Why All Internal Auditors Need to Be Data Experts

GUEST BLOG POST
A chief audit executive once said to me: “Almost every team follows a process. Just because they don’t write it down, doesn’t mean one doesn’t exist.” It was at that moment that I realized that the lack of capability maturity or process rigor doesn’t necessarily mean that no process exists. From that point forward I began describing the lack of written processes as “no articulated process,” instead of “no defined process.” Semantics to most people, but meaningful nonetheless.

Fast forward more years than I care to admit, and I have found that the pace of business has rendered process discipline almost obsolete to many of the stakeholders I find myself working with in business environments.

Blackrock’s 2024 Investment outlook sums up how volatility and, more importantly, change will impact our traditional perspectives of the business cycle:

“There’s a temptation to interpret the new regime by taking a classic business cycle view of the current environment, we believe. This misses the point: the economy is normalizing from the pandemic and being shaped by structural drivers—shrinking workforces, geopolitical fragmentation and the low-carbon transition. The resulting disconnect between the cyclical narrative and structural reality is further stoking volatility, in our view.”

In my own world I have often been tasked with the role of building out internal audit teams, creating processes, implementing systems, and providing structural frameworks for internal audit teams to be more effective. In that same respect, I work closely with business stakeholders to assess processes, gaps, and identify areas of improvement. Each year that goes by it seems like business operations are changing at a faster rate. Team, department, and division reorganizations are more common than ever before, and it is not unusual for me to be talking to a team of entirely new people at any given function within the span of 12 months.

That makes process discipline and rigor hard to establish and harder to maintain. It also raises the question: what is the value of building processes and to what extent should teams spend a great deal of time defining, writing down, and maintaining processes that may be obsolete in the span of a few months?

Improving Data Systems and Software

Software as a service (SaaS) and data systems have a role to play here. I started my career in software development and systems integration. And while I am usually the first person to say, “define the process before building the system,” I must admit that my resolve has wavered in the past few years after seeing what I have seen. The ubiquity of SaaS and data tools means that in almost all aspects of the modern business environment, we have sources that can give us information. As these tools advance, we see new and interesting ways for us to understand what is happening in business environments.

What this means for the internal auditor, however, is that teams are collecting more and more data that can be useful in understanding risk, providing assurance, and helping the business to continuously improve. It means that the future of internal audit is in the hands of the savvy data analyst. We all have to embrace this reality and begin training ourselves to build a better understanding and application of data analytics.

How Data is Gathered, Stored, Shared, and Used

Where do we start? I recommend that internal auditors begin with understanding how database systems work, from metadata to the data fields used regularly in the different systems that are currently operating in your company’s environment. Take the time to learn how the data is gathered, where it sits, and how it is stored and shared in the organization. Understand how data is used by different teams and departments. Understand the layer that sits below the dashboards you probably see regularly from different teams.

Years ago, I worked in several B2B sales environments and a trick of salespeople was to keep potential sales out of their pipelines when they met their pipeline targets. This enabled them to declare a win close to period end or hide the loss if the sale never closed. However, this created volatility in the pipeline reports used by management to make critical business decisions and invest in growth opportunities. What was good for the individual, wasn’t necessarily good for the broader company.

As an internal auditor, data can help you tell this story in a meaningful and impactful way. The risk becomes quantifiable and the outcomes can impact everything from how management makes strategic decisions to how salespeople are compensated. Without an understanding of data, you could never hope to get to the bottom of something like that. And, more importantly, you find it challenging to make the case to management that something is wrong and that they should do something about it.

I propose that over the coming years, internal audit professionals who don’t have a strong command of data analytics will be ineffective in their roles. They will, in essence, be living in houses of straw, not brick. Do yourself a favor, keep building, brick by brick, and start becoming your team’s data expert. 

Michael Pellet is a leader in the internal audit space with a passion for process improvement. He is currently the Director of Internal Audit at Lyft.

Republished with permission from Internal Audit Next