Tip #1 – Do not go for a grand plan but start small and test and learn as you go
In my experience, successful data analytics comes not from the development of a grand implementation blueprint, but rather from starting small and testing and learning to see what works well for your organization. This includes the building of support from the Board and executive leadership by showing, as you go, the insights gained from the analytics work done and the possibilities to go further with increased resource and technological investment. This is in contrast to going upfront with a theoretical case and associated request for a big budget. This approach lends itself to start with a pilot where you pick an area of audit work to be conducted and look to introduce some data analytics into this work. This should be an area where you know you can get relatively easy access to the data you need. Perhaps with an auditee who is an advocate of internal audit and willing to work with you to make the pilot a success. I have found that success breeds more success and considerable momentum can be delivered in this manner. It is also good, early on, to build your library of data analytics case studies so that you can showcase your success with executives across the business to get their support for an expansion of data analytics activity. I call this a test, share and impress approach.
Tip #2 – Do not get hung up on the technology, look to use what is already available
I have sadly wasted significant time in meetings on data analytics where we have discussed, at length, the potential technology available to conduct data analytics work when the time would have been better spent using the technology we already had in place and getting on with data analytics activity. An important step in your data analytics journey is to establish what relevant technology your organization already has in place (and is already paying for!). In one organization that I worked for we found over a couple of weeks, a whole range of technology was already in place and ready for us to use. This was done by engaging with the IT function to see what they knew about technologies in place. However, we also found through our business networks other tools readily available that we could use that the IT function was not aware of. While most of the tools you discover will not have been developed with the Internal Auditor in mind, they can be easily adapted to allow adoption in the function. So, get out there and find out what is available and get your team's access so that they can start playing with it to see where it can be put to use in your data analytics. And remember, Excel is often enough and of course TeamMate Analytics for Audit data analytics capabilities can allow you to make huge strides in your analytics fully integrated into your audit work within the TeamMate system.
Tip #3 – Data access is crucial – negotiate from the top
Having got underway you will need to look at data access to ensure that your progress is not hampered. Clearly, you cannot successfully deliver insightful data analytics if you do not have access to the relevant data. However, you need to be focused in how you go about doing this as you expand beyond initial pilots into a more systematic approach. As you increase the amount of analytics you are doing you will want to systematically ask yourself what are the really important questions that you wish to answer and how can data help you do this. Where is the data in your organization held and do you have a map of these data so all of your auditors know where to look? You may also face resistance in your organization as to whether you should be allowed access to sensitive data particularly in areas such as HR and customer data. Clearly, you will need to demonstrate how you have appropriate controls in place to manage the security of this data. It is important that you do this well as it will damage your reputation if you have a data breach of any kind. Clearly, TeamMate can help here as you already know this is secure so holding analytics data in your core audit system will give you comfort that you are in control. When you have done this, you can establish simple data access protocols that all parties support to ensure that future access is quick and simple. You may also need to get the executive of the business involved if the resistance does not recede – Your CAO may need to engage with the CEO, CRO, HRD to smooth over this resistance. This is where the share and impress part of your strategy is so important. If the executive has already seen the power of your work in another area it is likely that they will be supportive of your access to the data.
And do not forget to ensure your auditors have read-only access to key organization’s systems, such as risk and HR, to allow them to use these on an ongoing basis. This does not require feeds setting up or analytical tools, just the right to look in the database to see what is going on in the area under review. This direct, read-only access, is one area that I think is seriously under-utilized in analytics strategies.
Tip #4 - Collaborate with your business colleagues – independence is a mindset
I have spent time with a lot of auditors who have been reluctant to collaborate in any deep manner with the business, citing the audit charter and the need for full independence from first and second-line activity. I agree our independence as internal auditors is very important. We need to be objective in all that we do. However, I do not believe independence means that we cannot work closely with the business where it makes sense to do so. One such area is the identification and development of data analytics capabilities. Most organizations now have some strategic intent to develop the use of their data. This means that there is often significant investment into analytics capabilities in the first and second line, alongside the excellent work that is being done in many internal audit functions. Given this shared interest it makes sense for all those interested in analytics activity to come together to share ideas, technology, and data to the benefit of the business. For example, this may mean developing a shared data warehouse that all can access, jointly investing in one of the many analytics tools out in the market, working together on a project to establish the permanent capability to analyze a company data set or directly, for internal audit, sharing analytics we have developed for permanent adoption in the business to help them ensure their controls are working on a continual basis. Find out across your business who is interested in this space and join with them to share, learn and progress.
Tip #5 – Upskill all auditors at all levels (yes including you Chief Audit Executive)
The skills of your team to be able to identify when to use analytics and then how to execute are key. Analytics is not the privilege of a few anymore but a core competency for all auditors. This should be reflected in the recruitment and development approach for your team. I am a huge fan of expecting data analytics skills from all your new recruits and testing this through the recruitment process through some form of case study exercise. This allows you to examine both the mindset of the individual you are recruiting (i.e., can they see opportunities for using analytics) and the skills in using some simple analytic techniques. Do you know that your new hires are data-savvy? You will also need to revisit your Internal Audit competency framework (if you have one) to signpost the skills and knowledge that your auditors need to have to be successful in this area. The framework should be clear on the skills they will need including areas like data manipulation, statistical analysis, coding (for some at least), data visualization, and presentation. This is likely to mean that you will need to provide detailed training to the teams on the data analytics mindset and skills you need. Programs are increasingly common where all auditors in a function go through together, including the Chief Audit Executive and Audit Directors, to build a common understanding and momentum around data management and analytics.
When it comes to your people you also need to be honest with yourself about where you do not have the skills needed. Data analytics skills and knowledge are highly sort after and if you are a relatively small internal audit function you may not be able to build deep capability. You will need to draw on other sources of expertise including the business and external consultancy support. These can allow you to supplement both the capacity and capability of your team.
