1
Benefits and
Misconceptions
There are many misconceptions about data, especially about using it for audits.
Because many internal audit teams are unfamiliar with data, they make general assumptions about its value and application. Before we can explain how to use data, we must first dispel these myths.
Myth 1: Using data only increases
the value of a handful of audits.
A surprisingly common misconception is that data has limited applicability to audits.
It's something you have heard-perhaps from colleagues, managers, or maybe even just the voice in your head. You already know that this is false, or you wouldn't be reading this book! But how do you convince others?
Here are the top three benefits that we'll discuss:
1. Data helps identify opportunities that management cannot see.
As auditors, we have a unique perspective, because we look across functions and domains. Most of our first- and second-line colleagues focus on their direct areas. But we are not limited by process, function, service or product. Our domain is the whole organization. Using data can help us find opportunities that go across several functions.
The classic example of this is procurement and payroll. Procurement teams focus on procurement activity. They generally don't focus on payroll or employee-related matters. The same holds for payroll and HR functions. They rarely concern themselves with procurement-related matters, except when they are engaging service providers to help them with systems, or for contractors and the like. If we are conducting a payroll audit, we can use data from both payroll and procurement.
Why?
If there are employees (in the payroll system) who are also being paid as service providers (in the procurement system), there is a potential conflict of interest. We know that unmanaged conflicts of interest can create all sorts of risks. As internal auditors, we should be concerned about this. If we know that management is not looking at this risk, it is our duty to consider it as part of our payroll audit.
2. Data makes it easier to read our audit output(s).
Audit reports can be lengthy. They can also be text heavy, and are often laden with information only relevant to a small number of people, sometimes only one person. Thankfully report writing, like many aspects of our audits, is getting better as we look for ways to make it easier to understand our reports. We work hard at it, removing jargon, writing in plainer language and using diagrams and infographics.
Many audit leaders have been working with their teams to incorporate auditviz (audit data visualization) into their reporting. This is where we use graphs and charts in our reports. With visualized data, the reader doesn't have to waste time trying to imagine the context of each finding or decipher complex descriptions of the results. With auditviz, findings and results are intuitive.
Here is a good example from a public sector efficiency (value-for-money) audit:2
This auditviz represents relative efficiency scores for services provided by 46 similar entities (the colored dots).
The auditviz is compelling and easy to understand for a few reasons:
The three service models are clearly labeled and displayed (use of color).
The efficiency score uses a simple, intuitive scale ("less efficient" and "most efficient").
The performance of each entity is clear (adequate spacing of results).
Here the individual council model (orange) is often less efficient than others.
(More of these councils are grouped towards the less efficient end of the scale).
Auditviz like these convey messages and outcomes quickly to help the audience see the results. Of course, text can help support or further explain what's in the charts or graphs. But graphs help bring any text explanation to life, making for a faster, easier read. Sometimes, we may not even need to explain each of the data points. In fact, as we produce more reports with these visual elements, the graph becomes the primary component. The words then support the graph, help focus attention or help remove ambiguity.
Auditviz makes the reader's consumption of the report more efficient. A simple and focused auditviz means the reader can skim the detailed supporting text. This saves time, which the reader can use to focus on dealing with the issues and acting on the opportunities.
In some cases, even writing the report becomes more efficient. By including auditviz, we can start with the picture and explain what we are focusing on, to guide the reader's attention. This is more difficult to do if we don't have a graph in front of us.
Yes, it takes time to do. Time to check accuracy. Time to format the visuals to suit the audience. Time to remove anything that isn't necessary (clutter). But as with any work that we do, it gets easier, and we get faster with experience. And review time improves. Audit reports generally go through various layers of review. If we make the review process easier with accessible information organized in an intuitive way, the effort will decrease. Your reviewers will thank you for the time you save them.
3. Data makes it easier to manage the exceptions.
Traditional audits include a multitude of broad, sweeping statements about control failures or process gaps. The reports rarely contain the specific details needed to take action. Instead, the auditees may be instructed to follow up with more information on how to fix the identified issues. It's a time-consuming process that rarely helps anyone. Often, the solutions are so vague, the problems get lost or deprioritized.
But if we use data, we can often identify the root causes of issues. This makes it much easier for management to take meaningful action. We can surface real gaps, going beyond the traditional controls testing approach that may only identify theoretical gaps.
Of course, it's still important to test controls. It's still important to go beyond the initial remedial action.3 But where we are also using data, we can identify the specific issue: where the control failure has created a real loss or potential loss. This is probably what needs to be fixed first.
For a $30 million revenue audit, we spotted a gap in discount authorization controls. We could have said that the control was not working, with "potential for loss."
Instead, we analyzed the relevant data to find out what the control weakness meant. How much were we losing? $26K, which was less than 0.1 percent of revenue, so possibly "lower" risk.
By delving into the data, we detailed exactly where this had gone wrong and what the failure scenarios were. Importantly, we found the root cause: a system error that was easy to fix. We tested other controls and calculations. They worked. No need to change the rating.
Quantifying the loss means we can confidently assign a rating to the issue.
Identifying the specific control breakdown scenarios makes it easier for management to identify clear remediation action-a better result for the organization more broadly.
Now you know how to convince your colleagues, managers and peers.
But what else is there that may derail your attempts?
Here are three other common myths:
Myth 2: Using data is difficult.
While data is complex, it isn't more difficult to grasp than any other specialty, especially once you dive in and practice. But many conversations can be intimidating or impenetrable if you've never tried to understand data. In some cases, you have tried it, following some CAATs4 method that promised to deliver the world, but it gave you more grief than answers.
No matter how you came to believe using data is difficult, there is someone who has felt the exact same way.
Forget about all of that. If you haven't tried using data, you will soon. It is easier than people make it out to be. If you have tried it, and it failed, do your best to forget the frustration you felt back then. If you carefully follow the steps that we are going to go through together, you will get to that elusive positive result.
What you do need to know is how to audit. You can't effectively learn how to use data in your audit work if you are not already comfortable with core audit concepts. It is also useful to know how to use basic spreadsheets, something simple like Microsoft Excel works perfectly. In fact, much of the software and many techniques presented in this book will be easy to use and powerful. (Yes, we promise those two things will be true at the same time. And, no, you won't lose bragging rights.)
You don't need a technical background in math, statistics or computer science.
Many of our highly capable data-focused audit colleagues have other academic backgrounds-history, physics, environmental management, psychology and accounting, to name a few.
Myth 3: You need a data specialist
or a data scientist.
If we have a data specialist on our team, it is likely that they will be engaged in some complex analysis. We could learn from them through discussion and watching what they do. But data specialists usually won't have the time available to teach us the basics. Sometimes they have the time, but not the patience.
If you don't have a data specialist on your team, don't rush out to find one. You can do a significant portion...
