No Audit Too Small

Most of us have heard the expression that a good internal auditor is a "watchdog, not a bloodhound." But have you ever stopped to think about what that really means? A bloodhound engages in relentless pursuit — after the security system has failed. A crime has been committed and the suspect has escaped! The watchdog, on the other hand, prevents catastrophic failure by learning all the small, simple, everyday things that make for normal operation, and then barking up a storm if anything changes.

Let's face it — no one ever wants the system to fail, but it's our job as watchdogs to be realistic. People make bad choices sometimes. In this article, we'll explore three areas where a little watchdog action now can avert having to bring out the bloodhounds later. By applying data analytics to payments, payrolls, and purchase orders, you can ramp up your risk assessment and internal controls and ensure the accuracy and safety of your financial and operational information.

Payments.

Using IDEA, try some simple analytics to bring out information that needs to be included in your next audit plan.

• Is the number of payments for this year similar to what you experienced for the same time period in previous years?
• Are there any payments on dates where the organization is normally closed, such as Sundays or holidays?
• Are there any unusually large payments that are not explained by known expenditures, such as a company vehicle or paying down debt?
• Are there a large number of very small payments, which may indicate the need for process improvements?

Payroll.

Data analytics can help you uncover fraud and internal control issues in payroll with far more precision than traditional sampling methods. Some examples:

• How much money is going out for various earnings types on contracts and do you have a good handle on what the types are? Are types such as overtime and mileage in line with expectations?
• Do paid vacation hours jibe with what employees have actually accrued?
• Are there any unusually large bonuses?
• Are there any large reimbursements or unexplained payouts to any employees or contractors?
• Are there any employees, especially in key positions, with unusually low payroll tax withholding?

Purchase orders.

Designing data analytics to test the soundness of your internal controls for purchase orders may take time, but once you have the tests, you can replicate them again and again for results that are far more expansive than those uncovered with traditional sampling.

• Is every purchase order properly issued, authorized, and approved?
• How many payments are made that do not have purchase orders?
• Do purchase order totals match the corresponding invoice?
• How much time elapses between when a purchase order is issued, an invoice is received, and the payment is made? Are there any purchase orders that seem to move through the system too quickly?
• Are purchase orders being issued to cover non-purchase order transactions such as payroll transfers or health insurance payments?
• Are recurrent purchase orders being issued for services you no longer need?
• Is there a process for tracking whether items that are invoiced have actually been received and were satisfactory?

Data analytics can help you uncover fraud, but small audits may more frequently uncover internal processes that need to be tightened or changed. For example, you may find that a purchasing department is using a shared password among several employees, or a password for an employee who has retired. It may take a process of education to explain how such informality makes it impossible to determine which purchasing agent approved which payments.

Small audits may also uncover issues that need to be addressed with the organization's IT department. In the example of the retired employee, IT may be able to help deactivate passwords and end "ghost employee" access if the proper information channels are set up to notify them when someone leaves the organization.

Like any watchdog, data analytics need to be fed the right food. That is, your initial attempts to design and run tests may fail due to bad data. Believe it or not, this is a good thing! By plugging in numbers and getting inconsistent results due to bad dates or inconsistent entries, you are uncovering data problems that your organization needs to address.

As the watchdog, you cannot change human nature, but you can invest the time to design and develop data analytics that can be automated and used again and again to ensure that you always perform the same test in the same way, building up a store of good comparison data. This way, when the system does fail, your barking can begin at the first sign that something is wrong, ensuring that the organization can recover quickly and everything is put right again. Good dog!