Most of us have heard the expression that a good internal auditor is a "watchdog, not a bloodhound." But have you ever stopped to think about what that really means? A bloodhound engages in relentless pursuit — after the security system has failed. A crime has been committed and the suspect has escaped! The watchdog, on the other hand, prevents catastrophic failure by learning all the small, simple, everyday things that make for a normal operation, and then barking up a storm if anything changes.
Let's face it — no one ever wants the system to fail, but it's our job as watchdogs to be realistic. People make bad choices sometimes. In this article, we'll explore three areas where a little watchdog action now can avert having to bring out the bloodhounds later. By applying data analytics to payments, payrolls, and purchase orders, you can ramp up your risk assessment and internal controls and ensure the accuracy and safety of your financial and operational information.
Payments. Using IDEA, try some simple analytics to bring out information that needs to be included in your next audit plan.
Payroll. Data analytics can help you uncover fraud and internal control issues in payroll with far more precision than traditional sampling methods. Some examples:
Purchase orders. Designing data analytics to test the soundness of your internal controls for purchase orders may take time, but once you have the tests, you can replicate them again and again for results that are far more expansive than those uncovered with traditional sampling.
Data analytics can help you uncover fraud, but small audits may more frequently uncover internal processes that need to be tightened or changed. For example, you may find that a purchasing department is using a shared password among several employees, or a password for an employee who has retired. It may take a process of education to explain how such informality makes it impossible to determine which purchasing agent approved which payments.
Small audits may also uncover issues that need to be addressed with the organization's IT department. In the example of the retired employee, IT may be able to help deactivate passwords and end "ghost employee" access if the proper information channels are set up to notify them when someone leaves the organization.
Like any watchdog, data analytics need to be fed the right food. That is, your initial attempts to design and run tests may fail due to bad data. Believe it or not, this is a good thing! By plugging in numbers and getting inconsistent results due to bad dates or inconsistent entries, you are uncovering data problems that your organization needs to address.
As the watchdog, you cannot change human nature, but you can invest the time to design and develop data analytics that can be automated and used again and again to ensure that you always perform the same test in the same way, building up a store of good comparison data. This way, when the system does fail, your barking can begin at the first sign that something is wrong, ensuring that the organization can recover quickly and everything is put right again. Good dog!