Use of advanced analytics across the internal audit lifecycle, including the development of continuous control monitoring dashboards

Integrating advanced data analytics across the internal audit lifecycle allows internal auditors to make optimal and strategic use of data-driven insights. It enables real-time risk monitoring and timely reporting of high-rated internal control deficiencies. These practices help to build trust and support informed decision-making, ultimately leading to enhanced business value.

"However, the successful use of advanced analytics heavily depends on the data maturity and availability captured in an organization's (ERP) systems. We believe it is critical to verify the IT Generated Controls (ITGCs) and IT Automated Controls (ITACs) embedded in the ERP system, conduct a data quality assessment across all systems, and mitigate risks before implementing advanced analytics. Executing these reviews and implementing mitigating actions are crucial to avoiding false positive data analytics results and ensuring business buy-in."

1. Rolling risk assessment to develop a risk-based audit plan. To develop a risk-based audit plan, the continuous identification of emerging strategic, operational, financial and compliance risks is the starting point. These emerging risks can be identified by making use of the results of advanced analytics, such as continuous control monitoring dashboards.

2. Execution of high-impact internal audits. The use of advanced analytics supports the preparation, execution, and reporting of high-impact internal audits, facilitating better insights and enhancing risk coverage:

• Internal audit preparation: Gather and analyze data to identify internal control deficiencies when defining the audit scope and assessing the risks together with the business.
• Internal audit execution: Use analytics to discuss processes and related internal control weaknesses, and to execute targeted testing and full population reviews.
• Internal audit reporting: Incorporate data analytics results into reports to quantify the observations and prepare pragmatic recommendations.

3. Reporting to leadership and Audit Committees. The reporting to leadership and Audit Committees can be enhanced when internal audit results are communicated in new ways, using for example visuals from the continuous control monitoring dashboards.

4. Follow-up of outstanding internal audit observations. Process mining and continuous control monitoring insights are also utilized to monitor the progress made in addressing internal control deficiencies. These insights facilitate the follow-up of outstanding internal audit observations and help internal auditors to utilize updates on implemented action plans, which are often communicated orally by the business.

Organizations can leverage the power of data with advanced analytics. In today's business landscape, proficiency in data analytics has emerged as a core skill for internal auditors. Given the time-intensive nature of data extraction and analysis, this is particularly crucial. According to a TriFinance survey on the future of Internal Audit, there is a strong inclination towards adopting advanced data analytics to identify, assess, and address risks.

Process mining is a methodology that allows organizations to analyze their business processes, giving internal auditors the ability to reconstruct, monitor, and improve these processes using real performance data. The primary advantage of this methodology is its ability to review the entire transaction population and understand the process steps regardless of individual subjectivity. Three key benefits of using process mining include

1. Utilizing real-time data to optimize, standardize, and harmonize processes.
2. Detecting internal control weaknesses and process inefficiencies that were previously unknown.
3. Identifying instances of compliance breaches and fraudulent activities.

The results of process mining also serve as the foundation for developing and implementing continuous control monitoring dashboards for end-to-end processes. They provide a factual perspective on business processes across different entities and regions. Specifically, the emphasis is on processes where significant internal control weaknesses, previously unidentified, were discovered during process mining exercises.

The Continuous Control Monitoring dashboards are a set of data analytics tools designed to:

1. Identify, quantify, and mitigate internal control deficiencies.
2. Alert users in real-time of anomalies.
3. Automate internal controls monitoring.

Continuous control monitoring enables the quantification of risks through automated and constant supervision of controls. This results in cost savings and process efficiencies. The dashboard is built on the existing internal control framework. The key is to have real-time data accessible for continuous monitoring of processes, enable proactive detection of internal control weaknesses and take corrective actions in a timely manner.

The biggest gains of advanced data analytics are data gathering and targeted testing, as data is constantly updated and made accessible in the system for the internal auditor. Within a short period of time, they will have access to transactional data to understand various metrics across a number of processes such as procure-to-pay, order-to-cash, record-to-report, inventory, fixed assets, treasury, and even hire-to-retire. Each transaction is associated with entities, vendors, customers, warehouses, fixed assets, bank accounts, and employees, and can be analyzed with process flow charts and tables. To verify and investigate the existence of proper source documents, internal auditors can rapidly drill down into transactions.

Before deploying a continuous control monitoring dashboard, a data quality assessment is required to review data accuracy, completeness, consistency, and reliability. Additionally, it evaluates IT system configuration, including data security, system availability, change management, and segregation of duties. This assessment provides assurance regarding the correctness and completeness of the data utilized.

The integration and continuous use of advanced analytics to manage and improve operations enable internal auditors to act as an air traffic control tower. In this role, Internal Audit assigns ownership, requests actions to address internal control deficiencies and follows-up on the outcome of improvement initiatives.

Image by DC Studio on Freepik