It’s no secret that the amount of data that organizations are producing is exploding exponentially.
This overload of data can make internal audit coverage ever more challenging given the sheer volumes of data the typical organization generates, especially larger organizations. This problem is often compared to the difficulty of trying to drink from a firehose.
The use of sampling increasingly does not represent the entire data population and is also time consuming in cases where the sample size must be increased to better represent the auditable data population. An effective way to audit the entire data is to use automated queries and data visualization dashboards. One tool that I have found to be effective is Qlik Sense which is largely capable of handling huge volumes of data.
Data visualization dashboards like Qlik Sense can be used to analyze and extract exceptions from the auditable information. Logical queries can be made that scan the entire population of the auditable data and extract results which the auditor may need in line with the test steps of the audit program. These results can be shown in a dashboard for meaningful visualization and identification.
Getting the Data Right
Before embarking on automating audit test steps, it is imperative to answer three questions: What type of data is to be used to develop an automated query? What is required to be extracted from the data population? And how is the extracted result to be shown to the internal auditor?
The results extracted from the entire population of data must corroborate what the internal auditor desires to know and communicate.
An important aspect to keep in mind and to evaluate before doing the automation is to make sure that the required data is available in the organization’s IT systems. The data should also be accurate and updated and be in sufficient history in the IT systems so that the testing can be performed over a prior period of time if required and for the current data the results extracted would be based on the latest information. The old adage stands: garbage in, garbage out.
In the ongoing process of using automated queries, these can be updated based on the results extracted and reviewed in order to make sure that more meaningful information is being made available to the internal auditor.
Automating the internal audit testing process helps in efficiently covering the entire population of data during periodic audits by saving time required on audit program testing procedures. The automated queries and dashboards used generate exceptions which the internal auditor can review in detail instead of spending time on reviewing large samples of information. This way the workload of the auditor is significantly reduced thereby enabling more time to focus on a much smaller results and drawing comfort that the information processed as designed in the automated query dashboard has accurately been analyzed.
Benefits of Automating Internal Audit Processes
Increased efficiency: Automated processes can help auditors identify exceptions and potential risks more quickly and efficiently. This can free up time for auditors to focus on higher-value activities.
Improved accuracy: Automated processes can help to ensure that audits are conducted consistently and accurately. This can help to reduce the risk of errors and omissions.
Enhanced visibility: Automated processes can help to improve visibility into the organization’s risks. This can help management to make better decisions about risk mitigation.
As an example, let’s consider the audit process of reviewing the ageing of outstanding entries in general ledger suspense accounts that have not been cleared within 30 days. Instead of taking the reconciliations of a past history, say a year or so, and then reviewing it for old outstanding entries, a dashboard can be developed which can run a query that shows any entry in a suspense account that has not been cleared and is outstanding for more than 30 days.
In this example, this automated dashboard can show any entry uncleared and exceeding the 30 days’ time limit. So, the internal auditor can proactively follow up on the exceptions highlighted in the visual dashboard and further analyze the reasons for the outstanding result, thereby saving much of the audit testing process. The auditor’s time will only be spent on looking at the entry in exception instead of reviewing the entire entries to determine the ageing of all.
Moving Toward Continuous Auditing
Continuous auditing is another aspect that is greatly assisted with the use of automated audit queries and data visualization dashboards. Internal auditors can be assigned tasks to monitor the dashboard results which can be generated on a real-time basis. Any exceptions can be reviewed much more frequently than waiting for periodic audits that may happen with gaps of a year or so. This provides the internal audit function of the organization to be proactive in monitoring the risks within the organization and to be able to report timely to the management for early rectification of issues.
Data dashboards can also be used for making presentations to the audit committee of the board and senior management. They are crisp and draw focus on the results that the chief audit executive (CAE) may be communicating. Looking at graphs and charts and other visual means is more appealing than reading text in audit presentations.
No doubt embarking on automating the internal audit processes requires time and a financial budget, however, the same can be seen with respect to the organization’s size and complexity of data. The selling point for CAEs to get the desired budget for this is to provide information to their audit committees in terms of value addition by saving time and resources, getting coverage over the total population of data instead of sample sizing, real time extraction of exceptions and proactively making the risks available to the management and Audit Committees for timely rectification of identified issues.
Preparing for Continuous Monitoring
The following factors need to be considered while evaluating the automation option for your entity.
Data quality: The quality of the data used in automated processes is critical. If the data is inaccurate or incomplete, the results of the automation will be unreliable.
Technical expertise: Automated processes require technical expertise to design and implement. This can be a barrier for organizations that do not have the necessary resources.
Change management: Automated processes can require changes to the way that audits are conducted. This can be a challenge for organizations that are resistant to change.
Overall, automating internal audit processes can be a valuable tool for organizations that want to improve the effectiveness of their audits. However, it is important to carefully consider the benefits and challenges of automation before making a decision.
It is an exciting experience to automate the internal auditing activity and I can say that for those who are thinking of starting the same, do it sooner than later!
Nasir Islam is a Fellow member of the Institute of Chartered Accountants of Pakistan. He is a senior professional with more than 30 years of banking experience having led internal audit, compliance, and finance functions at several organizations.