The future of Internal Audit - Data Analytics?

I’ve recently been given a task of talking about the future of the audit function to a number of institutions, from global fund managers to domestic retail banks. Whilst I was initially surprised that the ‘data guy’ was allowed out to speak on this, I think this was because if you asked most chief auditors what they see as the future of the audit function, they would probably say data analytics. You would probably expect me to jump on this and say yes – this is true, and immediately wax lyrical about data analytics.

But I’ve always been a believer in the contrarian view, and as some of you know, never really followed the norm.

I loved doing these talks though because the attendees made me think. What will audit teams look like in the future when we are all driving autonomous bubble cars, living on the moon, and working three day weeks? I was asked some really challenging questions about the size of the future audit function, the skills required in those audit functions etc. But standing in front of rooms full of the amazing bright people in our client teams, I had to have a credible answer. I had read lots of publications about the future of the industry, all valid and sensible, but none of it really deeply resonated on a practical level with me because none of it talked about being a successful audit function. So here’s what I came up with:

• Skills & Knowledge: When I started in (public sector) external audit, doing really tedious accounts audits, it was clear to me that the ledger did a lot of the work, even back then. And so the trend that the computers do the work is probably going to continue. Lucky thing, in a post-Enron world, we now have a lot more IT auditors out there. We will need more of them as the computer says’ yes’ or ‘no’ more often in decision making. We will probably need a deeper IT skill base, like seasoned testers, developers, analytics specialists, and for models, quants. These specialists will give a much greater depth to our conclusions. They may not be natural auditors, so we will need to structure our teams with people who can take their ‘techie’ outputs, land the issues, and communicate it in an audit report. We will also need to think about our people strategy - how on earth do we get these talented people to come to internal audit? We all know it’s a great career, but the external perception of a career in audit isn’t always that great.
• Efficient: I had the real pleasure of having an all-expenses paid trip to Marbella badged as ‘annual training’ over a decade ago. Sadly, no one has given me a free boozy week since. I guess this is because of the 2008 crash, and (i) increasing profit margins is now driven more than ever before by reducing costs, and (ii) public perception of banks and large corporates is pretty dire so ‘flashing the cash’ is rightly frowned upon. So we will need to continue to do more with less. Of course, it is right that an audit function should in some fashion set an example to the rest of the business. Do remember if you want to get the most out of your people, you cannot pour a pint into a half pint glass; that few people like working for a stingy business, and recruiters are phoning your teams daily with offers of pavements lined with gold. To retain and get the best out of our people we will need to give them more than a salary and a job, we will need to give them a purpose and a vision. I was a reservist for many years when I was younger and I can tell you I’ve chronically missed the very dear friendships, comradery and sense of purpose ever since.
• Influence: Last but most important. Where I have observed audit at its best is where the function has sufficient influence to support and guide real change in an organisation. Having learned from painful personal experience, few people will believe you because of your technical credentials, your position, or your years of experience. Degrees are just expensive ways into interview rooms. Whilst this can build credibility, people only really believe you when they trust you as a person. We have all experienced executive leaders and committees where there’s lots of game playing, backstabbing etc. But good emotional intelligence goes a long way in navigating these obstacles. Audit leaders must rise above it all. Audit leaders must have empathy, listen and to understand the challenges their stakeholders face. This is time proven advice to build trust, and something that only comes with experience. Barack Obama said to his children something like ‘Whatever you do in life, just be useful to someone’ which is brilliant advice that I tell my kids. I don’t think we acknowledge enough that execs and senior leaders have tough jobs. They need realistic, practical support on a timely basis. Is your report really a ‘red’? Is it good for your business to watch a potential disaster evolve and then three months later, after your audit team have poured over the intricate and unnecessary detail in working papers, and a report, finally conclude after the event that the project could have done better? Be helpful to them when you can. After all it must be nice sitting in our ivory tower often getting paid six figure salaries just to say ‘I told you so’.

I know its vitally important as auditors to maintain our independence. However if we all work for the same company, are we not therefore all on the same team? I do think being supportive, responsive, and flexible to your stakeholders needs, yet still maintaining your independence can be done. So yes, I think the audit function can and should do advisory work, it can and must audit strategy. Culture can make or break an organisation, so make sure this is more than a one-off on your audit plan. If there’s one thing I recommend you do, please move to a flexible reporting model to deliver assurance conclusions in real time. My brilliant and talented team is working with a retail bank right now on a redress project. They are partnering with them in real time, delivering independent post testing assurance over the data extracts and the compensation calculations. We need to raise what we find as soon as we find it, or the project wont hit its deadlines. That means we need to work hand in glove with the test and development teams to identify the root cause quickly, and be an integrated, trusted, part of the programme. It works. Don’t be hamstrung by your methodology, re-write it if needs be.

So the future of audit isn’t data, it is people. Aim for a diverse, strong, and cohesive team that is valued by your stakeholders for thought leadership and a solid contribution to keeping the wheels on. I don’t really know what your function, or any function, will look like in 10, or 20 years. But the good and successful ones will have invested in their people, and have the right skills mix to adapt to the future. The successful audit function of the future will be an integral part of the firm’s executive, and all the various sub committees and divisions by having built trust and demonstrated commercial value. Rather perversely, I look forward to hearing about the audit function that staves off a corporate collapse by having that ‘independent view of risk’, the function that can confidently articulate the contrarian view, and be trusted enough by the senior executives so that they are listened to.

So how do you start building trust and demonstrate commercial value to become the successful audit function of the future? Well, producing compelling audit reports and being valued by our stakeholders sounds simple, but can be very difficult to achieve in practice. So, going back to basics, we all know as auditors that the best way to land issues credibly is with cold hard factual observations. People act much more quickly and decisively on facts and data that they can understand, rather than subjective opinion.

That’s where data analytics comes into its own.