Despite years of Chief Audit Executives stating the data analytics are a necessity for efficient and agile audit, and requiring auditors to have analytic skills, analytics still often fail to deliver. I have often heard. “We didn’t have time to investigate the results of the analytics”, “We didn’t have time to get the data”, “The data doesn’t have integrity”, ”We didn’t understand the results”, “We didn’t know what to recommend…
Build it and They (won’t) Come?
Reflecting on 35 years of performing analytics to support internal audit, finance, and fraud detection has led me to a – not so startling – revelation: you can build the best analytics in the world, and they still might not be used by internal audit. Analytics I have developed, even with significant client input, have not been used or were limited in their use: either time or extent. The question…
What is Internal Audit?
When I am asked, “What does an internal auditor do?” my response is usually, “How much time do you have for me to answer that question?” As a long time internal auditor (35 years), I have often been disappointed by the perception of management (and others) regarding the purpose and value of internal audit. Ask management about internal audit and their response if usually that audit reviews financial statement and…
A Lifetime of Analytics
At the end of the year, I tend to reflect back on what I have done or not done. It occurred to me that 2023 will be my 35th year using ACL Analytics (Galvanize, Diligent) on a daily basis. Throughout the years I have had many failures and successes. I have learned from identifying lessons-learned when things worked and even more importantly when they did not. I also took responsibility…
Head Bang on Desk (aka My SOD Analytics Failure)
My understanding is that SAP user roles are difficult to design properly, and the review of user authorizations and access rights is equally challenging. I thought that I could use analytics to identify instances where a user had performed transactions that constituted a potential separation of duties (SOD) issues in the FI component and support management in their reviews to identify roles that were not designed properly. The analysis utilized…
Audit: Developing a Continuous Monitoring Program for use by Management
I was fortunate it my early career by a forward-thinking manager. Back in 1990, my manager allowed me to explore the notion of data analytics to support audit. The manager also had the view that the analytics developed for the audit (e.g., AP analytics) should be handed over to management for their use (e.g., AP manager does continuous monitoring). So, I began my analytics career with the notion that analytics…
Better Audit Reports
Here are my top eight best practices for creating better internal audit reports that hit the mark: Audit Objective: ensure that the audit objective addresses the risks to the goals and objectives of the organization. It should drive the risk identification and assessment; and be a foundation for the audit workplan and the conduct of the audit. And ultimately, is it the statement upon which the audit concludes. Audit Workplan:…
Data Analytics and Internal Audit
This is the next post in a series that discusses the importance of having a proper audit objective, defining the business goals and objectives, and the risks to the achievement of those objectives. This article will discuss the identification and assessment of risk. The next series of articles will look at the audit finding statement: Criteria, Condition, Cause, Impact and Recommendation. The focus will be on the use of data…
Better Audit Recommendations
Setting the proper objective is critical to delivering on a quality, value-add audit. It must be strongly linked to the goals and objectives of the entity being audited; drive the risk identification and assessment; and be a foundation for the audit workplan and conduct of the audit. And ultimately, is it the statement upon which the audit concludes. Yet too many audits have poor objectives. I have performed analysis in…
My Analytics Journey
Dave Coderre, Co-Founder CTRLmatters It occurred to me today that I have been performing internal audits and reviews for more than half my life. Throughout the years I had had many failures and successes. I have learned from both by identifying lessons-learned when things worked and even more importantly when they didn’t. I also took responsibility for my failures and shared my successes with the auditors on my teams. In…