Data Analytics in Internal Audit - assets.kpmg · The technology landscape for data analytics in internal audit has expanded rapidly as new categories of tools, such as self-service

Data Analytics in Internal AuditHow leading Internal Audit departments combine data, tools, people, and process to drive value from data analytics

kpmg.com/jp/kc

January 2019

1

IntroductionModern internal audit departments are faced with an impossible task.Not only are they tasked with identifying, assessing, and monitoringthe risks related to increasingly complex organizations and regulatoryenvironments, they must do so with smaller budgets and fewerpeople. Internal audit departments are forced to adapt to rapid changein organization structure, business processes, and frequently do sowith a global footprint –seeking to find a balance between a strictcompliance function and a business advisor. It is no wonder that,faced with these complexities, many internal audit departmentsreceive feedback from stakeholders that the audit process andfindings did not add substantial value.

Data analytics is not a new answer to this need for increased qualityand efficiency in internal audit. Speaking to any veteran auditor willyield stories of performing analytics on mainframe computers to catchcheck fraud in the 1980s, or using Computer Assisted AuditingTechniques (CAAT) to perform stratified sampling of journal entries inthe 1990s. Although the basic concepts of data analytics in internalaudit have remained the same, however, the practices of leadinginternal audit departments have been forced to evolve rapidly to keeppace with their organization’s evolution.

Specifically, leading internal audit departments have adopted frameworksthat address the four elements of successful data analytics:

1.Data

3.People

4.Process

2.Tools

© 2019 KPMG Consulting Co., Ltd., a company established under the Japan Company Law and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

2

These four elements are combined to offer increased quality andefficiency, including:

Integrating analytics of financial and operational systems duringrisk assessments, annual audit planning, and audit scoping toidentify high risk business processes and locations;

Implementing pre-incident forensic analysis routines that can beused to assess “what could go wrong,” detect fraud during auditfieldwork and, in leading organizations, as the basis of a continuousauditing/ continuous monitoring (CA/CM) program;

Leveraging multiple years of data, statistical analysis of timeseries data, and modern visualization tools to disaggregate largevolumes of data and identify anomalies in transaction-basedbusiness processes such as Procurement; and

Combining CAAT procedures, modern tools, and advanced analyticstechniques including natural language processing and cognitiveservices to gain substantially increased coverage of high risk areas .

These efforts can dramatically increase the audit quality and efficiency,allowing internal audit departments to cover significantly more riskswith fewer resources.

While analytics will never replace the judgment and experienceof a veteran internal auditor, it can be crucial in enabling them toperform detailed procedures over complete populations and in-depth,complex assessments.


3

The availability of complete and accurate data setsenables detailed analysis of in-scope business processes.Once identified and standardized, especially acrosslocations and subsidiaries, these analytics procedurescan be run on-demand and in real-time to proactivelyidentify issues or validate that issues have not recurred.

Leading practice internal audit departments frequentlystart with one business process such as Procurement andwork closely with their IT organizations to understand thedata that is available. Due to business needs for insightsinto these business processes, there are often existingdata warehouses, business intelligence tools, or otherexisting reporting mechanisms that can be leveraged toprovide data to internal audit on an ongoing basis.

However, if the data is not currently available, or if IT isnot comfortable providing direct access to productionsystems, an internal audit “data mart” can be created toenable analytics and CA/CM. Additionally, leadingpractice internal audit departments standardize and

enforce data quality routines that identify missing dataand inaccurate values to identify potential issues beforethey impact audit results.

Many challenges can be encountered with incomplete orinaccurate data. Organizations face issues with physicalforms and other data that is not machine-readable.Additionally, data from third parties, such as vendors orsupport services, may not be available on a frequentbasis. Technologies such as Optical CharacterRecognition (OCR) and natural language processing arepotential solutions to these issues, including enabling therapid and accurate scanning of paper documents such ascontracts or approval forms. However, they requirecareful planning and evaluation before adoption.

The technology landscape for data analytics in internalaudit has expanded rapidly as new categories of tools,such as self-service analytics and visualization tools, haveentered the market. While the features of these toolshave expanded and become more accessible for non-technical users, the cost has also dropped dramatically.Frequently, this combination allows experienced auditorsto create basic analytics with little effort or IT support.The availability of free, “open source” libraries foradvanced, predictive data analytics also enablesmoderately technical users to leverage techniques thatwould have previously been prohibitively expensive.

Leading practice internal audit departments combine thecapabilities of multiple tools to take an agile approach todata analytics.

Several elements are required for the successful integration of data analytics throughout the internalaudit methodology: data, tools, people, and process.

Example

A Japan-headquartered automotive part manufacturerwith global operations leverages multiple years oflabor costing data in their ERP system to enableanalytics during the risk assessment process (e.g.identifying subsidiaries that have the highest amountof overtime, an opportunity for process improvementand possible fraud indicator).

Data, Tools, People, and Process

Data1

Tools2


4

Once basic procedures have been created, leading internalaudit departments seek to turn these new assets intoincreased value through increased depth and scale. Forexample, if basic pre-incident forensic analytics proceduresindicate that fraud may be an issue, the department willdeploy more advanced tools such as training predictivemodeling based on external data (e.g. bank records) toincrease depth. Because these processes are repeatableand sustainable, they can frequently be transitioned intonear-real-time continuous auditing tools. Areas wherethere is significant overlap with management’s activities,such as auditing travel & entertainment expenses, can alsobe transitioned in to a continuous monitoring process.

Picking the right set of tools can be challenging given thevariety of tools available in the market. Each tool shouldbe assessed by many requirements, including:

Ease of use, training, and available support

Library of procedures for common business processes

Cost, including ongoing maintenance or annual costs; and

Alignment and integration with existing IT infrastructure(e.g. ERP)

Although self-service data analytics tools have reduced thedifficulty in performing analysis, many traditional internalauditors still struggle with using data analytics to take a risk-based approach to auditing. Data analytics requires asignificant amount of critical thinking and understanding ofdata; faced with a new business process, auditors must notonly be able to quickly understand a new business process,but they must identify risks that can be quantified andcreate analytics-enabled procedures to address those risks.

Leading practice internal audit departments take differentapproaches to building a data analytics team based ontheir organizational structure, goals, and long-termstrategy. While some departments choose to hire netnew employees and create a data analytics in internalaudit center of excellence, it is much more common tohave one or two data analytics specialists in an internalaudit department – frequently IT auditors that have beencross-trained on analytics tools and techniques.

Internal audit departments that are starting their dataanalytics journey may find it difficult to balance their short-term and long-term personnel requirements. Reliance onthird parties – including IT resources from anotherdepartment; a tool or consulting vendor; or temporaryworkers – is a common way to address initial, part-time, orincremental needs. This can enable greater flexibility whileshowcasing the initial value of data analytics and providesupport for making long-term decisions, including hiringgoals and tool selection.

Example

A US-based industrial manufacturer used a self-service visualization tool to import populations ofvendors, purchase orders, and invoices to helpauditors quickly understand underlying relationships,strata, and anomalies. Based on their understandingof the data, a modern data analytics tool was used tocreate audit procedures with drag-and-dropworkflows, enabling basic analytics such as three-way matching and duplicate payment detection thatwere combined into a comprehensive audit programthat significantly reduced risk.

People3


5

The integration of CAAT procedures in audit programs ofcommon business processes is a traditional first step inleveraging the power of data analytics to bring betterinsights and increase the efficiency of an audit. However,many organizations struggle with scaling data analyticsusing these analytics procedures without a comprehensive,end-to-end process for applying data analytics throughoutthe internal audit methodology. For example, the existingprocesses must be extended to answer questions such as:

What information should I provide to IT in order to getthe right data?

Where are scripts stored and documented so thatother team members can leverage them?

What process will be used to validate data quality?

How are data analytics integrated throughout theinternal audit methodology, including risk assessment;annual audit planning; audit project planning, scoping,fieldwork, and reporting; issue follow-up; and otherrelated activities?

Leading practice internal audit departments have modifiedtheir processes to embed data analytics considerationsinto every part of the internal audit methodology. Typically,special consideration is given to data analytics at thebeginning of any activity. Thinking of “data first” providesadequate time to identify data assets, request access, andgather an understanding prior to using them in the auditprocess. Many internal audit departments also meetregularly with IT to understand upcoming changes tosystems or configurations – as a continual consumer ofthis data, it is important that internal audit understandwhether any changes will impact their ongoing analyticsefforts, especially for CA/CM.

5

Data, Tools, People, and Process

Process4


6

ConclusionInternal audit departments are faced with a difficult task:providing increased value and efficiency in an operatingenvironment that is constantly being disrupted by newoperating models and organizational changes.

Leveraging data analytics can provide immediate value –offering unique, value-added insights throughout theaudit process while simultaneously enabling auditors tocover more locations, more transactions, and more risks.

Balancing the requirements of data, tools, people, andprocess can be a difficult task. However, there areseveral small steps that can showcase the immediatevalue of higher quality and efficiency through the use ofdata analytics in internal audit. These include:

Selecting and completing a data analytics-enabled auditpilot project with high value and low complexity. Manyorganizations select a portion of the Procurementprocess because the data is typically centralized and theanalytics, such as detection of duplicate payments,can result in a tangible, positive return.

Leveraging free visualization tools to create interactivedashboards that can be used during multiple phases of

the internal audit methodology, including audit planning,scoping, fieldwork, and reporting. For example, adashboard for a Procurement process can be used toselect the highest risk areas during scoping, enablesampling and drill-down analysis during fieldwork, andcommunicate value-added insights to stakeholdersduring reporting and issue follow-up.

Understanding existing analytics, visualization, orreporting available within the organization. Usingtools and reports already provided to management isa low cost, quick way to perform analytics without alarge investment in new tools.

6

Getting Started

Licensed by TOKYO TOWER© 2019 KPMG Consulting Co., Ltd., a company established under the Japan Company Law and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

The information contained herein is of a general nature and is not intended to address the circumstances of anyparticular individual or entity. Although we endeavor to provide accurate and timely information, there can be noguarantee that such information is accurate as of the date it is received or that it will continue to be accurate inthe future. No one should act on such information without appropriate professional advice after a thoroughexamination of the particular situation.

© 2019 KPMG Consulting Co., Ltd., a company established under the Japan Company Law and a member firm ofthe KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMGInternational”), a Swiss entity. All rights reserved. 19-1004

The KPMG name and logo are registered trademarks or trademarks of KPMG International.

Some or all of the services described herein may not be permissible for KPMG audit clients and their affiliates.

Hiroshi Asanuma

Partner, Risk Consulting

KPMG Consulting Co., Ltd.T: 03-3548-5111E: [email protected]

I-Ching Lim

Director, Risk Consulting


Micah Manquen

Manager, Risk Consulting


Blair Plett



Maria Tsuchida



Contact us

Documents

Data Analytics in Internal Audit - assets.kpmg · The technology landscape for data analytics in internal audit has expanded rapidly as new categories of tools, such as self-service