Where’s the info?

By Tony Ritlop
Illustration: Baiba Black

Data analysis may not be the silver bullet many hope it is, but it can accelerate the execution of audits

All of us can attest to the proliferation of information systems and automation at all levels of our business and personal lives. Information is captured by our home computers and smartphones as well as within the enterprise resource planning applications that organizations spend millions of dollars implementing and maintaining. Virtually every activity and transaction, financial or not, is captured and recorded somewhere. For those who look, this information can be a gold mine. The question is, can we obtain valuable information from all this data without having to be data-mining experts with time to spare?

There are significant potential business intelligence opportunities related to having data. Data analytics, typically done over an entire population, tend to provide more complete and exhaustive results than sample-based reviews. However, many professionals are still unsure how to extract the most value from all available data.
What does it mean and how can it help?

In determining how to get value from information, first consider what we know. The term “data analytics” is often used as a one-size-fits-all description of data analysis techniques and approaches. In addition, the term’s continuous controls monitoring and continuous audit are both over-used and provide little clarity in describing the capabilities they involve.

To improve understanding of data analytics, consider the following forms data analytics can take. More specifically, the three most-desired outcomes generated by a robust data analytics exercise are to address risks and assess internal controls; to improve performance; and to predict (see Desired outcomes on page 44).

There are opportunities for relatively straightforward and easy-to-execute analytics, which most auditors and even business owners, data-minded or not, can consider in addressing risks and assessing internal controls for audit or review purposes.

Some value-driven quick hits for risk/control analytics include:

journal entries analysis for irregular entries and the like;
analysis of inventories for costing (e.g., identifying products that have costs that fluctuated, over a set period of time, greater/less than x%) and pricing issues (e.g., identifying products that were sold for greater/less than cost by x%);
analysis of accounts receivable for confirmation selection (using basic statistical concepts) as well as identification of economic dependencies, etc.;
analysis of accounts payable, also for confirmation selection, in addition to aging; including possible simplistic working capital improvement analysis when combined with actual disbursement data;
analysis of expense report amounts versus promotion limits, to identify trends, etc.;
comparing a pay register at year-end with stated salaries in an employee master file;
comparing payments made during a predefined period with a list of known and approved vendors as well as with approved disbursement limits;
analysis of an employee master file for invalid social insurance numbers, which may reveal fictitious employees;
comparison of employee address information to vendor address information;
looking for duplicates or gaps in a pre-sequenced series of disbursement cheques; and
isolating repetitive transactions (e.g., disbursements, inventory movement, etc.) and following up on their nature.

How can data analytics help you?
With a better understanding of the types of possible data analytics, deeper thought should be given to whether it is truly beneficial to a practitioner’s existing situation. This process should focus on two primary considerations: whether existing tactics can be replaced by more efficient ones and whether this alternative approach will yield better results.

The easiest possible replacement item could be a manual analysis or audit procedure, which can be augmented through data analysis. However, simple replacement of manual audit steps with data analytics will not typically provide enough perceived benefit to sustain the investment in analytical tool analysis capabilities. It is at this point that the second perspective should be assessed. More specifically, if the data analytics are able to provide comfort on specific areas of risk that cannot effectively be monitored or audited by manual procedures, then, by extension, better results will be obtained.

In determining whether better results (e.g., greater scope coverage, more risks addressed, more controls assessed, etc.) are obtainable, practitioner skills begin to become more relevant because the executing practitioner will likely be the first person determining what is reasonable and what is anomalous.

Are you able to pull it off?
After thinking about how data analytics can help, the immediate next step is to determine whether existing competencies can be harnessed or developed and whether it makes sense to develop or buy the required skills.

Given that this is an exercise in leveraging technology, the technical skills component of any data analytics exercise cannot be ignored. Here, it helps to remember that any automated tool alone does not result in effective audits; a tool is often only as effective as the professional who wields it. A typical analyst given ACL, IDEA, ActiveData, SQL or any other tool may not generate compelling findings. Too often, data analytics projects invest in basic training for two or three auditors with a budding interest in using analytics.

However, without proper training, initiative and guidance, these auditors may perform unfocused analysis with limited benefits. Generally speaking, good auditors may not make good analysts and vice versa; it takes a combination of the right skills and approach.

Data analytics for audit testing purposes can deliver dramatic results. Conversely, they can yield little more than the manual procedures they replace. In reality, the latter result isn’t necessarily a bad thing — using analysis to validate the effectiveness of existing procedures increases confidence in the overall audit program. However, when we scope the investment and build expectations for greater results without specific objectives, the analysis is rarely considered successful by its end users.
Before embarking on any data analysis, it is helpful to appreciate that, historically, one of the biggest obstacles to executing analytical analysis was simply capturing the information in a readable and usable form. It would be fair to say approximately 50% to 60% of the total data analysis budget is related to data request, receipt, initial review and inquiry and preparation. Only then could the actual detailed analysis be commenced.

Working on the assumption that a workable set of data is obtainable, begin planning for a data analytics exercise. In doing so, perhaps the single most relevant consideration is that one needs to have at least some idea of what to look for (have some level of ideas) and how to find it (one does need some level of analytical tool usage skills).

Alternatively stated, there is a requirement for some rudimentary expectations and technical software skills. Furthermore, there is nothing wrong with having multiple people develop the expectations, whereby the actual data analysis executor (i.e. the person operating the tool) works in tandem with someone with no tool or data analytics experience, but who has a deep understanding of the particular business risks and controls. Frequently, a lack of cooperation among audit engagement team members leads to unsuccessful data analysis efforts.

For practitioners with limited re-sources, it may just mean more focused, expectation-based analysis. More specifically, it means establishing some well-thought-out expectations, which are developed through one’s own knowledge of operations and further corroborated via management discussion.

Tools available
Once the decision to advance with data analytics is made, as well as how and who will execute them, consider that available technology is fundamental to the exercise.
There are many available tools: ACL, IDEA, ActiveData, SQL, SAS and even the stalwart Microsoft Excel are popular. The decision about which tools to use is impacted by the following considerations:

the volume of data to be processed (some tools have limits);
the usability of the raw data (i.e. how much manipulation and massaging is required to import the data into the tool);
the skills available to execute the analysis;
existing technology platforms and available support; and
budgetary constraints.

The good news is that from a skills perspective, usually someone who already knows at least one of the tools is at an advantage over someone with no experience at all. While they are all different, most of the currently available and most popular tools have enough similarities to enable people with skills with one to adapt to the requirements of another. Furthermore, while the tools are different, data analytics is based primarily in a certain mind-set, rather than a tool.
Different perspectives exist on which tools are better, but each user needs to determine his or her primary decision conditions. Once the tool is acquired, it must be leveraged effectively to deliver maximum value. A tool is just the enabler, and it will not overcome, by itself, the challenge of conducting an analysis. The onus for successful analytical analysis rests primarily on the commitment of the practitioner. Here, it bears mentioning that each analysis will improve over time. Errors will be ironed out, skills will improve and, eventually, the focus will move from the more technical components of appropriately capturing the data and executing commands in the tools to improving the analysis, developing more robust expectations and looking into business improvement opportunities. For those used to a traditional, manual approach, an initial investment is required to give the data analysis approach a chance to be adopted and, over time, improved.

Conclusions
Sustained and effective use of data analytics may require a change in mind-set for the typical audit practitioner. To realize this transformation, there must be changes in approach for risk and control test procedures and controls programs, as well as a possible broadening of focus to include identification of performance improvements to better meet management’s strategic objectives.

The table on page 43 provides some of the guiding principles that need to be evaluated when determining if data analysis is something worth exploring in more detail. Furthermore, if the decision to proceed is then made, there needs to be a minimum level of conditions in place around the data itself to warrant additional investment.
The concluding considerations include:

Can we derive value from the exercise?
Do we have the skills and budget to efficiently execute data analytics?
Is data readily available?

Using data analysis may not be the silver bullet many people hope it can be. However, it can accelerate the execution of audits or reconfirm what one may have previously suspected but did not have readily accessible proof of. Here is where analytics can offer the most value for the least cost.

Tony Ritlop, CA•IT, CISA, CGEIT, is a partner in Ernst & Young’s advisory services practice in Montreal. He can be reached at tony.ritlop@ca.ey.com

Technical editor: Yves Godbout, CA•IT, CA•CISA, Director of IT Services, Office of the Auditor General of Canada. He can be reached at godbout@computrad.com