Why do some internal auditors shy away from using data analytics? Some say the complexity and jargon surrounding it are too overwhelming. Team leaders don’t know how to distinguish between hype and practical application. Team members are hungry to learn how to apply data analytics but aren’t sure where to start. Nearly everyone is paralyzed, with no clear path forward.
There are many misconceptions about data, especially about using it for audits, and these misconceptions are preventing internal auditors from embracing data analytics and reaching their full potential. Because many internal audit teams are unfamiliar with data analytics, they make general assumptions about its value and application. But once they begin working with data themselves, they realize that these assumptions were completely false.
If you think working with data as an internal auditor sounds too difficult, impossible to do yourself, or simply not worth the time, you may be pleasantly surprised to find out these conceptions are far from the truth. Anyone can analyze data, and it can yield significant results for your audits. Let’s dispel some of these myths, starting with one of the most widespread.
1 Using Data Only Increases the Value of a Handful of Audits
A surprisingly common misconception is that data has limited applicability to audits. This is simply not true. In fact, here are three of the biggest ways data can benefit audits:
Data Helps Identify Opportunities that Management Cannot See
As internal auditors, we have a unique perspective, because we look across functions and domains. Using data can help us find opportunities that go across several functions.
The classic example of this is procurement and payroll. Through an audit, we might discover that employees (in the payroll system) are also being paid as service providers (in the procurement system), creating a potential conflict of interest. We know that unmanaged conflicts of interest can create all sorts of risks. If we know that management is not looking at this risk, it is our duty to consider it as part of our payroll audit.
Data Makes it Easier to Read our Audit Outputs
Audit reports can be lengthy. They can also be text heavy and are often laden with information only relevant to a small number of people, sometimes only one person.
Many internal audit leaders have been working with their teams to incorporate auditviz (audit data visualization) into their reporting. This is where we use graphs and charts in our reports. With visualized data, the reader doesn’t have to waste time trying to imagine the context of each finding or decipher complex descriptions of the results.
Data Makes it Easier to Manage the Exceptions
When we analyze data, we can often identify the root causes of issues that are hindering progress. Here’s an example: For a $30 million revenue audit, we spotted a gap in discount authorization controls. We could have said that the control was not working, with “potential for loss.”
Instead, we analyzed the relevant data to find out what the control weakness meant. How much were we losing? $26,000, which was less than 0.1 percent of revenue, so possibly “lower” risk.
By delving into the data, we detailed exactly where this had gone wrong and what the failure scenarios were. Importantly, we found the root cause: a system error that was easy to fix.
2 Using Data Analytics is Difficult
While data is complex, it isn’t more difficult to grasp than any other specialty, especially once you dive in and practice. If you haven’t tried using data, you will soon. It is easier than people make it out to be. What you do need to know is how to audit.
You can’t effectively learn how to use data in your audit work if you are not already comfortable with core audit concepts. It is also useful to know how to use basic spreadsheets, something simple like Microsoft Excel works perfectly.
You don’t need a technical background in math, statistics, or computer science. Many of our highly capable data-focused audit colleagues have other academic backgrounds—history, physics, environmental management, psychology, and accounting, to name a few.
3 You Need a Data Specialist or a Data Scientist
If you don’t have a data specialist on your team, don’t rush out to find one. You can do a significant portion of the analysis yourself. Most of what you want to accomplish can be done without new team members. Try doing it yourself first. And when you get to the point that you don’t want to learn any more technical wizardry, then you should consider bringing someone in.
When you understand the basics of data analysis, outsourcing this role might make sense. But only if it is genuinely going to improve your audits. Often you can learn how to do them yourself with a bit of guidance.
If you want to, over time, you can learn how to apply those approaches yourself. But nowadays, even some free software is evolving to the point that you don’t need a Ph.D. in statistics or a data scientist to make use of those more advanced techniques.
The most important thing at this stage is to know what techniques are available so you can decide if they are useful.
4 “Big Data” is Something You Need to Worry About
With all the hype around the term “big data,” the perceived value of smaller data sets has diminished. But, as auditors, we often only have smaller data sets to work with.
Is big data more valuable than small data? What do we even mean when we ask this question?
The thing is, there’s no real definition for either. In fact, the term “big data” is now quite dated. It’s been around for nearly a decade but has never been defined. Small data, then, could be the opposite of what we think big data is.
It is easy to see why larger data sets can be used to generate value. If we have more data to work with, we’re comfortable with the quality of the data, and we have defined our approach well, it can easily generate audit value.
Equally, if we have a smaller high-quality data set to work with, and a solid approach, we can use it to generate significant value. Smaller data sets can be extremely useful in audits, particularly when it is already at high levels of quality and integrity.
Ignore the Myths by Embracing Data
The worst part about these myths is that they can prevent auditors from fully embracing everything that data has to offer them. Data analytics might seem difficult to parse, too technical, too unwieldy, or something reserved for the specialists, but it’s not.
The good news is that these worries are misplaced. Anyone can use data to enhance their audits. Embracing data will only strengthen your knowledge, skills, and experience.
Don’t let the falsehoods surrounding data stop you from rolling up your sleeves and getting started. Technology has made the process more accessible than ever before, and embracing data analysis can help you find more opportunities for growth. 
This article was adapted from the book, The Data-Confident Internal Auditor, available on Amazon.
Yusuf Moolla, CIA, has over twenty years of experience in data and assurance. He has worked for both Deloitte and KPMG, leading audits and data projects globally, and is co-founder of Risk Insights, a specialist advisory firm that focuses on using data for internal and performance audit.
Conor McGarrity’s background includes KPMG and the public sector. Passionate about leveraging data for better audit outcomes and redefining the limits of what’s possible, he is also co-founder of Risk Insights.