Training insights: Set a date for data

While some internal audit teams have been using data analytics to trawl large data sets and identify anomalies for years, many more have realised that they should be using some form of it since Covid lockdowns enforced home working and increased remote audits. However, seeing the value of data analytics is not enough – how do you identify the best way to make it work in the context of your organisation and what could data analytics mean in practice for your work?

The problem is not lack of information. Type in “data analytics” and you are quickly swamped. The main issues for those who have not used data analytics in the past are working out where to start and how to get your organisation to a point where using data analytics will produce relevant and useful results. You need to establish where the data is and whether it is robust, and gain a realistic idea about how you can begin to use it for internal audits. This is why the Chartered IIA set up a specific Data Analytics for Auditors course, in collaboration with partners at Technology4Business.

Who is it for?

The course is aimed at people who are either new to data analytics or new to using data analytics for internal audit, although some self-taught data analysts have found it useful and reassuring to reinforce their experiences and consider an expert viewpoint.

Many people who attend are representing teams that are just starting to explore the potential of data analytics in an internal audit context and have not yet put any systems in place.

“We look at the specific issues of implementing data analytics in the internal audit process – for example, how do we incorporate the necessary documentation and what do you need to have in place to make data analytics work in internal audit,” explains Neil Macdonald, operations director at Technology4Business and leader on the course.

Although there are generic courses that teach attendees how to use a specific tool or become a data scientist, this one is targeted to help the “average” internal auditor who is looking to start using data analytics and has no particular technological experience. It is also technology “neutral”.

“We use Excel during the course, as most auditors are familiar with it. But the course is not an ‘Excel course’ – instead we focus on which Excel functions can be useful for data analysis and how to use these in your audits.  So we look at how to apply the basic tools and which functions are most useful. This functionality is also likely to be common to all the analytic tool solutions,” Macdonald explains.

The most important element is that the three “pillars of data analytics” all work together – the tool, the staff and the stakeholders, he adds. Another important issue is deciding when to begin data analytics in the audit cycle. Many people start to consider it too late.

“You can’t first talk about data a couple of weeks before you start an audit,” Macdonald stresses. “You need to begin a long time before this – preferably at the annual planning stage.”

Another common mistake is to neglect documentation, which is rarely mentioned in data analytics training courses. “It’s easy to get towards the end of an audit and then struggle to demonstrate how you undertook each of the tests,” he warns.

“Or, if you are asked for the full list of 35 exceptions that you have identified, you may not be able to identify these retrospectively or reproduce them if you didn’t adequately document the approach at the time.”

Similarly, you need to know how to document the data sets. It’s important to document the data in a way that captures it in a structured format so that you don’t have to ask IT (for example) the same questions the following year or in a related audit.

“Some people come to us with a specific audit in mind, while others just know that they should be using data analytics and want advice on where to begin,” Macdonald says. “We start by teaching the language of data analytics – how to have the right conversations before you begin and to know the terminology, so you can talk to IT professionals and data holders and understand the answers and any potential issues.”

The course goes on to look at some of the main technical aspects, such as data types and structures, and then focuses on how these fit into – and what they mean for – the internal audit context.

Attendees are led through a complete audit process so they can see how the principles work in practice. They are given activities to do between the six half-day sessions that take place weekly, including writing the tests to use within a data-enabled audit. They then compare notes and discuss what they’ve produced.

Macdonald stresses that the data used in the practical activities is taken from genuine systems and some of it is problematic. “This makes the exercise more complicated, but it is true to real-world experiences. This is the kind of data most internal auditors will have to deal with sometimes, and knowing how to work with it will make you much more resilient than if you know only how to undertake data analytics with complete, robust data,” he adds.

The final session focuses on top tips, things to avoid and a “rogues gallery” of common mistakes.

To get the most from the course, Macdonald recommends that attendees allow themselves time to complete the “homework” and to think about what they have learnt.

“Leave yourself enough time to put what you learn into practice, and start by using data on an audit you are already familiar with,” he suggests. “It’s better to begin with small steps and build up your knowledge and experience gradually.”

Long-term back-up

Once the course is over, attendees are invited back to share their experiences and discuss issues with the group at a series of surgeries. These are initially set up just for the group who attended the course together, but individuals can then attend monthly surgeries open to anyone who has attended the course in the past.

“People find it useful to share what they’re doing with a larger group and really interesting questions come up in the discussions,” Macdonald says.

Data analytics is still a developing area for many internal audit teams, but it is one that will become increasingly important.
Those teams that have not yet engaged with data need to understand what it could do for their audits and how to talk about the possibilities in their organisations.

If you’re stuck on where to start, the Data Analytics for Auditors course should set you on the right track and, just as importantly, provide an ongoing support network. 

This article was published in November 2022.