GLOBAL KNOWLEDGE BRIEF

DATA ANALYTICS MANDATE

Part 1: Where do we go from here?

 
Table of Contents

Introduction ................................................................................................................................................... 1

Understanding data analytics ....................................................................................................................... 2

Data analytics has become a necessity rather than a desire ........................................................... 2

The categories of data analytics ......................................................................................................... 3

Benefits of data analytics .............................................................................................................................. 4

Efficiency and accuracy are chief among the advantages ............................................................... 4

Overcoming objections........................................................................................................................ 4
Audit function maturity ........................................................................................................................ 6

Closing thoughts ........................................................................................................................................... 7

INTRODUCTION
The future of data analytics is now

Getting started
Before you can determine where to go and how to get there, you must figure out where you are.

The concept of data analytics has become a mandate for

internal audit functions. The question isn’t “if”; it isn’t even “Internal audit can be a
“when.” The time is now; the question is how? catalyst for expanding the
use of analytics through the
If you have not yet started or have only dabbled in the world
of data analytics, it is time to learn about it and recognize
company to provide
the potential value you can contribute to your organization greater, more holistic
by implementing even a basic foundation and building on it business insights.”
as you appreciate the full value and power of information.
— Neil White
Is it a daunting proposition? It can be, and there is a “Analytics Refresher,” iaonline.org
learning curve, but even small audit functions can take
advantage of the power that data analytics can provide. It
can further your reach into and visibility within your organization, allowing you to stay relevant and contribute
to your organization’s betterment by providing greater value.

“Analytics Refresher,” published almost five years ago in Internal Auditor magazine, is still on target today.1
“Internal audit can be a catalyst for expanding the use of analytics through the company to provide greater,
more holistic business insights,” states the article’s author, Neil White. Those who are not fully engaging in
data analytics can enhance their organizational profile and usefulness by making it a priority to introduce data
analytics into the audit plan.

This is the first of two primers on the topic. Understanding data analytics and its potential benefits are covered
in this issue. Part 2 will review strategies and tactics for those in the early stages of data analytics adoption or
have yet to begin.

1
White, Neil. 2014. “Analytics Refresher.” InternalAuditor.org. October 22, 2014. https://iaonline.theiia.org/analytics-
refresher.

1
UNDERSTANDING DATA ANALYTICS
Leveling the playing field through knowledge

Data analytics has become a necessity rather than a desire

Various definitions abound but Data Analytics: Elevating Internal Audit’s Value offers an elegantly simple
definition: “(data analytics is) the process of gathering and analyzing data and then using the results to make
better decisions.”2

In his April 8, 2019, blog, IIA President and CEO Richard Chambers cited a 2018 Gartner study that found
87% of organizations are classified as having low business intelligence and analytics maturity.3,4 There is a
lot of buzz about data collection ― and certainly about protecting its privacy ― but less is said about how
useful that data can be and what insights its analysis can offer.

The sheer volume of data companies collect and can collect demands innovative ways of dealing with it and
getting useful, actionable information from it. Think about the data being collected and the disparate business
units across your organization that may be unknowingly hoarding information in siloes: marketing, IT,
consumer data, finance, R&D, operations, and more. Individually they may be getting what they need, but
opportunities may be missed by failing to aggregate the information to conduct thorough, objective analysis of
the stories it has to tell when viewed through a more comprehensive lens.

Each entity may have its own purposes for collecting the data, but there is abundant information to be learned
from it by sharing. Data analytics can help bridge gaps across siloes, and it is likely that new information and
facts can be derived from existing data to create opportunities for the organization.

The amount of information and variances in data collection are so extreme that manual analysis is simply
ineffectual. In fact, it may be damaging because by nature and definition, manual analysis is too narrowly
focused. Look how quickly the world has progressed from 2G to 5G. Internal auditing must use the tools at its
disposal to, as Chambers says, audit at the speed of risk, which, arguably, is moving faster every day.

2
Stippich, Warren W. and Bradley J. Preber. 2016. Data Analytics: Elevating Internal Audit’s Value. Altamonte Springs,
Fla: The Internal Audit Foundation. https://bookstore.theiia.org/data-analytics-elevating-internal-audits-value.
3
Chambers, Richard F. 2019. “Facebook Data Exposure Offers Critical Lesson for Internal Auditors.” InternalAuditor.org,
April 8, 2019. https://iaonline.theiia.org/blogs/chambers/2019/Pages/Facebook-Data-Exposure-Offers-Critical-Lesson-for-
Internal-Auditors.aspx.
4
Moore, Susan. 2018. “Gartner Data Shows 87 Percent of Organizations Have Low BI and Analytics Maturity.” Gartner
press release. December 6, 2018. https://www.gartner.com/en/newsroom/press-releases/2018-12-06-gartner-data-shows-
87-percent-of-organizations-have-low-bi-and-analytics-maturity.

2
 Data analytics and financial services
In their pursuit to be more efficient, cost effective, and secure with technologies such as cloud
computing, artificial intelligence, robotic process automation, blockchain, and others, financial services
organizations, specifically banks, may be falling behind in the area of data analytics.

If they are not already making use of the worlds that data analytics have opened, banks risk not only
succumbing to competition but also running afoul of compliance with regulatory expectations. A recent
article in American Banker discusses the many disadvantages banking institutions may face if they fail
to achieve a level of competency in employing data analytics.5

Specifically for internal auditors in the banking sector, the article offers tactics that may help shape
industry-specific data analytics frameworks. The article posits that banking is a legacy industry that
may not be as nimble as others in implementing drastic change such as that which data analytics may
require in terms of infrastructure.

The categories of data analytics

Objectives should guide internal auditors into one of four distinct categories of data analytics:

 Descriptive analytics. Information describing the past, which may help determine what can happen
in the future.

 Diagnostic analytics. Using data to understand why things happened the way they did. This can
help with root cause analysis and determine patterns.

 Predictive analytics. Combining findings from descriptive and diagnostic analytics to forecast or
develop an educated guess on what may happen in the future based on the past.

 Prescriptive analytics. The higher purpose of data analytics. This could include modeling options
to mitigate risks, acknowledging trends that could help the organization, and outlining or defining
future actions.6

Data analytics helps organizations look backward, at the present, and toward the future. All are useful, and
each has an important purpose. Data analytics can also play a role in developing problem-solving processes
and formulating insights about the organization.

In addition, data analytics can be both risk-focused (e.g., the effectiveness of controls, the presence of fraud
and waste, noncompliance with policies and regulations) and performance-focused (e.g., increasing sales,
decreasing costs, improving profitability).

5
Kosoff, Jacob and Daniel Stahl. 2019. BankThink blog. “Banks are playing catch-up in the big-data game.” March 1,
2019. American Banker. https://www.americanbanker.com/opinion/banks-are-playing-catch-up-in-the-big-data-game.
6
Garofalo, Susan. 2018. “Data Analytics for Internal Auditors.” Audit Insights: Vonya Global blog. October 18, 2018.
http://www.vonyaglobal.com/internal-audit/knowledge/data-analytics-internal-auditors/.

3
BENEFITS OF DATA ANALYTICS
Embracing adoption has many potential benefits

Efficiency and accuracy are chief among the advantages

Many auditors now fully engaged in the use of data analytics point to a range of benefits including increased
efficiency with regard to time and resources. For example, data analytics allows IT to write single scripts that
apply across a broad range of audits rather than writing the same script multiple times for singular uses. It
also provides more reliable and insightful information based on analysis of an entire database, as opposed to
manual analysis that relies on sampling, which may yield a more parochial view of the information.

Other potential benefits from counting robust data analytics capabilities among your audit function’s available
resources include:

 Increased effectiveness through testing whole populations versus random samples, thus getting a
clearer picture of areas under review.

 Continuous auditing can enable the discovery of emerging trends ― positive and negative ― before
they become entrenched issues. Audit functions may be able to react more quickly in monitoring risk.

 With analysis of more complete data set populations, internal audit can provide better assurance.

 Reduction of human error with carefully vetted and tested automation.

 Audit resources can be efficiently deployed to examine more operational and organizational strategic
risks as more routine functions are automated and continually running.

 Data analytics can enable the internal audit function to conduct more audits over time with the same
resources.

For a simple analogy, think of data analytics as multitasking around the house. The dishwasher, washing
machine, and dryer can perform their unique functions as programmed while the skilled household executive
handles sophisticated tasks that require a hands-on approach. Planning and cooking dinner, for example,
takes more active monitoring and sensitivity to timing to get everything on the table at the same time.

This is one incontrovertible reason why smaller audit functions are highly encouraged to embrace data
analytics and all it has to offer.

Overcoming objections
Implementing a strong data analytics plan doesn’t always require an investment in new technology or software,
though there are excellent, user-friendly, peer-reviewed packages available. Incorporating new technology or
software may result in functional downtime as learning to use these tools takes time. Understandably, smaller

4
audit functions may see this as a barrier to entry. However, software providers often offer online tutorials for
their products, and some may be included in the package itself. Educational videos are available on YouTube,
as some software manufacturers post tutorials there, free of charge.

Perhaps the package included a provision for onsite or online training. If your organization opts for the
prepackaged software approach, use the sales professional or consultant as much as possible to get started
and keep going. Cross training team members helps ensure that if one person moves on, the program doesn’t
land on the scrap heap of good ideas. This is especially true for small audit functions.

But short of an investment in new technology and applications, your organization may already have enterprise
software such as SharePoint that can accomplish many things if it is set up properly. It’s a question of having
the talent on board and inclination to do so. In a recent blog post, Jim Pelletier, The IIA’s vice president of
standards and professional knowledge, discusses five misconceptions about small audit functions, including
the presumption that they are unable to leverage technology. 7

Candy expenses make for “sweet win”

In his presentation at The IIA’s 2019 General Audit Management Conference TM (GAMTM), David
Chavez, CFO of Latin America for Marathon Petroleum, shared a quick win his team at a previous
employer experienced in their use of data analytics.

In presentations about introducing data analytics into internal audit functions, Chavez outlined an 11-
step process that includes “select an initial impact project (quick win).” As many organizations do
when embarking on a data analytics strategy, Chavez’ team first focused on a relatively simple
project: travel and expense (T&E) reports. The analytics quickly revealed that one company executive
was spending $40,000 a year on candy. No one questioned the
expense sooner because each individual expenditure was relatively
small.

“The moment we started looking, we found it. Nobody detected it

previously because of the small charges, but it was all on the same
account. The moment we found it,” Chavez stated, “we said ‘wait,
what’s going on here?’ Management immediately saw a quick win.
And guess what? We had done a T&E audit on that department
every year, and it never came up.”

7
Pelletier, Jim. 2019. “5 Common Misconceptions About Small Audit Functions.” April 26, 2019. InternalAuditor.org.
https://iaonline.theiia.org/blogs/Jim-Pelletier/2019/Pages/5-Common-Misconceptions-About-Small-Audit-Functions.aspx.

5
Audit function maturity
Much is made of the maturity of organizations and their internal audit functions regarding the adoption of data
analytics. No matter where your organization may be on the path, you can start. Much may depend on the
skill sets of the audit function. Auditors with strong data and technical scripting skills can advance the
organization’s ascent up the maturity scale.

DATA ANALYTICS MATURITY PATH

Data Analytics
Enabled
Data Analytics
Use of data analytics
Managed
fully embedded
Data Analytics within the internal
Defined Organisation wide audit activity. The
approach to the use organisation is
Data Analytics of data analytics, looking to internal
Aware Clear understanding internal auditors audit for assurance
within internal audit recruited with coding, linked to 100%
Data Analytics Some skills within and the organisation programming skills testing in business
Naive the internal audit as to the value use of critical areas
along with support
activity and some data analytics as a from IT
No data value add tool can bring
analytics skills opportunities

Source: “Data Analytics: Is it time to take the first step?” Chartered Institute of Internal Auditors, 2017.
https://www.iia.org.uk/media/1689102/0906-iia-data-analytics-5-4-17-v4.pdf.

In another presentation at GAM, two representatives from The PNC Financial Services Group, Derrick Thomas
and David Dunn, shared their experiences focusing on three core areas to upgrade their data analytics
capabilities to a higher maturity level: people, process, and capabilities. Dunn, an executive vice president
and the assistant general auditor, led the internal audit activity for PNC’s IT function. He shared his background
in advancing PNC’s data analytics strategy, which started with the typical manual analysis he said was slow
going and minimally effective.

Then Thomas joined the organization as a senior vice president and director of advanced data and analytics
solutions. Dunn began working closely with Thomas, whose team was able to provide data analytics, data
procurement, and infrastructure management functions within the internal audit department using ordinary
software programs such as Excel and Access. With Thomas’s oversight of the department’s advanced analytic
development — including robotics process automation, machine learning, and other emerging analytic
modalities — he and Dunn worked to create a symbiotic relationship between their teams. It started out with
Thomas’s team being “order takers.” Auditors made requests and the data team fulfilled them. However,
because the data team had the expertise to dig further, eventually they began consulting with the auditors,
informing them of how much more they could offer. When auditors began informing the data team of each
request’s objective, they were able to work together to more thoroughly investigate each objective for deeper
insights. Both teams have benefited from the collaboration, achieving significant milestones on the
organization’s path to data analytics maturity.

6
CLOSING THOUGHTS
There’s no time like the present

Begin now
The need for internal audit to adopt data analytics and
Suggested Reading
adapt its process to leverage new technology has is not
new. Yet many organizations fail to get beyond “how to  GTAG: Understanding and Auditing
start,” as indicated by the 2018 Gartner study noting that Big Data.8

87% of organizations confess to having low business  GTAG: Data Analysis

intelligence and analytics maturity. Technologies.9
 Global Perspectives and Insights:
“Analytics Refresher” outlines six guiding principles that 5G and the Fourth Industrial
Revolution, Part 1.10
can help those just beginning to implement data analytics.
Another excellent repository of information is The IIA Data  “Data Is a Matter of Trust.”11

Analytics Resource Exchange.12

Choosing to invest in a shiny new state-of-the-art software package might be an option for your organization
to spark interest, but even if that’s not in this year’s budget ― or the next ― you still may make great strides
in starting on a shoestring with software you likely already have, such as Excel, Access, and Sharepoint. One
key is investing in a person or a small team to take on the project of developing a rudimentary system. Cross
training is wise from the outset to keep the momentum going.

Considering starting with a quick-win project, such as your organization’s T&E expenditures. These can yield
high-level returns in the form of showcasing the value of data analytics without a lot of effort or expenses, and
they might just be what is needed to inspire excitement in your company about adopting data analytics.

Time is of the essence. Get started now. Don’t be left in the data dust when you can be auditing at the speed
of risk.

8
GTAG: Understanding and Auditing Big Data. The IIA. May 2017. https://global.theiia.org/standards-
guidance/recommended-guidance/practice-guides/Pages/GTAG-Understanding-and-Auditing-Big-Data.aspx
9
GTAG: Data Analysis Technologies. The IIA. August 2011. https://global.theiia.org/standards-guidance/recommended-
guidance/practice-guides/Pages/GTAG16.aspx
10
Global Perspectives and Insights: 5G and the Fourth Industrial Revolution, Part 1. The IIA. 2019.
https://global.theiia.org/knowledge/Pages/Global-Perspectives-and-Insights.aspx
11
McCollum, Tim. 2019. “Data Is a Matter of Trust.” InternalAuditor.org. February 21, 2019.
https://iaonline.theiia.org/2019/Pages/Data-Is-a-Matter-of-Trust.aspx
12
The IIA Data Analytics Resource Exchange. https://global.theiia.org/standards-guidance/topics/Pages/Data-Analytics-
Resource-Exchange.aspx.

7
About The IIA
The Institute of Internal Auditors (IIA) is the internal audit profession’s most widely recognized advocate, educator, and provider of standards,
guidance, and certifications. Established in 1941, The IIA today serves more than 200,000 members from more than 170 countries and
territories. The association’s global headquarters is in Lake Mary, Fla., USA. For more information, visit www.globaliia.org.

Disclaimer
The IIA publishes this document for informational and educational purposes. This material is not intended to provide definitive answers to
specific individual circumstances and as such is only intended to be used as a guide. The IIA recommends seeking independent expert advice
relating directly to any specific situation. The IIA accepts no responsibility for anyone placing sole reliance on this material.

Copyright
Copyright © 2019 The Institute of Internal Auditors, Inc. All rights reserved. For permission to reproduce, please contact copyright@theiia.org.

June 2019

Global Headquarters
The Institute of Internal Auditors
1035 Greenwood Blvd., Suite 401
Lake Mary, FL 32746, USA
Phone: +1-407-937-1111
Fax: +1-407-937-1101
www.globaliia.org