Data is a powerful thing. Consequently, the role that data analytics play in today’s audit profession cannot be emphasized enough, especially in light of digital transformation across different industries. Auditors are now blessed with abundant data sets and analytic techniques capable of driving audit insights into unprecedented horizons for new, “data-driven” insights. In contrast, some auditors mostly build on professional wisdom, experience and pragmatism to carry out audit engagements, dealing with any data they come across to echo their perceptions and judgment, aka “data-informed.”
Whether data-driven or data-informed, neither is right or wrong. Being purely data-informed could be used as an excuse for not doing all the hard work of distilling data. However, data-driven auditors can also be tempted to over-analyze everything that comes into audit interest, without stepping back and looking at the big picture as guided by human judgment.
Auditors should seek a balance between the two above extremes. In fact, there are some common pitfalls of which auditors should beware and avoid in reaping the full potential of data analytics, including:
Only Focus on the Known Unknowns
When planning for an audit engagement, auditors might easily pull a list of risks and concerns based on past understanding and other information available on hand. Starting from there, auditors then build a series of analytics procedures and metrics to either conform to or disprove auditor skepticism. This is an approach of “finding the known unknowns” and is undoubtedly fundamental to developing an audit analytics program. However, auditors solely relying on this approach may miss what could sometimes come out as their secret weapon – “finding the unknown unknowns” – that is, finding risks or anomalies not on the auditor’s radar at the beginning.
But that is easier said than done. Prior to finalizing an audit plan, auditors could take an exploratory analysis into any accessible key business metrics and datasets related to audit scope. Hopefully, this will align facts/numbers with auditors’ assumptions and create opportunities to fine-tune the audit plan with more pertinent considerations.
Assume the Data is Clean and Tidy
Garbage in, garbage out. Any analytics is only as good as the data that feeds into it. Auditors usually must compile data in disparate forms and patterns from different sources and are thus subject to additional layers of data quality risks, both arising from bad data in its source and errors/omissions in the data compilation process. Jumping straight into analysis on such data without any quality check could produce misleading audit results, ultimately putting the reputation of the audit department at risk.
However compelling the results are that analytics may produce, cleaning the incoming data can consume a lot of workload in an analytics journey. But the process of data cleaning can also benefit auditors in that the invalid datasets, once identified, may reveal important patterns for further investigations. As the saying goes, “the devil is in the detail.”
Mix Correlations with Causation
Supported by the right data and algorithms, auditors should be on track to identify some patterns or anomalies from data by which auditors may be tricked to believe they found a “mine” of audit findings to chase down. Well, that may be a good sign, but auditors should also bear in mind that these clues are just correlations for a potential issue and may not be the truth, at least not all of the truth, to justify an audit finding.
A prudent auditor, in this case, would reflect on two underlying questions before further action:
- Are there any other clues that would provide an opposing point of view?
- What is not collected in data, i.e., is there any data collection bias?
Data Reporting: Information Overload
When wrapping up the analysis for reporting, it can be tempting for auditors to want to show the audience (e.g., executives) everything from the analysis as evidence of all of the hard work done and the robustness of the process. It is an understandable mistake, but doing so actually forces the audience to repeat the tireless process that the auditor has gone through to reach the argument. Instead, auditors should ask themselves three questions before they proceed:
- Who: To whom are you communicating?
- What: What do you want your audience to know or do?
- How: How can you use data to help make your point?
With all that being said, the only way auditors can strike the right balance when it comes to leveraging data analytics is through practice and making a conscious effort to avoid these common mistakes. By steering clear of the above pitfalls, data analytics can be your indispensable guide to becoming a more valuable auditor.