Digital transformation is the buzzword everywhere, but it comes with risks. The journey towards a more creative and innovative environment goes beyond traditional risk, with new areas such as social media or digital resiliency to contend with
For the internal audit function, it’s a scary place: eight of the twelve hot spots for Gartner’s 2019 review of internal audit leaders’ biggest concerns are associated with the ongoing digitalisation of businesses, governments and society. But for those who can embrace change, it presents a powerful chance to increase the reach of the internal audit function within an organisation.
According to a recent report from consultants Protiviti: “Many [companies] are looking squarely at their internal audit team to provide guidance and insight along the journey. Digital transformation is presenting internal auditors with the long-awaited ‘golden opportunity’ to finally become a truly strategic partner to the business.”
Internal audit is uniquely positioned to guide a business through the risks of digital transformation. After all, monitoring and evaluating the effectiveness of an organisation’s risk management system is an Orwellian “Internal Audit 101”; the department exists to find problems.
Critical to this is internal audit’s ability to look across the whole business. The fast-moving world of data analytics gives internal auditors the ability to break down and rebuild information to analyse the risk landscape, according to the Institute of Chartered Accountants in England and Wales (ICAEW).
“It’s challenging, but increasingly internal audit is going to be much more about using data,” says Kirstin Gillon, technical manager in ICAEW’s IT faculty. “It’s not just about skills; it’s a different way of thinking. This is about a mindset, working with effective visualisation to look at all the data.”
It turns traditional audit on its head. Instead of sampling datasets and using statistical extrapolation to reach a conclusion, today’s powerful analytics are about crunching entire populations of data to extract the anomalies. That’s a big shift in thinking for auditors, but makes their work much more understandable to everyone else. High-quality analytics can transform the credibility of internal audits but, conversely, getting it wrong can be bad news.
Internal audit is uniquely positioned to guide a business through the risks of digital transformation
To produce relevant insights requires internal auditors to work closely with colleagues in IT and data analysis, which means absolute clarity on roles and responsibilities, according to the Ms Gillon at ICAEW. Otherwise, it warns, there is a risk the relationship becomes unbalanced and ineffective. “For example, too little involvement from analytics in defining the audit scope can result in inappropriate insights being produced, whereas an over-reliance on analytics to define the testing can lead to the wrong questions being asked or risks being investigated,” the ICAEW says.
Internal audit skills may need to be upgraded to deliver the kind of insights that will guide C‑suite executives through a digital transformation. According to the Intelligent Automation report from consultants KPMG, when it comes to delivering meaningful insights: “Digital solutions, including cognitive technology and intelligent automation, are critical to success.” The report says stronger critical thinking, analytical data science and IT skills are necessary to complement financial and business acumen.
Dutch brewer Heineken has integrated technology through its whole audit plan, according to a case study cited by Protiviti. The audit team is able to spot issues that technology might be able to solve and “help connect business owners with specialists in the company who can provide more guidance”. Jan Joost Bierhoff, director at Global Audit, has a dedicated audit and analytics team actively working to get insights through data-mining. “When we are talking to senior management, we often find we are blowing them away with data insights,” he says.
Internal auditors are now stepping away from their desks and becoming proactively involved with their colleagues, able to offer advice and perspective where necessary. “This is about the culture of the function and it’s challenging to get people to buy into it,” says Ms Gillon at ICAEW.
At energy company Centrica, internal audit now employs data scientists with the team to achieve that step-change in how they think about and use data. It sees a blurring of the roles between accountants and data scientists over the next decade, as accountants learn technology skills while data scientists acquire commercial acumen.
Data analytics’ twin power of insight and automatic identification of risk is set to transform internal audit. According to Protiviti: “For those business leaders who have not yet considered internal audit’s ability to serve as a steady guide through disruptive change, we suggest they embrace that opportunity as they completely rethink how their business operates.”