Data Driven Dynamic Audit

Introduction

Data analytics aiming to enable a more effective and efficient audit is becoming more and more common in (financial) audit approaches from both internal and external auditors. However, the application of data analytics in today’s financial audit approach is mainly focusing on the analysis of routine transactions in the company, e.g., transactions and controls in the purchase-to-pay-process and on the analysis of manual journal entries. Although a further embedding of this type of data analytics in the end-to-end financial audit approach remains necessary, much progress still needs to be made when it comes to developments to engage with data analytics in the non-routine transactions of a company. This includes the application of data analytics in the areas of risk assessment, impairment testing, benchmarking, anti-fraud procedures, going concern, etc.

This article explores several developments in the sources and types of data which can be used in the financial audit and how these may impact the audit approach and the auditor.

Data Driven Approach

Both internal and external auditors have a wide variety of data available that can be relevant from a financial audit point of view. In most cases, however, the auditor focuses on data that is available in the organization itself. Generally this data is from a ‘known’ and structured source, e.g., the organization’s ERP environment or Business Intelligence environment.

The (data) landscape is changing and growing in the sense that organizations are also exploring the possibilities of utilizing data from outside the organization’s perimeter, with a view to improving the management’s view and creating new business opportunities. This change in the use of data as part of the daily operations in an organization also has an impact on the data and information the auditor needs for his financial statement audit. The financial auditor will not only need to join the data journey within the organizations, but also needs to include externally available data to implement a data driven dynamic audit.

Over the last few years, the effect of the changing data landscape on the audit approach has gradually increased and more and more auditors are embracing these technologies, increasingly using information technology in the audit. However, as was noted in a recent American Institute of Certified Public Accountants (AICPA) whitepaper: “For the most part, IT has been used to computerize and improve the efficiency of established processes rather than transform or replace them. Consequently, improvements have been incremental rather than transformative” ([AICP14]). Accordingly, a lot of work still needs to be done to transform the audit rather than improve on what auditors have been doing over the last 50 years.

When we take the example of a medium-sized retailer with a relatively simple IT backbone and automation, the financial auditor will probably rely on his own knowledge of the industry and a structured balance sheet and income statement based on the organization’s ERP system to perform the risk assessment and plan for the audit procedures. However, the use of public data can also have an impact on how we interpret risks residing in the environment of the organization, even more than in the case of using internal data alone. Numerous books and articles have been written on subjects such as the impact of social media on the business of a retail organization (e.g., how to address complaints made via social media). If, however, social media influence the retail organization, why should not the auditor use this data to plan his risk assessment procedures for the financial audit?

To better understand the different categories of data and the relevance of these categories for the financial auditor, a Data Category Framework has been defined. This framework (see Figure 1) includes the data available within a company as well as externally available data. In addition, the framework links structured (e.g., databases) and unstructured (e.g., video, social media) data to either category. The four individual elements are described below.

Figure 1. Data Category Framework.

Structured Internal Data

This category of data typically refers to the data sources managed, owned and created by the organization itself and contains the transactional data that is used in the core business and supporting processes of an organization. The data life cycle from creation to destruction normally follows a predefined, structured path, determined by e.g., the company’s policies and procedures, in combination with the way the system has been set up. Examples include the transactional data stored in the ERP system (AP/AR invoices, Purchase Orders etc.), customer data stored in the organization’s CRM environment or personnel data stored in the HR system. We refer to this data as structured internal data, irrespective of where the data is physically stored – be it in the cloud, on the premises or with a hosting provider.

For the auditor, structured internal data is a rather convenient category. This type of data has been used as part of the financial statement audit for decades and is usually the basis for all testing procedures. As a rule, this category of data is also the starting point for applying data analytics procedures as part of the audit approach (data analytics for automated control testing, manual journal entry testing etc.). Opportunities for further enhancement of data analytics routines in this area lie in using this data to drive the internal aspects of the risk assessment, performing analytical procedures as part of the planning phase of the audit, further optimizing the use of this data in both interim and year-end audit procedures (e.g., the application of process mining tooling as part of the process walkthroughs) as well as using this data for predictive analytics.

By using suitable analytical procedures, the results of the analytics on this type of data can provide almost complete assurance over the correlation between the cash and goods movements, for example, limiting the additional requirements to perform substantive test procedures in the year-end audit. See also the article regarding the goods/money flow data analytics by Bram van der Heijden and Satiesh Bajnath in this issue of Compact.

Unstructured Internal Data

Presumably, even the larger part of the data residing within an organization can be categorized as unstructured internal data. Estimations are that 80% of companies’ data is unstructured ([Wiki15]). This category of data is known by the fact that it does not normally follow the regular data life cycle flow; no predefined policies or processes are in place to govern the data from creation to destruction and the systems supporting this category of data are usually more like data sharing platforms. Examples of this category include SharePoint environments, an organization’s internet and intranet websites, videos, PowerPoints, emails, firewall traffic, etc.

From an auditor’s point of view, this type of data can be of high interest for the financial statement audit, as these data sources normally provide the guidance on the organization’s processes, input for the risk assessment as well as evidence for the control testing (e.g., approval emails, process descriptions).

Structured External Data

The use of structured external data is already being explored in the audit domain and is characterized by the fact that the data life cycle follows a path similar to that of internal structured data, except that the data is not owned or managed by the organization itself. This category of data includes data coming from, for example, analysts or subject matter experts, industry data, going concern analytics or from the organization’s supply chain environment.

This data category is very promising, not only from an auditor’s point of view, but also for the organization itself. However, the application of data analytics using this category of data in a financial audit setting is limited.

Unstructured External Data

The last data category – unstructured external data – can likewise be utilized for the audit. This category of data follows a completely different life cycle path, can be created ‘by the many’ and ‘for the many’, comes from data sources normally irrelevant to the financial audit (e.g., radio and TV) and in some cases does not even have a clear source of the data (e.g., social media).

To perform data analytics on this category of data, an auditor needs to be equipped with more than just basic analytical skills to analyze, process and assess the usability of this data as part of the (financial) audit. He needs to invest in (advanced) tooling to retrieve and process the data, he needs to develop analytical skills to analyze and interpret the data and he needs to understand the impact of this data on the audit as well as his profession.

The current technology or the availability of adequate tooling to analyze the data is not primarily the issue. Social media or news analysis solutions (e.g., Bottlenose, Owlin) are already available in the marketplace. The challenge rather lies in convincing the auditor to use this kind of data and to use these insights for the purpose of meaningful information for the audit approach.

Impact on the Financial Audit

All these new and improved capabilities and potentialities of data analytics as discussed in the previous section will have a significant impact on financial statement audits and open the door to further audit innovations. When determining the potential impact of the aforementioned data categories on the innovation of the audit approach, we can cluster this in the following brackets of improved quality:

• Quality of execution
• Quality of insights
• Quality of opinion

In this paragraph we will describe the audit innovations in all three.

Quality of Execution – Towards a Dynamic, Tailor-Made Risk Audit Approach

Traditional financial statement audits are planned and performed following four sequential steps (see the Audit Methodology shown in Figure 3). Every audit starts with audit planning (including a risk assessment) and continues with controls and substantive testing, after which the audit findings are evaluated and the audit opinion is issued. The control evaluation is typically performed in the fall during the interim audit, while the substantive end-of-year testing procedures are performed after the balance sheet date.

Figure 3. KPMG Audit Methodology.

New capabilities and potentialities of data analytics can have a major impact on the traditional audit procedure. The availability of internal, structured transactional data has already had an impact on current financial statements audits. It allows audit teams to switch – among other things – from a control-based audit approach to a substantive audit approach with multiple testing periods throughout the year while testing large transactional processes such as purchase-to-pay or order-to-cash transactions. The more powerful the data analytics tooling, the more the financial statement auditor will be able to identify and follow up on potential errors in the data analyzed at an early stage. This will allow financial statement auditors to tailor the audit approach specifically to the transactions with higher risks soon after the transaction has taken place, allowing auditors to perform a dynamic, tailor-made risk audit.

Quality of Insights – Towards an Enhanced Audit

In addition to audits of transactional data (internal structured data), the developments in data analytics methodology and tooling also enable auditors to use external and unstructured data in financial statement audits. The purpose is to perform risk assessments, external benchmarking, challenge the valuation of certain assets, identify misbehavior of employees of the audit client and to perform anti-fraud procedures. As yet, this type of data is not common in the majority of the current financial statement audits. Extending data analytics in the audit by using external and unstructured data will allow auditors to enhance audit insights and provide new and fresh perspectives for the audited companies and, if relevant, the users of the auditor’s reports.

Quality of Opinion – Towards a More Skeptical Audit

Improved data analytics techniques allow auditors to change the audited sample of transactions and/or challenge the management’s statements in a different way. Regulators and users of audits are demanding for professional skeptical auditors, and data analytics can enable the external financial statement auditors to change their audit approach and further challenge audited organizations in a different way. The use of data analytics for the audit of internal transactional data enables auditors to audit the entire population of processed transactions instead of the review of samples and/or internal controls over the transactional processing. Exceptions and errors can easily be identified and followed up based on the data analytics performed. Furthermore, the incorporation of data analytics on external and unstructured data in the audit will help auditors improve the quality of opinion. Likewise, external data can be used to challenge the management’s assertions. Any claims by the management with regard to asset valuations and antifraud-related issues are now typically supported by internal data, and can be challenged with the help of external data by implementing the data analytics techniques and tooling mentioned in this article.

Transforming the Financial Audit into a Data Driven Audit

The auditor can only successfully transform the audit by using (advanced) analytics and combining all different types of data categories in the audit. Risk of material misstatement on the valuation of a company’s assets can be better determined if risks residing outside organization are also taken into account. However, the success of this transformation does not depend on more activities within the framework of the financial audit, but rather requires a change in how existing tooling and technology are being utilized by the auditor to perform an effective and efficient audit. In other words, a change in the behavior of the auditor is more likely to be the critical success factor in this transformation. The tools that can drive this transformation are already available. The question is how, and to what purpose the tooling in the audit is used, and how much time the auditor spends using data analytics in the audit.

When plotting the actual time spent by the auditor when applying data analytics techniques in the financial statement audit, it turns out that most of the time is in fact spent on analyzing routine transactions (e.g., journal entry testing, automated controls within the purchase-to-pay process etc.), using internal structured data (see Figure 4).

The change in the behavior of the auditor would require him to flip the time pyramid by actually spending more time on non-routine transactions and reduce manual efforts in test procedures for routine transactions. After all, if the organization can automate its routine processes altogether, why should not the auditor follow the same approach and automate the entire routine testing? An additional side effect of this change is to further unlock the highest added value of the auditor, which is auditing the non-routine transactions rather than the routine transactions.

Figure 4. Possible impact of a Data Driven Dynamic Audit Approach on the efforts of the auditor.

The auditor cannot flip the pyramid just by himself, however. Once the auditor has made up his mind to change his approach into one where he performs manual audit procedures only where he cannot (yet) use data analytics, you could also argue that the auditor needs a different eco-system to be successful in applying data analytics on non-routine transactions. The non-routine transactions represent non-standardized processes, more often than not with a relatively high risk profile. To test such transactions, (costly) advanced data analytics would be required using tooling which as yet is not available to all auditors. In addition, it would require significant investment for any audit firm to develop such tooling and to train the auditors on how to apply such data analytics procedures. To design and build tools that support advanced data analytics, one would also need to have extensive expertise on the subject, and needs to understand how to perform analyses using automated tools and techniques. Such an ecosystem should combine external subject matter expertise (e.g., the academic world or specialist organizations such as WoodMac, referred to in the example above) with the right tools (e.g., partnerships with Google, Microsoft, IBM etc.) as well as the relevant experience of one’s own organization and the auditor.

Conclusion

The possibility of using data in the audit is not limited to internally structured data only, but also extends to external or even unstructured data. Advanced data analytics using unstructured external data has already proven to be a successful element to incorporate, for example, a continuous risk assessment in the audit, by using the external point of view (e.g., benchmarking) rather than the internal point of view only. We believe that these data categories should not be considered to exist in a vacuum, but should be combined in an overall audit approach, providing valuable, data driven insights into the quality of opinion, quality of insights and quality of execution of the audit. In addition, audit firms are also recognizing that they cannot do this all by themselves, and are building EcoSystems with third parties to be able to jointly transform towards the data driven dynamic audit.