Building the data enabled function of the future - Internal audit digital and analytics survey 2021 - Deloitte
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Building the data enabled function of the future Internal audit digital and analytics survey 2021
Building the data enabled function of the future | Contents
Contents
Foreword 03
Report Structure 05
Executive Summary 07
Current use of analytics 10
The operating model, talent and resourcing 17
Barriers and challenges 23
Future direction and strategy 29
The Internal Audit function of the future 36
Appendix A – About the survey 42
Appendix B – Digital and analytics maturity 44
Appendix C – Definitions and glossary 46
Appendix D – External sources / references 47
Contacts 48
02
Building the data enabled function of the future | Foreword
Foreword
Foreword
eport
R
structure
Executive
summary
Current use
of analytics
The operating
model, talent
and resourcing
Barriers and
challenges
Future direction
and strategy
The Internal
Audit function
of the future
Appendix A –
About the survey
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
03
Building the data enabled function of the future | Foreword
Foreword
We are pleased to welcome you to our latest
eport
R
structure digital and analytics internal audit survey.
Executive
summary
The wider topic of data analytics, A transformation that seeks to enhance the level of We considered the output of this survey in the
Current use impact and influence of internal audit by providing context of previous Deloitte analytics or internal audit
of analytics and the principle of applying assurance more efficiently, advising management more surveys, and drew findings, many of which reinforced
The operating data interrogation or statistical insightfully, and anticipating risks more proactively. earlier messages while others offered interesting new
viewpoints.
model, talent
and resourcing
analysis techniques to increase Functions are realising that to be able to mirror (if
Barriers and
the level of assurance Internal not surpass) the digital maturity of their businesses, Prominent among these are the findings that functions
leverage technology-enabled techniques, and continue with strong impact and influence are embracing digital
challenges Audit provide is, of course, not adding value, they need to evolve and innovate as innovation and new approaches to running Internal
Future direction new. However, in recent years, rapidly as the threats they face. This requires a desire Audit and that most functions are seeking to improve
and strategy to reduce inefficiencies, embrace digital innovation, their data analytics capabilities and have plans in place
it has gained growing attention leverage the power of data and adopt a focus to do so. We thought it would be intriguing to validate
The Internal
Audit function by Board Audit Committees and on to the future. these hypotheses.
of the future
Chief Audit Executives (CAEs) and We surveyed over 50 organisations that operate in At this point we would also like to thank our clients who
Appendix A –
About the survey
has been broadened as a topic to the UK, across various industry sectors, size, audit took part in this survey, either via virtual interviews, or
maturity, seeking to get a better understanding of the by utilising our online survey tool. Their openness and
ppendix B –
A
align to the wider data and digital maturity of capability, the vision and approaches to candour, particularly when highlighting weaknesses,
Digital and transformation of the Internal building (or acquiring) such capability and some of the barriers or their ambitions to transform their
analytics maturity key lessons they have learned along the way. functions, was greatly appreciated.
Audit function. Many of these organisations are going through digital
ppendix C –
A
transformation, including in their Internal Audit We hope you find the content stimulating and helpful
Definitions and
function. They candidly shared views on the current in your own journey and we look forward to hearing
glossary
state of their “maturity”, the significant challenges they your views on the key points underlined by the survey.
Appendix D – are facing with the pace of change, cultural adoption,
External sources / the scarcity of skilled resources and openly shared
references their aspirations.
Contacts
04
Building the data enabled function of the future | Report structure
Report
Foreword
eport
R
structure
structure
Executive
summary
Current use
of analytics
The operating
model, talent
and resourcing
Barriers and
challenges
Future direction
and strategy
The Internal
Audit function
of the future
Appendix A –
About the survey
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
05
Building the data enabled function of the future | Report structure
Foreword
eport
R
structure
Executive
Current use of analytics The operating model, talent and Challenges and barriers Future direction and strategy The Internal Audit function of
summary
resourcing the future
xploring themes such as what is
E his section explores the key
T his chapter explores the answers
T
Current use
the current state of play, and how Key questions that will be explored challenges or barriers that may to the “why now?” questions. e provide our perspectives on
W
of analytics
the use of digital and analytics in this section relate to talent, prevent organisations from using It focuses on strategic direction, the effective use of digital assets,
The operating compares across sectors and size reporting lines and organisational analytics further. key priorities for Internal Audit analytics and solutions as part of
model, talent of organisations? structure for digital and analytics functions over the next 3-5 years. the organisations’ journey to build
and resourcing
teams. It also provides perspectives and the next generation of Internal
Barriers and hat is the more typical use of
W comparatives from organisations It discusses the investment for Audit as a function well attuned to
challenges tools and techniques, across What skillsets are organisations across sectors and sizes, while future maturity enhancement the challenges of emerging risks,
which lifecycle stages, and how looking for in order to respond also discussing insights across the and development, and how we technologies and ‘disruption’.
Future direction
pervasive are advanced and to the challenges? Which types industry. see this translating into digital
and strategy
cognitive automation technologies of operating models do we find transformation initiatives and We debate what effective digital
The Internal in Internal Audit? evolving? ow do you “embed” analytics
H technology enablement projects. and analytics means, what drives
Audit function effectively, and how important is a value, and how this value can be
of the future ow do “smaller functions” embed/
H How do functions incentivise the data and analytics culture. measured.
Appendix A – apply analytics effectively to drive adoption of analytics and digital?
About the survey optimum value? We have aligned our point of view
to the Deloitte Internal Audit 3.0
ppendix B –
A
blueprint which is designed to
Digital and
analytics maturity “We provide our perspectives on the effective use of digital assets, analytics and solutions as provide a structure to organisations’
transformation pathways, seeking
ppendix C –
A part of the organisations’ journey to build the next generation of Internal Audit as a function to bring a culture of innovation,
Definitions and
glossary well attuned to the challenges of emerging risks, technologies and ‘disruption’.” helping functions keep pace with
technological change, and enhance
Appendix D – their impact and influence across
External sources / the organisation.
references
Contacts
06
Building the data enabled function of the future | Executive Summary
Executive
Foreword
eport
R
structure
summary
Executive
summary
Current use
of analytics
The operating
model, talent
and resourcing
Barriers and
challenges
Future direction
and strategy
The Internal
Audit function
of the future
Appendix A –
About the survey
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
07
Building the data enabled function of the future | Executive Summary
Foreword With COVID-19 impacting every We ran a well received survey across Internal
Audit Data Analytics functions in 2015, focusing on “Through our work with Internal
eport
R aspect of the work environment,
structure
many functions are considering
the relative maturity of the functions. We asked
questions such as how to embed analytics effectively Audit functions across a number
Executive
summary deploying digital technologies
in an Internal Audit function, what is the most
appropriate operating model and what is the of sectors we have recently seen
Current use
of analytics
to become more resilient, cost- strategy for the future.
a notable growth in the use
effective and smarter about
The operating
providing services that make an
Through our work with Internal Audit functions across
a number of sectors we have recently seen a notable of tech-enabled and analytics
model, talent
and resourcing
impact. We thought it is a great
growth in the use of tech-enabled and analytics
practices, particularly – but not exclusively – for practices”
Barriers and
challenges
time to explore the above across larger and more digitally mature functions. As one
would expect, there are still a number of areas that
Future direction
the industry and provide some organisations struggle with, particularly in terms of “Data analytics” could form a part of such broader
digitisation agendas but relate to the analysis and
and strategy refreshed perspectives and setting a clear vision or embedding such practices
interrogation of data sets to identify anomalies,
effectively in a way that truly unlocks value.
The Internal insights. trends or potential issues for further investigation.
Audit function The objective is to enhance the level of assurance
For clarity, when we talk about “digital” or
of the future provided by Internal Audit, through higher quality
“digitisation” in the context of our report, we refer
Appendix A – to the integration and embedding of digital assets of evidence, increased depth of testing and
About the survey or enablers to transform and automate existing better indicators for controls issues –
operational processes, and increase the value current and predicted.
ppendix B –
A
Digital and offered to stakeholders.
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
08
Building the data enabled function of the future | Executive Summary
Foreword A summary of our findings and key insights • The vast majority of respondents stated that they Internal audit function of the future
from the survey is presented below. have a clear vision for the future and a strategy for the • Compared to 5 years ago, we noticed that analytics
eport
R
further development of the capabilities in line with the leads are reporting increasingly more to the CAE or
structure
Current state overall Audit function’s strategy and priorities. Head of Internal Audit, or even to the Chief Operating
Executive • In terms of analytics use across audit lifecycle • Some of the key strategic outcomes that functions Officer roles, which indicates that this capability has
summary stages, fieldwork continues to be the most common; are seeking to achieve in this area are to enhance the been elevated in the internal audit agendas as a topic
Current use however, an area that has seen an uptake compared effectiveness of the function by providing a higher of strategic importance for functions.
of analytics to previous surveys is continuous risk assessment level of assurance, as well as to improve auditee • Innovation is key to an effective, evolving and resilient
with 30% of respondents leveraging data analytics to engagement through richer insights and greater use Internal Audit function. Digital innovation should be
The operating better anticipate risk. of visualisation. encouraged across all lifecycle stages or operational
model, talent
• With respect to the types of tools and digital • Larger functions and analytics teams place their processes of the function, and not just as part
and resourcing
technologies applied, all respondents are performing future strategic development focus on the audit areas of fieldwork.
Barriers and descriptive analytics (describing what occurred) around risk assessment, planning, audit committee • While many of our lessons and suggestions from this
challenges closely followed by diagnostic analytics (describing reporting, while for the majority of small or medium survey would not apply similarly to all functions, we
Future direction why something occurred). Cognitive analytics sized functions the focus is on fieldwork. believe that the key principles and success criteria for
and strategy (predicting what will occur) with the use of advanced an effective digital and analytics function include the
analytics technologies, including Artificial Intelligence People and talent adoption of a coherent transformation strategy and
The Internal (AI), appears to be the least used type among • Internal Audit is a people-based service function, and prioritising innovation and a data mindset.
Audit function its ability to get the best out of its human capital will
respondents at 17%. • The real power in Internal Audit digital and analytics
of the future always be a key driver in determining its success. The
• Visualisation tools are some of the most popular in involves a change in mindset; a mindset that is value-
Appendix A – Audit functions, with 87% of respondents reporting trend we are seeing is business auditors being trained driven, forward-looking, more focused on delivering
About the survey the use of tools such as Power BI and Tableau, due on basic analytics to develop further the “purple” business insights to stakeholders than the traditional
to the high impact visualisation adds to reporting as person, combining sophisticated data analysis with compliance-driven Internal Audit mindset of “what we
ppendix B –
A communication skills, business acumen, and political
Digital and well as the relative ease of use and accessibility of have done before”.
visualisation tools. sense. There is also a trend towards decentralised
analytics maturity
or hybrid models, driven by what is referred to the
ppendix C –
A “democratisation” of analytics and technology.
Definitions and
glossary
Barriers and future direction
• It is interesting to find that all of the Internal Audit • The investment in upskilling and training of auditors is “The key barriers to overcome
relatively low cost, offering the opportunity for people
Appendix D –
functions with no analytics capability or teams, have
said they are planning to establish such capability to develop, helping them with career progression, but include lack of access to data,
also allowing them to experiment and innovate within
and inadequate skills and
External sources / in the next 3-5 years. The key barriers to overcome
references include lack of access to data, and inadequate skills the remit of their audit work, which is proven to lead to
increased satisfaction and retention of talent.
Contacts and knowledge within the function.
knowledge within the function.”
09
Building the data enabled function of the future | Current use of analytics
Current use
Foreword
eport
R
structure
of analytics
Executive
summary
Current use
of analytics
The operating
model, talent
and resourcing
Barriers and
challenges
Future direction
and strategy
The Internal
Audit function
of the future
Appendix A –
About the survey
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
10Building the data enabled function of the future | Current use of analytics
Foreword
There are two perspectives covered Figure 1. Driving factors for the use of digital and analytics
What are the key driving factors / outcomes that the function has been aiming to achieve through the use of digital and analytics to date?
eport
R
structure
in this section, the first being the use Improve the Improve the Improve the
90% 100% 100%
Executive
of digital technologies and analytics effectiveness effectiveness effectiveness
across the internal audit lifecyle, and Identify outliers 70% Identify outliers 66% Identify outliers 81%
summary
Improve auditee Improve auditee Improve auditee
Current use the second the type of technologies, engagement
55%
engagement
73%
engagement
72%
of analytics
practices or sophistication of Upskill function 20% Upskill function 53% Upskill function 81%
The operating
model, talent analysis adopted. Access
better data
35%
Access
better data
40%
Access
better data 54%
and resourcing
Improve speed 25% Improve speed 46% Improve speed 63%
It is worth underlining that, while 18% of our participants
Barriers and
reported that they were not using analytics at all, they Automate core Automate core Automate core
challenges process
35%
process 33% process 54%
did have active plans to do so in the future; this contrasts
Future direction to the 2018 CAE survey1 where 25% reported having no Future proof
25%
Future proof
40%
Future proof
63%
function function function
and strategy analytics capabilities at all.
Drive Drive Drive
20% 53% 36%
The Internal collaboration collaboration collaboration
Audit function We asked our survey participants what the key driving
Reduce costs 15% Reduce costs 13% Reduce costs 27%
of the future factors were behind the use of analytics and digital and
what they hoped to achieve, “Improving the effectiveness Provide insights
5%
Provide insights
6%
Provide insights
0%
Appendix A – and hypothesis and hypothesis and hypothesis
of the function through greater assurance coverage” was
About the survey Automate back Automate back Automate back
top of the list with “identifying outliers and unusual items office process
5%
office process
0%
office process
0%
ppendix B –
A for focus” a close second. “Improving auditee engagement Focus on Focus on Focus on
Digital and 0% 0% 9%
through richer insights and greater visualisations” was business outcome business outcome business outcome
analytics maturity also high on the list (Figure 1). Make analysis capabilities/ Make analysis capabilities/ Make analysis capabilities/
0% 0% 9%
offerings transparent offerings transparent offerings transparent
ppendix C –
A
Improve internal process and Improve internal process and Improve internal process and
Definitions and audit management information
0%
audit management information
0%
audit management information
9%
glossary
Number of Internal Audit FTEs Small (20 & 100)
Appendix D –
External sources /
references
Contacts
11Building the data enabled function of the future | Current use of analytics
Foreword Internal audit lifecycle It is revealing to see that 22% of functions are Figure 2. Audit lifecycle
In terms of analytics use across audit lifecycle using analytics as part of their continuous auditing Activities which functions use analytics to support
eport
R
stages, fieldwork continues to be the most common, activities. Continuous auditing or continuous controls
structure
with 96% of respondents with analytics capability monitoring is widely recognised as a mechanism
Executive using analytics to deliver fieldwork activities, such to achieve more efficient and cost-effective audits. During audit fieldwork 96%
summary as validating or applying tests across populations However, should these processes be owned and
Current use rather than sample testing; this too is an increase operated by Internal Audit? During our interviews,
To provide assurance over operational
of analytics from previous survey results of 69% (Figure 2). we heard how departments are acting as an advisor effectiveness of internal controls
72%
The responses related to the use of analytics to to the rest of the business, developing capability that
The operating provide assurance over the operational effectiveness around continuous testing that is then transitioned
model, talent
of internal controls was 72%. An area that has seen a into the First or Second Line of Defence with Internal As part of individual audit planning 61%
and resourcing
small uptake is continuous risk assessment. In 2018, Audit functions, tapping into the output as part of
Barriers and less than one in ten were using data as part of their their broader monitoring activities.
challenges risk assessment activities. Fast forward to 2021 and To develop audit reporting 54%
30% of respondents are leveraging data analytics to
Future direction
and strategy better anticipate risk.
To develop audit
46%
The Internal committee reporting
Audit function
of the future
As part of the annual
41% planning process
Appendix A –
About the survey
ppendix B –
A 30% For continuous
risk assessment
Digital and
analytics maturity
For continuous
ppendix C –
A 22% auditing
Definitions and
glossary
During quality
Appendix D – 15% assurance process
External sources /
references
Contacts
12Building the data enabled function of the future | Current use of analytics
Foreword Applications and tools This supports our point of view that organisations still Figure 3. Digital tools and technologies
With respect to the types of tools and digital have plenty of unexplored opportunities to innovate What type of digital and analytics tools are used within the function?
eport
R
technologies applied, all respondents are performing via the use of smart tooling and digitise their functions.
structure
descriptive analytics (describing what occurred) By keeping an eye out for the “art of the possible”,
Executive closely followed by diagnostic analytics (describing they should consider bringing more automation and Visualisation 87%
summary why something occurred) at 67%. Cognitive analytics digitally enabled practices into everything they do.
Current use (predicting what will occur) appears to be the least
of analytics used application with only 17% of functions exploring Simple 76%
analytics
The operating
the use of more advanced techniques.
“Our 2015 survey showed
model, talent
and resourcing
Our 2015 survey showed that only a third of respondents
were using visualisation tools; we were now interested to that only a third of Intermediate
analytics
52%
Barriers and
challenges
see a significant change with visualisation tools at the top
of the list with 87% of respondents reporting the use of respondents were using
visualisation tools; we
tools such as Power BI and Tableau. This is likely due to Machine
Future direction learning
48%
and strategy the high impact visualisation adds to reporting as well as
The Internal
the relative ease of use and accessibility of visualisation
tools and is consistent with some of the key drivers for were now interested to Advanced 48%
Audit function
using analytics and digital noted, specifically improving
see a significant change
analytics
of the future
auditee engagement through richer insights and
Appendix A –
About the survey
greater visualisation.
with visualisation tools Process
mining
22%
ppendix B –
A
Digital and
Unsurprisingly, the use of “simple” analytics,
mostly through the use of tools such as Microsoft’s at the top of the list with
analytics maturity Excel spreadsheet tool is still prevalent (76% of
respondents). Other notable references of common 87% of respondents RPA 20%
ppendix C –
A
Definitions and
glossary
tools included SQL, Python, Tableau and R. Robotics
Process Automation (RPA) and process mining tools reporting the use of tools
Appendix D –
showed lower levels of adoption and use with only 18%
and 16% of respondents respectively applying tools such as Power BI and
Tableau.”
External sources / and techniques in these areas. See also Figure 3.
references
Contacts
13Building the data enabled function of the future | Current use of analytics
Foreword In terms of analytics applications across audit or risk
areas, the top three areas are financial risk (with 85%
Functions we spoke to did not see budget as a barrier
to innovate through digital and analytics. Open source “By keeping an eye out for
eport
R
structure
of participants stating they had used analytics to
support the assessment of financial risks), operational
technologies, software already used in the rest of the
business and even Microsoft Excel can be leveraged the ‘art of the possible’, they
Executive
summary
(80%), information/data and technology risk (63%).
This is somewhat expected as these are data rich,
in order to test hypotheses without having to spend
allocated budget on something that may not return should consider bringing more
Current use
of analytics
high yield areas and common focus areas for Internal
Audit. We observed lower levels of use in areas such as
a favourable result. Especially in cases where there is
a dedicated team aligned to analytics, any downtime automation and digitally enabled
The operating
regulatory and compliance (41%), cyber security (35%),
where arguably these can be seen as second line
between audits is spent prototyping and exploring
new areas of analysis limiting the cost to the function. practices into everything they do.”
model, talent
responsibilities but given the expectations on Internal
and resourcing
Audit to play more of an advisory role and for better We were also interested to hear about instances where
Barriers and integration across the first and second lines, there are Internal Audit was leading the digital innovation within
challenges opportunities to broaden risk coverage (Figure 4). the business. New technologies implemented in the
function (such as Process Mining, continuous auditing or
Future direction
and strategy visualisation) are adopted by the first and second lines
of defence. Internal Audit functions are demonstrating
The Internal to their organisations that a lot can be achieved using
Audit function
simple, easily accessible inexpensive tools.
of the future
Appendix A –
About the survey
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
14Building the data enabled function of the future | Current use of analytics
Foreword Figure 4. Analytics for key risks
What types of risks does the function use analytics techniques to assess?
eport
R
structure
Executive
summary 15% 28%
Data privacy
Programme & GDPR
Current use
of analytics
The operating
model, talent
and resourcing 26% 28%
Investigations Culture
Barriers and 85%
challenges
Financial 54%
7% Fraud risk
Health &
Future direction
and strategy
safety
13%
Emerging
The Internal technologies
Audit function
of the future 35%
Cyber security
Appendix A – 80%
About the survey Operational
ppendix B –
A 13% 63% 48% 20%
Digital and Strategic Financial crime Follow up
IT
analytics maturity
ppendix C –
A
Definitions and
15% 41%
glossary Regulatory
Governance
33% 11% & compliance
Appendix D – Conduct Sustainability
External sources /
references
Contacts
15Building the data enabled function of the future | Current use of analytics
Foreword
eport
R
structure
What we have learned
Executive
summary
The adoption of analytics by Internal Audit is increasing
in the areas that matter and are set to have the biggest
While effective analytics are not driven by the
technology itself, a minimum investment to grab the “There are inexpensive ways and
Current use
impact. However, there is still room for improvement
when it comes to adopting digital technologies and
opportunity of advanced technologies or analytics
should be encouraged. Our survey shows that the technologies to experiment with
of analytics
The operating
continuous auditing approaches. Digital innovation
should be applied across all lifecycle stages or
opportunity hasn’t been fully tapped regarding
advanced analytics. It has huge potential to and significant benefits to be
model, talent
and resourcing
operational processes of the function, and not just
in “doing the testing”. It should cover approaches to
revolutionise organisational processes more broadly,
power predictive analysis, risk identification and gained, regardless of the amount
Barriers and
challenges
Internal Audit planning, execution, and reporting,
in stakeholder relationships, and even in the
insight generation. Many of our respondents
have proven that there are inexpensive ways and of the investment, size or maturity
Future direction
mission and remit of the function, which is not only
to provide assurance, but also to advise management
technologies to experiment with and significant
benefits to be gained, regardless of the amount of the function itself.”
and strategy
and anticipate risks. of the investment, size or maturity of the
The Internal function itself.
Audit function Most of the tools used are common, easily accessible
of the future and budget friendly that are not necessarily designed
with Internal Audit in mind but can be applied to a
Appendix A –
About the survey variety of problems or data scenarios. Functions that
innovate can achieve a great deal by using what is
ppendix B –
A available to them without spending large amounts of
Digital and budget on the latest and most expensive tools. There
analytics maturity
is still a great opportunity for functions that are not yet
ppendix C –
A doing much by way of analytics to start small, use the
Definitions and tools available, innovate and add value incrementally.
glossary
Appendix D –
External sources /
references
Contacts
16Building the data enabled function of the future | The operating model, talent and resourcing
The operating model,
Foreword
eport
R
structure
talent and resourcing
Executive
summary
Current use
of analytics
The operating
model, talent
and resourcing
Barriers and
challenges
Future direction
and strategy
The Internal
Audit function
of the future
Appendix A –
About the survey
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
17Building the data enabled function of the future | The operating model, talent and resourcing
Foreword Reporting lines Figure 5. Internal Audit Analytics Reporting Lines
Our previous survey of internal audit analytics2 Where does the Head of Audit Analytics (or equivalent) report to?
eport
R
showed that for the vast majority of our respondents,
structure
the audit analytics capability or team was led by 7%
Executive the Head of Data Analytics, or equivalent, which Head of Innovation/
summary Transformation/
in turn reported to the Head of Technology Audit. Governance
Current use This survey identifies that there has been a notable
shift in where responsibility sits. While for 43% of
of analytics
respondents, analytics still sit under the broader remit
10%
Chief Operating
The operating of the Head of IT Audit, we are now are seeing 40% of Officer
model, talent
organisations’ analytics leads reporting directly to the
and resourcing
CAE or Head of Internal Audit, and a further 10% to
Barriers and the Chief Operating Officer (Figure 5 and 6).
challenges
Future direction
and strategy
The Internal
Audit function
of the future 43%
Head of IT Audit
Appendix A –
About the survey
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references 40%
Chief Internal
Contacts Audit
18Building the data enabled function of the future | The operating model, talent and resourcing
Foreword We believe that the reporting lines to CAE or Figure 6. Innovation / transformation roles and size of function
Innovation roles reflect a significant trend that aligns Where does the head of audit analytics (or equivalent) report to?
eport
R
to the broader messages from our recent Chief Audit
structure
Executive survey. Firstly, the increased number of
Number of Internal Audit FTEs
Executive organisations with Analytics teams directly under the Large (>100) 18% 9% 9% 9% 55%
summary CIA indicates how this capability has been elevated
Current use in the internal audit agendas as a topic of strategic Medium
importance for functions. 55% 18% 27%
of analytics (>20 &Building the data enabled function of the future | The operating model, talent and resourcing
Foreword Operating model Most of our survey respondents do not use resources Figure 8. Functions that supplement their digital
A centralised approach remains the most popular or skills outside their Internal Audit team (54%). and analytics capabilities with external support
eport
R
operating model across Internal Audit functions, with However, from the organisations that do supplement
structure
over half of respondents organising themselves with their capability with external resources or skills, 62%
Executive a central specialist analytics team that perform the (or 33% of total respondents) procure co-source
summary majority, if not all, of analytics activities (Figure 7). This internal audit services, while 21% (11% of total) are 33% External /
54% None
Current use model is followed, in popularity, by a hybrid model supported by professionals from other lines of Co-source Support
33% External /
(43%) whereby business auditors run most of analytics defence in their organisation (Figure 8). 54% None
of analytics Co-source Support
(largely basic tasks) with support from centralised
The operating Centre of Excellence teams, as required, and primarily Figure 7. Operating model
model, talent
on advanced and more technical areas. What is the current operating model for
and resourcing
digital and analytics?
Barriers and Talent
challenges The majority of the survey respondents (55%) have
a dedicated analytics team within the Internal Audit
7%
Future direction Decentralised
and strategy function with specialised skills. This increases to 69% 7% 9% Other
7% Second Line
of Defence
Decentralised 7% Second Line
across Financial Services (FS) organisations. Those 9% Other
of Defence
The Internal that do not have dedicated team members generally
Audit function
use resources from within the broader Internal Audit
of the future
team or external resources. All Internal Audit functions
Appendix A – that have no analytics capability, have said they are
About the survey planning to establish such capability in the next
3-5 years. More than half of these, also consider
ppendix B –
A
Digital and using external service providers or providing analytics
4% First Line
analytics maturity training to current team members to strengthen of Defence
their analytics capabilities. 4% First Line
ppendix C –
A of Defence
Definitions and
glossary
Appendix D –
External sources /
references
Contacts 43% 50%
Hybrid Fully centralised
43% 50%
Hybrid Fully centralised
20Building the data enabled function of the future | The operating model, talent and resourcing
Foreword In terms of skills, the percentage of auditors with basic Over half of the decentralised or hybrid functions have Figure 9. Training and operating model for analytics
analytics skills is relatively low with three quarters trained more than 40% of their business auditors, Percentage of the Internal Audit function that has received training, and the
eport
R
of organisations reporting this figure as below 40%. while only 20% of the centralised have reached that analytics operating model of the respondent organisations.
structure
However, in functions that operate a hybrid or level. See also Figure 9.
Executive decentralised model this figure rises to 80%.
summary What has also been particularly intriguing, especially No training 20%
Current use We believe this is explained primarily if we compare the results to our 2015 survey, is the
of analytics through three key reasons: increased use of incentives encouraging the uptake of
• one, the increased exposure to analytics analytics. Indeed, 58% of respondents have embedded 1-20% 13% 3%
The operating work through their day to day audit work targets within the performance objectives or the
model, talent
• two, the more frequent and structured training that evaluation approach for their audit leads or Heads of
and resourcing
such functions provide to their business auditors Audit – 37% of which are formally established. For 7% 20-60% 3% 13% 20%
Barriers and (refer to Figure 9) of organisations, there are plans to implement such
challenges • the third reason is increased use of analytics self- measures in the near future. It needs to be highlighted
Future direction serve techniques and tools used by functions with that this also applies to many smaller Internal Audit >60% 3% 17% 7%
and strategy hybrid models, including pre-configured testing functions (Building the data enabled function of the future | The operating model, talent and resourcing
Foreword
eport
R
structure
What we have learned
Executive For all the debate around digital enablement, advanced Second, the trend we are seeing is business auditors What will be important is to ensure technical teams
summary technologies and the impact of these on the internal being trained on basic analytics to develop further develop their audit and business understanding as
audit function, Internal Audit is a people based service the “purple” people / auditors, combining sophisticated well as soft skills, around influencing, coordinating,
Current use function, and its ability to get the best out of its human data analysis skills or “red skills,” with communication collaborating and communicating with others in
of analytics
capital will always be a key driver in determining its skills, business acumen, and political sense or “blue the organisation, often outside the function itself.
The operating success. Individuals are at the heart of internal audit skills”. There is also a trend towards decentralised The strength and the value in the function will come
model, talent analytics functions and whilst having the right tools or hybrid models, driven by what is referred to the from the power of collaboration, the intersection
and resourcing and maturity of approaches will be important, having “democratisation” of analytics and technology. between diverse skills, experiences and thinking that
Barriers and the right people and skills in the right role will be Analytics shouldn’t be the privilege of the few anymore. fosters innovation and leads to new insights and value.
challenges crucial. But what are the skills and traits that define a An approach that focuses on the combination of training
successful digital and analytics strategy? The continued and clear targets or incentives that drive additional Any internal audit recruitment seeking to support
Future direction technological advancement and the ever increasing use of analytics is proven to help to that end. innovation capability and culture should also cast a
and strategy
pace of change, would mean that the need for a core wide recruitment net by actively targeting experience
The Internal specialist team of digital and analytics experts will Third, by encouraging teams to experiment, identify that could disrupt and innovate within the function
Audit function remain. For larger or more advanced functions, this and explore the “art” of technology enablement; as (refer also to our recent paper “Optimising internal
of the future translates into a recruitment challenge given the people become more comfortable with automation and audit; Developing top flight teams”). For example,
scarcity of these skills in the market. artificial intelligence, as they collaborate closely and on product designers may help the function revitalise
Appendix A –
About the survey a day-to-day basis with “purple” people, they get more the stakeholder experience or rethink how it
The approach to overcome this challenge includes opportunities to experiment and fail, learn, develop communicates through audit reports. The “purple”
ppendix B –
A the following three strands: themselves and help deliver tools or approaches that person, as we mentioned earlier, would be key in
Digital and First, procuring skills outside of the internal audit improve productivity and audit quality3. innovation roles given their intellectual curiosity in
analytics maturity
profession, bringing in data scientists, digital both enabling technologies and internal audit and
ppendix C –
A transformation experts, developers, to establish a core The investment in upskilling and training of people we expect they will be critical to moving the dial on
Definitions and ‘development’ factory and technical skillset and then is relatively low cost and easier options for functions the function’s ability to anticipate risk. For example,
glossary upskilling them in audit practices. This is encountered (particularly smaller or cost-conscious ones), offering “purple” people will help functions embrace practices
Appendix D – mainly in functions with Innovation capability and the opportunity for people to develop, helping them such as real-time risk assessment, continuous
External sources / larger R&D budgets. Most commonly however, we see with career progression, but also allowing them to controls testing, and tools such as automation
references upskilling programmes and training initiatives for core experiment and innovate within the remit of their audit and artificial intelligence3.
data analytics staff covering areas such as advanced work, which is proven to lead to increased satisfaction
Contacts
analytics, programming languages (Python, R etc), new and retention of talent.
approaches etc.
22Building the data enabled function of the future | Barriers and challenges
Barriers and
Foreword
eport
R
structure
challenges
Executive
summary
Current use
of analytics
The operating
model, talent
and resourcing
Barriers and
challenges
Future direction
and strategy
The Internal
Audit function
of the future
Appendix A –
About the survey
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
23Building the data enabled function of the future | Barriers and challenges
Foreword Whilst the increase in the use Figure 10. Key barriers
What are the key reasons / barriers currently preventing the function using digital and analytics?
eport
R
structure
and application of analytics is Access to Access to Access to
63% 65% 82%
Executive
notable in our survey, there appropriate data appropriate data appropriate data
are still a number of areas that
Skills & Skills & Skills &
summary 52% 71% 82%
knowledge knowledge knowledge
Current use organisations struggle with as Capacity 59% Capacity 65% Capacity 45%
of analytics
part of the journey in developing Access
30%
Access
29%
Access
18%
The operating to tools to tools to tools
model, talent their digital and analytics strategy Not knowing Not knowing Not knowing
15% 0% 0%
and resourcing
or delivering on their priorities in where to start where to start where to start
Insufficient Insufficient Insufficient
Barriers and
challenges
a way that truly unlocks value. budget
11%
budget
12%
budget
9%
Role & Role & Role &
11% 12% 9%
Future direction The top three barriers described as preventing remit remit remit
and strategy the use of analytics and digital across all respondents Lack of Lack of Lack of 0%
4% 12%
are (Figure 10): support support support
The Internal
Audit function Access to 4% Access to 6% Access to 9%
01. Access to appropriate data outside skills outside skills outside skills
of the future
02. Skills and knowledge within the function Not a Not a Not a
4% 6% 0%
Appendix A – 03. Capacity within the function
priority priority priority
About the survey Data Data Data
0% 6% 0%
loss risk loss risk loss risk
ppendix B –
A
Reputational Reputational Reputational
Digital and risk
4%
risk
0%
risk
0%
analytics maturity
Data Data Data
0% 0% 9%
ppendix C –
A culture culture culture
Definitions and
glossary Number of Internal Audit FTEs Small (20 & 100)
Appendix D –
External sources /
references
Contacts
24Building the data enabled function of the future | Barriers and challenges
Foreword To add more perspective, smaller functions or the Figure 11. Data Sources and Data Access Model
ones that have not started integrating analytics into What sort of data sources do functions perform analytics over?
eport
R
their audits, cite capacity and lack of resource/skills as
structure
their key barrier. The larger or more mature functions Structured Unstructured Third party data
Executive list access to appropriate data as their biggest barrier.
summary 100%
Current use The challenges around the skills, capacity and
of analytics resourcing have been discussed also in the previous
chapter alongside with some perspectives on the
The operating future direction, as well as key actions on skills
model, talent
development, training and recruitment.
and resourcing
39%
Barriers and Interestingly, only one function reported “data
challenges culture” or the lack thereof, as a barrier. This is yet
another revealing result as it could point to a shift in 17%
Future direction
and strategy mindset within functions to confidently apply the use
of data and analytics. The key obstacles seem to be
The Internal operational in nature, and therefore possibly easier to
Audit function
overcome. We didn’t notice any significant volume of
of the future Social media Other data sources
responses or notable references to culture, leadership
Appendix A – and top-down approach that may inhibit further
About the survey development of analytics capabilities.
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources / 9% 9%
references
Contacts
25Building the data enabled function of the future | Barriers and challenges
Foreword Figure 12.
What is the data access model in use?
eport
R
structure
Executive
summary Data extracts Team size Medium
70% 55% 80% Large (> 100) 82%
from business Small ( 20 & 20 & 100)
Dedicated IA Small ( 20 &Building the data enabled function of the future | Barriers and challenges
Foreword Access to data is the most prevalent barrier with 61% acknowledge the need to evaluate the quality Figure 13.
many respondents appearing to be heavily reliant on of data before use, which compares to 50% noted Do you independently evaluate the quality of the data before
eport
R
business or IT to provide the data they need. Indeed, in 2015. Given the importance in data quality, running analytics?
structure
70% of respondents list this as their main source of this is something that most functions still need to
Executive data. Direct access and feeds from business systems assess before the audit, and depending on the
summary were still prevalent, with 52% and 61% respectively, need for cleansing this is still reported as a challenge 39%
Current use but very few functions reported having their own for functions. No
of analytics dedicated data servers or data warehouse for internal
audit (17%). Having a dedicated data warehouse may We would encourage functions to explore more
The operating not be necessary for most functions but access to opportunities to use data external to the organisation,
model, talent
the right data and within the right timeframe is for example, scraping data from news sites, social
and resourcing
paramount to the effective and sustainable media that can be used to identify emerging
Barriers and embedding of analytics. We did also note that reputational risks.
challenges identifying the right data owners, especially in
Future direction larger organisations, was a key challenge. There are numerous use cases that support the
and strategy innovative use of non-traditional data sources to
The Internal “61% acknowledge the provide insight and perspective that would not have
been achieved in the past. We have seen some
Audit function
of the future need to evaluate the analytics teams making effective use of such external
data, seeking to utilise all available data sets – third
Appendix A –
About the survey quality of data before party sold or publicly available - to evaluate the
external or market environment, make predictions or
ppendix B –
A
Digital and
use which compares to assess inherent risk without restricting themselves
simply to the use of organisation-derived data.
61%
analytics maturity
50% noted in 2015.” Yes
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
27Building the data enabled function of the future | Barriers and challenges
Foreword
eport
R
structure
What we have learned
Executive
summary
Without a doubt, access to data • It is important that Internal Audit is aligned with
the data governance practices that exist within “Data quality is a key
is a sensitive and tricky process,
Current use
requiring internal auditors to
the organisation, establishing the relationships
with the data owners and making sure the needs consideration here as this is
of analytics
The operating know what exactly they need
of Internal Audit functions are considered when
defining and cataloguing data for use. Data where quality requirements
model, talent
and resourcing
to access, for which periods quality is a key consideration here as this is where
quality requirements are likely to be defined at an are likely to be defined at an
and where data is hosted,
Barriers and
challenges while making sure security and
organisation level.
• For larger or more data-mature organisations, once organisation level.”
data is identified, it is worth considering automating
Future direction confidentiality is maintained and collection of data through data feeds, obtaining access
and strategy
that data is only used for its to organisations data lakes or establishing servers
The Internal dedicated to Internal Audit, where this is feasible. We
Audit function intended process. This can be acknowledge that this is no simple task but, if done
of the future
a challenging task. So, what can right, has proven to save hours of time and effort later,
safeguard quality and ultimately speed up the time to
Appendix A –
About the survey
functions do to make this easier? deliver quality output.
• For smaller organisations or functions, we believe
ppendix B –
A they should start small and scale slowly, especially if
Digital and this is new area to the function, starting with one data
analytics maturity
source at a time. They need to ensure that access to
ppendix C –
A data is repeatable and automated, where possible,
Definitions and and keep building over time to make the process more
glossary manageable and less overwhelming.
Appendix D –
External sources /
references
Contacts
28Building the data enabled function of the future | Future direction and strategy
Future direction
Foreword
eport
R
structure
and strategy
Executive
summary
Current use
of analytics
The operating
model, talent
and resourcing
Barriers and
challenges
Future direction
and strategy
The Internal
Audit function
of the future
Appendix A –
About the survey
ppendix B –
A
Digital and
analytics maturity
ppendix C –
A
Definitions and
glossary
Appendix D –
External sources /
references
Contacts
29Building the data enabled function of the future | Future direction and strategy
Foreword It was encouraging to see that, Figure 14. Vision and Strategy for the future and size of the Internal Audit function
Do you have a clear vision for the future use of digital and analytics within the function?
eport
R
structure
from the surveyed organisations
with dedicated teams, the vast
Vision for the future – Number internal audit of FTEs Strategy for the future – Number internal audit of FTEs
Executive
summary majority have a clear vision for
Current use the future (79%) and a strategy 15% No
of analytics
for the further development of
The operating Small ( 100)
Appendix D –
External sources /
references
Contacts 23% Yes 21% Yes
30Building the data enabled function of the future | Future direction and strategy
Foreword Figure 15.
Is the strategy aligned to the broader function priorities?
eport
R
structure
Executive
Strategy alignment for the future – Number of internal audit FTEs 2%
They have a plan but
summary 21% Yes no alignment to the
function’s strategy
Current use 24%
of analytics They have no plan and
no alignment to the
The operating Small ( 20 & 100) 74%
External sources / They have a plan which is aligned
to the function’s strategy
references
Contacts
21% Yes
31Building the data enabled function of the future | Future direction and strategy
Foreword In terms of outcomes that the functions are aiming to Figure 16. Outcomes that the function is aiming to achieve through
achieve through delivering on their strategic priorities future use of digital and analytics (next 3-5 years)
eport
R
in this area and the future drive on digital and
structure
analytics, these were (Figure 16):
Improve the effectiveness of the function
Executive 89%
through greater assurance coverage
summary 01. Firstly, (Figure 16) the overall effectiveness
of the function through enhanced level of
Current use assurance and better identification of true Improve the speed of the function 67%
of analytics issues and outliers (84% of FS organisations
The operating quoted this objective, and 89% overall)
model, talent 02. The second factor was to improve the speed To automate, for example, core process enable the function
to spend more time on greater value adding activities 65%
and resourcing of the function (67% quoted this objective)
Barriers and 03. Third, the need to increase automate core
challenges processes (65%) Upskill the function 59%
Future direction 04. Upskill the function (59%)
and strategy
Improve auditee engagement through richer
Improve access to data as well as to improve insights and greater use visualisations 57%
The Internal
Audit function auditee engagement through richer insights
of the future and greater use of visualisation were additional
Identify outliers and unusual items
focus areas. FS organisations quoted in particular the to focus on highest risk areas 54%
Appendix A – need to “future proof” the function (48%). In fact,
About the survey Internal Audit functions that had invested in analytics
ppendix B –
A prior to the recent crisis seem to have been able to To reduce costs within the function 52%
Digital and better withstand the effects of the pandemic and
analytics maturity continued to provide assurance services effectively.
Gain access to better data from the
ppendix C –
A business to inform planning process 48%
Definitions and Interestingly, reduction in costs did not feature
glossary significantly in the responses, with functions
appreciating that some investment would be Future proof the function 48%
Appendix D – necessary and that the key objective is enhancing
External sources /
impact and influence and not necessarily squeezing
references
costs – at least in the short term. Drive collaboration with
39%
Contacts first and second line
32You can also read
