter-
nal Auditors Research Foundation).
In this environment, data analytics is a
necessary and powerful tool for assessing
risks and controlling violations. Expense
management is a high-risk optics category
for public sector operations. As such, con-
siderable effort has been invested in the
past through controllership, costly and
prolonged substantive auditing, and client
training to ensure appropriate compliance.
With a data analytics approach, expense
concentration, consistency across periods,
and deviations from the required limits or
the mean, are all relevant elements used
to identify patterns, trends and outliers to
expense limits. The governance function
at all levels remains highly visible, while
the analytics expertise supports a cost ef-
fective monitoring culture.
Client/Audit Interface
Internal auditors and their government
and public sector clients have a shared
interest in improving their cost-effective
control environments. The clients can use
these techniques to develop their data-
use capacity to assess risks in complex
program delivery, and to allocate compli-
ance/control resources, accordingly.
A logical progression for internal au-
dit’s role in the organization is to consult,
encourage and support client groups to
adopt these techniques. Data analytics ap-
plied directly by clients to policy and op-
erations can provide improved control de-
sign and governance monitoring. Audit’s
role under the COSO model also tests the
effectiveness of new controls developed
with data analytics to ensure they operate
effectively. Both consulting and assurance
roles require strong working knowledge
of the business dynamics, data elements
and linkages, and analytical tools neces-
sary for assessment.
Case Example: Client Data
Analytics Applied to Service
Provider Performance and
Compliance Monitoring
The Ontario Internal Audit Division
(OIAD) worked with its client, a division in
a Ministry, to establish risk profiles reflect-
ing key data elements, performance in-
dicators and outcomes relevant to a class
of service providers. The client assessed
their data holdings and other related best
practices to refine risk profiles and compli-
ance options. Additional monitoring tools
were considered and tested for efficacy
using actual data in controlled tests. The
outcome of this client-driven process pro-