While no two audits are the same, most auditors follow the same processes and strive to improve performance. Whether your organization has formal or informal benchmarks to assess efficiency, data analytics can be used during every phase of the audit to save time, fine-tune the planning process and deliver valuable insights.
CaseWare IDEA® allows you to spend less time on administrative tasks, and more time on the audit, including less travel. When the data is acquired electronically, the analytics portion of the audit is automatically documented in the working papers and the auditor can verify they have all the data. This saves significant time. Incorporating IDEA into audit planning and preparation yields more efficient and effective audits from start to finish.
Phase 1: Scheduling
Risk-Based Analysis of the Audit Universe
The new audit standards recommend: "It is important for internal auditors to acknowledge the need to consider the most important risks of the organization. Assessing strategic risks, or risks to the organization’s strategic objectives, has become accepted as an effective way to capture this point."
While not everything could be audited using data analytics, it can be highly effective in scheduling, prioritizing and organizing preliminary information gathering.
As a leader, you should formulate relevant engagement objectives. Information gleaned from data analytics can help identify anomalies that alert you to focus on particular areas of the business and assess risks with greater confidence. Some auditors will leave room within the schedule to accommodate requests from management. On occasion, issues are identified in the planning phase and need to be communicated via a management letter even before the audit is scheduled.
Within the data flows, think about where you might find risk within the data. Where may anomalies hide, or where might you find data that doesn’t make sense? If possible gather data from these areas and run an analysis, and check for unusual patterns within the data to test and investigate further.
Using analytics, auditors can conduct a high-level analysis to determine if issues from past audits are reoccurring. Cursory investigations will disclose if previous agreed upon controls have been put into place, are effective or ineffective, and gain an overall understanding of how the business is performing.
Field statistics, unexpected credit and/or debit balances, profit and loss, and other areas can be reviewed to determine where resources should be allocated. Simplified data-mining utilities such as Benford’s Law tests can be used to identify unusual patterns in the frequency of distribution of digits in a field. IDEA Version Nine includes new statistical analysis tools designed to test for fraud and data integrity issues.
Examples of the Audit Universe
Key Financial Accounts:
Key Operational Accounts:
The information acquired at this phase of the audit can help the leadership team determine (and justify) where to audit based on the highest potential risk areas. By using analytics early in the lifecycle, auditors can help narrow the locations where audits should be conducted, save weeks of time and significantly reduce travel. More importantly, by using analytics, leadership now has the ability to focus on key risks in the process by looking at the data.
Risk Assessment Phase:
Areas to Evaluate
Phase 2: Engagement Planning
Once priorities are set, data analytics can be used to drill deeper into areas discovered during the risk assessment phase. Data should be acquired from the database administrator and imported into an analytics tool like IDEA to look for regulatory compliance, inherent risk, changes to policies and
procedures, human resource data, and potential fraud. In this phase, it is important to look for frequency of events and what the numbers reveal. The background or details can be included in the work papers.
Data analytics can be a powerful tool for helping plan the audit. It breaks down the data from a massive population to a subset to help you look for potential risks, and determine whether policies and procedures are being followed. For example, the auditor can check authorization levels for segregation of duties violations, approval levels over set amounts, and identify expense caps (maximums and minimums).
Data importing can be more of an art than a science. One of the advantages of using a data analytics tool is the ability to bring data from disparate systems, and even print reports, into a single system for further examination. While data analytics provides 100% data coverage, you may not need that level of review, depending on the set objectives. The key is getting what you need out of the analysis, narrowing the population of data you plan to examine further as part of the audit, and gleaning useful insights from the data.
Time-Saving Tip #1
With IDEA, you can import data from just about any source including text files, data from ERP systems, spreadsheets and PDFs. The Report Reader feature within IDEA accurately reads characters and encoding to create properly aligned text, and automatically eliminates leading or trailing spaces for better matching (and less clean-up). Plus, you can preview the data prior to importing it into IDEA, and save templates for future use.
Time-Saving Tip #2
IDEA Users benefit from unlimited help desk support. If you struggle to import a file or database into IDEA for more than 20 minutes, simply call the IDEA Help Desk for step-by-step instructions or assistance. We take a "no auditor left behind" approach and will assist you with the file until the issue is resolved.
Phase 3: Testing
This phase is where most auditors plan to use data analytics, especially for "heavy lifting" required for larger data sets. For example, if you have a table with ten million records and apply a filter capturing a thousand records, it is time consuming to scroll through your results unless you extract the data or create an index. IDEA allows you to perform up to 50 extractions, or views, with one pass through the database.
Examples Data Analytics
Features & Functions:
IDEA gives you the ability to combine fields from multiple databases into a single database for testing, to determine whether the data matches across various systems.
The goal is to get the data (which comes in various forms and formats) into a single tool where you view and compare files. IDEA offers split screen capabilities to open and view multiple files at the same time, which comes in handy when you want to visually compare files side-by-side.
There are an unlimited number of tests that can be used to identify anomalies and uncover potential fraud. The key is to determine where it can add value. How can it be applied to find errors, waste, abuse and fraud? The use of data analytics is limited only by your imagination in ways to use it.
IDEA Version Nine includes a ribbon of 100+ audit-specific commands to quickly perform tasks such as searching for duplicates, detecting gaps in numeric sequences, grouping data by categories, and filtering rows and columns in seconds – without programming. IDEA also offers editable text fields to create electronic working papers, and comes with a comprehensive HTML help utility for questions along the way.
Phase 4: Communicating Results
As testing is completed, the focus of the audit turns to communicating results. This is one of the core time-saving areas where data analytics simplifies presenting your findings. The Project Overview feature in IDEA presents a graphical or table representation of the entire audit or investigation process that may be shared, and used to meet documentation requirements. The History file contains all the actions performed within a Working Folder, including the creation, deletion, and modification of databases. It also records all actions performed so the process used can be repeated on next period’s or next year’s files. This feature provides the ability to independently review the workflows including drill-down capabilities for additional history.
Most data analytics tools offer reports in various forms, with export to Excel and Word, to suit varying presentation needs. Charts, graphs, pivot tables, stratification and history provide great visuals to put the audit report into a format where the reader can grab onto what you’re communicating. The drill-down capabilities give management the ability to review results independently and see details that would not be available otherwise. IDEA also works with visualization tools such as ClickView, Spotfire and Tableau.
Phase 5: Monitoring/Corrective Action
In the final phase of the audit lifecycle, data analytics can still play an important role and save time. Analytics can be used for open-issue follow up to determine whether actions have been correct, stopped or adjusted.
As part of the closing process, auditors may be asked about what tools and techniques were used, and the client may be interested in adopting and implementing them to establish a more regular continuous controls monitoring process. For example, duplicate payments, credit balances, errors in record keeping, excessive returns may need to be run more frequently to add value and recover losses.
Continuous controls monitoring can be facilitated by using the Project Overview feature in IDEA. The routines are already in the History file within Project Overview, so it saves a significant amount of time by acquiring data in the same format as the original test data and rerunning the same tests year-to-year to see whether controls are working as expected.
The highest value of using data analytics in the final phase is the ability to cite instances, provide detail and back up your findings with facts rather than opinions and projections or estimates. As an auditor, you have an obligation to inform management about risks, and work to put controls into place that mitigate those risks. In the event the risks are accepted by management for a valid reason, then audit tests and results will be fully documented.
Many auditors are required to track their time, and are expected to increase their productivity year over year. By using data analytics to reduce manual process, and conduct a more effective and efficient audit, the audit lifecycle can be significantly reduced so you can fit more projects into each year and become invaluable to your organization or client.
Interested in learning more about IDEA?
We offer free live demonstrations and are interested in learning more about your goals, and how we can help you achieve them. Contact us at [email protected] or visit our website www.audimation.com to arrange a demo.
Acknowledgement: Information for this article was provided by Donald Sparks, CISA, CIA, ARM, Former Vice President of Industry Relations, Audimation Services, Inc. IDEA is a registered trademark of CaseWare International Inc.