What is auditor data analytics?
Data analytics is a relatively new discipline for auditors. It requires a substantial investment in hardware, software, skills and quality control.
Data analytics consists of tools that extract, validate and analyse large volumes of data, quickly. The tools are applied to complete populations, 100% of the transactions, ie, “full data sets”, and they can be used to support judgements, draw conclusions or provide direction for further investigation. Data analytics can be applied to a wide range of assurance engagements, not just audit.
Data visualisation, such as bar and pie charts, and cluster diagrams, is used to explore data, bring it to life and help users understand the significance of the findings. Improvements in interfaces mean that data analytics can be used by non-specialists.
Data analytics enables auditors to improve the risk assessment process, substantive procedures and tests of controls. It often involves very simple routines, but it also includes complex models that produce high-quality projections. Auditors using such models need to understand them, and to exercise significant judgement in determining when and how they should be used.
How did we get here and where might we go from here?
The audit once involved an exhaustive examination of every transaction and balance, following all (or most) of them through the system. In the 1950s auditors started to question this fully substantive approach and by the mid-1970s, risks analysis and controls testing, sampling and flowcharts, risk-based auditing standards and the concept of materiality were the norm. They have been the hallmarks of external auditing ever since. Had it been possible at either of those points to examine all of the invoices automatically, cheaply and fast, then it is very unlikely that we would be where we are today.
Data analytics challenges many established concepts, including the concept of an audit itself, as well as the way it is performed and regulated. Questions arise as to the importance of the distinction between risk assessment, substantive procedures and tests of controls when a complete data set is examined. Data analytics should enable auditors to see the big picture again, more easily than they have been able to in the recent past.
The technology firms are using to develop data analytics is rooted in software originally developed in the early 2000s for data mining in the banking and retail sectors, and for design and modelling in financial services and engineering. The type of tasks this software can perform, and the connections it can make, dwarf what was previously possible.
The main operational issues going forward for auditors are likely to be:
- how to extract good quality audit evidence from the analyses, taking account of the quality of the underlying data;
- what type of analyses give the best audit evidence; and
- uncertainty regarding regulatory challenge.
Auditing standards are written on the assumption that it is rarely possible to test 100% of the transactions entered into by any entity. This is no longer true. One view is that the sheer scale of the work that can be performed using data analytics techniques changes everything and that, as a result, auditing standards need a root and branch modernisation to reflect the new techniques.
Another view is that the basic concepts are sound and that auditing standards simply need to be modernised to reflect some powerful new audit techniques. The challenge is not only to ensure that auditing standards can accommodate the new tools, but also to ensure that they contribute to audit quality, the level of assurance obtained by auditors and the value of the audit to investors and other stakeholders. Auditing standards, and regulatory scrutiny of their application, must also continue to encourage innovation in audit.
What can data analytics do and how does it contribute to audit quality?
Data analytics involves the extraction of data using fields within the basic data structure, rather than the format of records. A simple example is Power View, an Excel tool which can filter, sort, slice and highlight data in a spreadsheet and then present it visually in a variety of bubble, bar and pie charts.
Visualisations are only as good as the data on which they are based, and the quality of the analyses depends on the underlying data that must be extracted, analysed and linked in the right way.
These tools can be used in risk analysis, transaction and controls testing, analytical procedures, in support of judgements and to provide insights. They can draw on external market data such as third-party pricing sources, to re-price investments, for example. Interest and foreign exchange rates, changes in GDP, and other growth metrics can also be used in analytical procedures.
Many data analytics routines can now easily be performed by auditors with little or no management involvement. The ability to perform these analyses independently is important. Many routines can be performed at a very detailed level, and/or in total. The higher-level routines can be used for risk analysis to find a problem, while the more detailed analysis can be used to sharpen the focus, and provide audit evidence and/or insights.
Some routines can provide audit evidence to support judgements relating to the appropriateness of methods used in calculating accounting estimates.
Data analytics has been developed with a view to improving audit quality. Audit quality does not lie in the tools themselves – although it clearly cannot be achieved without tools that are fit for purpose – rather it lies in the quality of analyses and judgements the tools facilitate. The value is in the audit evidence extracted from the conversations and enquiries that the analytics generates.
The following unique features of data analytics have the capacity, if used appropriately, to enhance audit quality significantly:
- the ability to graphically visualise results: data visualisation is now a discipline in its own right;
- sophistication, and the breadth of interrogation options;
- ease of use by non-specialists; and
- scale and speed.
What are the technical challenges?
Data capture, extraction, validation and transformation
Many large audit firms have had read-only user accounts within client systems with their own user names and passwords, to serve themselves with reports, for some time. In jurisdictions in which a standard chart of accounts is used, this is a very efficient method of generating information for audit purposes. This is not the same as the extraction or transformation of data, though. Auditors sometimes obtain the data themselves, but they sometimes use data that management has extracted and validated. Auditors perform a suite of controls testing around management’s data extraction and validation processes, and then use what management has produced for their own analyses. Routine aspects of this work are moving offshore. In all cases, management has to perform extensive security and integrity checks before auditors do anything at all.
Confidentiality and security
Confidentiality and security are critical issues and auditors need to manage the risks appropriately, not least to avoid the dysfunctional behaviour that can arise when security is over-engineered and users start working outside the system altogether to get the job done.
The quality of data analytics tools and routines
Extensive quality assurance procedures need to be applied to the development of tools and routines as well as extensive quality controls over the processes that ensure that the people using the tools do so properly.
Data retention
There are issues with large volumes of data provided to auditors by management that do not “belong” to the firm. The issue is not new, but the scale and reach of data analytics keeps it in focus. The audit quality issue is about the need to keep documentation that supports key thought processes, in the context of the legal and practical issues associated with high volumes of data storage. The infrastructure auditors require to accommodate terabytes of data and to analyse many millions of transactions from hundreds of reporting units goes beyond the capacity of standard servers.
Developing a data analytics offering
Data analytics may be about audit quality but auditors have to justify their substantial investment in it. The options for firms are to:
- buy in established techniques from providers outside the firm, maintain alliances with third parties or work with a captive provider; or
- build something from scratch or on top of an existing platform.
However data analytics tools are developed, they have to be merged with practice methodologies. They often permit staff to be creative about how they go about achieving an audit objective. This means that staff also need to be very clear about the audit objective of every routine they run and how it fits with auditing standards.
What are the areas for further consideration and improvement?
Sharpening the focus of data analytics with smarter testing
Data analytics tools are sensitive. Auditors need to be clear about what they are looking for when using them.
Thinking about why and how auditors test internal controls
There are questions around the extent to which, for instance, auditors need to test controls applied during processing. For example, data analytics may show transactions to be properly valued and recorded and so auditors can see what has happened to all of the transactions finally recorded in a system.
Encouraging innovation and respecting the value of data analytics
Innovation is generally seen as a good thing but discipline is needed to ensure that new tools do not become solutions in search of a problem.
Reconsidering the audit approach to fraud
The profession has long argued that the cost of requiring auditors to find fraud is simply prohibitive. That analysis stands and the tension still exists, but data analytics has opened up the possibility of fraud detection in a manner not previously possible.
Enhancing the dialogue between auditors and regulators
Auditors and regulators are working together with standards that never envisaged data analytics. This is a novel situation and a positive approach to the dialogue is important to ensure that all involved remain focused on the improvement of audit quality.
Determining the skills needed in the next generation of auditors
How much understanding of statistics is necessary to use data analytics today? How much more will be required by 2029? Many data analytics routines involve a distribution analysis. Some understanding of how to interpret them is already important.
Additional resources
- Find out about the experiences of two medium sized audit practices in implementing data analytics.
- For more information about what to think about when considering the use of data analytics in your practice, please see our audit data analytics tips.
