Maximizing the Value of Your Data Analytics Program (article)
Scott Moody, Senior Manager
By 2018, most internal audit functions have caught on that data analytics enhances their ability to identify areas of key risk and fraudulent activity, verify process effectiveness, improve business efficiencies, and influence business decisions. Organizations continue to establish analytics programs, but the implementation alone often isn't enough to generate excitement or ensure success. The reality is that most companies are already conducting ad-hoc analysis of their data but haven't duplicated or formalized recurring tests to optimize their analytics program overall. To truly maximize the value, internal auditors should define the people, processes and technology required to manage a sustained data analytics program.
Understand What Success Looks Like
Without clearly defining what success looks like, you haven't set yourself up to achieve it. It is unlikely that all stakeholders would be derived from a single department. Rather, they are likely comprised of some combination of Internal Audit, IT (especially Security and Data Management groups), senior management and potentially the Board of Directors. Each individual may have different expectations for how the overall data analytics program fits within the organization's strategic goals and varying ideas for what data is important to be analyzed. Conduct a conversation first with all stakeholders to understand their perspective, taking into consideration their objectives and pain points. Converting this feedback into clear goals that everyone agrees to, such as improved control execution, risk identification, or instances of fraud, waste and abuse, will arm the data analytics team with what it takes to achieve success.
Audit and Monitor the Best Risk Candidates
In the world of analytics programs, not all data is created equal. When identifying the areas to include for analysis, organizations often gravitate toward including risks that are very likely to occur or will cause significant impact. While this approach makes sense from a risk-management perspective, it doesn't always mean that these risk areas make the best candidates for data analytics. In addition to the criticality of risks, consider the relevant data needed for analysis and if the area is currently being audited. How easily and consistently can this data be obtained? What individuals manage this data? What is your relationship with that individual or department? It is possible that the data you're seeking will require additional measures to obtain or the facilitation of better relationships with those who manage it to keep your program running smoothly. These considerations can be included in your goal-setting process.
Make the Data Work for You
Once you've implemented a program and identified the right data to analyze, you need to transition from conducting periodic audits to performing continuous auditing and monitoring. This means that you are executing recurring analysis of certain areas important to your organization automatically. While many organizations have implemented internal audit analytics software, such as ACL or TeamMate, they are not using the software to its full capacity. These analytics tools typically have flexible interfaces that can execute provided commands and save them in a log over time, which can later be loaded to help you create a specific script. This custom script can then be run automatically, sending real-time reports to you or management for review and remediation without ever having to wait for a formal audit report. Establish a process around scripting to make sure you are looking at the correct data, that analytics are tested and that outcomes produce the correct results. Make sure to include a process to implement changes for instances where the script requires updating to prevent future failure.
Build a Winning Team
Your data analytics program is only as strong as the individuals on which you rely to execute it. When creating your analytics team, it will be important to make sure you designate a few individuals to fulfill critical roles. Identifying a data analytics champion should be your first step. This individual should not only have an expertise in working with data and information technology systems but should also have a passion for this type of analysis. They will serve as your primary driver for the program execution. In addition, someone on the analytics team should focus primarily on relationship management. Consider which individuals from which different departments should be involved throughout various stages of your program. Building and maintaining relationships with the individuals or departments who grant access to the critical data will be important throughout. Finally, selecting a management liaison from your team can help bridge the data analytics program with management's overall strategy. This individual should provide your team with oversight and understanding of what is truly important to the organization. These three areas can be fulfilled by the same person, but it is recommended that they be handled by multiple team members to ensure focus is not lost in any area. Your team can always expand in the future to include business process owners as your data analytics program grows.
Maintain an Optimum Program
When a clearly defined program is based on strategy and executed by a strong team, your organization is set up to achieve success. Successful data analytics programs often reduce manpower, resources and overall cost while better controlling actual risk in real time. These are outcomes that all departments can get excited about, which will help you continue to generate buy-in from individuals across your organization.
For more information on data analytics, please contact one of our Risk & Advisory specialists.