Embracing Audit Analytics: Q&A with Workiva Expert Corey Wells

One could say that audit analytics is woven into Corey Wells' DNA. Prior to joining Workiva, where he is VP of Partnerships and Alliances, Corey spent 13 years as a partner with a national risk advisory firm. One of his core responsibilities there included leading their national data analytics practice. In his risk advisory role, Wells helped numerous departments either initiate or mature their analytics capabilities. Corey believes that for too long, audit analytics has been viewed as optional. We sat down with Corey and discussed why he now considers audit analytics as necessary for audit teams of the future and how auditors interested in maturing their analytics can pitch it to leadership. 

Key takeaways:

• Increased data complexity has transformed analytics from optional to a must-have—one could argue that NOT including analytics in your audit program is a risk in and of itself
• Launching an audit analytics program can be daunting: start small for some quick wins, which will help you prove early value to leadership
• Mature departments use analytics for real-time audit planning and shifting, across their life cycle; they don’t look at it as just part of one process
• A strong internal audit analytics program can help attract high-caliber talent

How would you define audit analytics? 

From my perspective, audit analytics is basically the use of data analytics anywhere in the audit process. It's leveraging data for different reasons—whether it’s part of your risk assessment process, part of testing, or part of your planning process. Data can be leveraged anywhere throughout the audit process, so any data analysis as it relates to that process is what I would classify as audit analytics.  

Audit analytics isn’t a new concept—so why is it becoming increasingly important to internal audit teams?

Internal auditors have been talking about data analytics for as long as I've been in the profession, which is over 20 years. What’s really changing the game with analytics today, specifically related to audit, is that the complexity of data just keeps increasing. 

There's just so much data—and the data is so complex and the processes are so complex—that without internal audit analytics, it’s like trying to find a needle in the haystack with traditional audit sampling techniques. That’s why it’s transformed to a must-have versus from a nice-to-have. 

Another reason it's so critical today is that external auditors have incorporated analytics as part of their standard audit methodology. You don't want to be in a situation where your external auditor is finding issues with your data or uncovering problems that you weren't able to.

Is there risk for audit teams who are hesitant or unwilling to invest in analytics? 

The mandate of a chief auditor and of an internal audit department is to help identify and mitigate risk while ensuring the company is mitigating risk. So, in the absence of data analytics, the likelihood of being unable to identify existing problems becomes much higher. 

Do you know what keeps a chief audit executive up at night? It’s the possibility of something happening within the organization that no one knows about. When that happens, the CEO and the board start asking questions of internal audit: Why weren't you aware of this? Why weren't you looking at this? Why didn’t you make us aware that there was a problem here, that we had a lapse of control? 

Unfortunately, the way control testing works is that you don't know if there's a lapse in control until an event occurs. Data analytics is one tool that allows auditors to identify problems before they become much bigger problems. I would say audit teams that are hesitant to implement audit analytics should get ready for those much bigger problems. 

What can an auditor do to build a case for audit analytics?

Education is the first step. You need to take the time to educate your executive team, your audit committee, and your board on why it's so critical to incorporate data analytics within the process.

I always recommend taking small steps to prove the value by creating a small pilot project. You don't need a lot of money to do a small pilot project. You don't need audit analytics software or expensive technology to do some form of analytics—you can do basic analytics within a spreadsheet. So if you've got some data sources that you're relatively comfortable with, and that are relatively clean, start small and get some relevant wins to prove the value of analytics. This will help make the case for greater investment. 

I always recommend using the pilot project to focus on an area that's important to your executive team. So if you find issues—which you undoubtedly will—that it's going to resonate with your executive team. Don't focus on travel and entertainment expenses if they're not going to care if you find a duplicate expense. Look at the strategic focus areas. Maybe they're in a low-margin business that's being hurt by the economy and there's a cost-cutting initiative. If that's the case, focus on areas where you can identify cost overruns or duplicate payments within the accounts payable process—anywhere you can actually save tangible dollars. That's going to get the attention of management. That’s going to build your case. 

Do you think data analytics plays a role in attract internal audit talent? 

One hundred percent. Internal audit is generally not revered as a sexy profession, so anything you can do to make that role more interesting is a win. Obviously, data analytics is an exciting, high-demand area that a lot of people are interested in exploring. Incorporating data analytics into your processes is generally indicative of a more mature department, so it will attract high-caliber individuals looking to build on that skill set and looking to do more than from just a traditional audit standpoint. 

What should be on the wish list for an internal audit team that wants to mature its analytics program?

The wish list is going to vary dramatically depending upon the maturity of the department. The most common scenario is a team dabbling in analytics, but they're struggling to get the full value out of it. Often, the number one item on the wish list is a dedicated data resource on the team—having someone who has the experience and the knowledge, who understands the data and can really dive into it on a day-to-day basis. They’re a big accelerator for driving maturation and value with analytics and within audit. 

Another item often on the wish list is getting direct access to data. In many organizations, IT can be a barrier. They don't like providing direct access to data—they like to be a conduit to providing data. This creates inefficiency in terms of getting the data that you need. 

How do you feel analytics can help auditors be more agile? 

When less mature organizations think of analytics and audit, they immediately think of field work testing and full population testing. Certainly those are the most common forms of audit analytics, but one of the more valuable areas for using analytics is in the planning and risk assessment portion of audit activity. 

This takes place in two areas. The first is when you're developing your annual plan, letting data influence where you focus based on inferences you can make from data. The second is when you're planning for an audit and looking for insights and data before you start, to drive where you want to focus within that audit or specific audit procedures. If you're doing that effectively, based on the insights you're getting from the data, you can change direction on the fly in terms of where you're focusing your audit activities on the highest risk areas. To me, that's the definition of being agile.

More mature departments don’t just go off of a cyclical audit plan. They focus their audit resources and effort in areas where their data indicates the greatest risk. They’ll run analytics as part of their continuous monitoring routines. If something pops up that identifies a significant risk, they may change their audit plan in the middle of the year and say, “OK, you know what, we're going to push this other audit that we had planned, and we're going to we're going to prioritize this particular area because we now have some data insights that tell us that there's something there that needs our attention right away.”

I would say leveraging analytics across the audit process and across the audit cycle is a telltale sign of a more mature department—not just using it for testing, but using it for your audit planning process, as part of your risk assessment process.  

What are steps someone can take to raise their analytics program to the next level? 

I think co-source providers play a pivotal role, particularly to departments that are looking to get started or are fairly early in their maturation cycle. A co-source partner brings that expertise and context of what your peers are doing, as well as best practices within the industry. If you pick the right provider with the right experience, they can accelerate the maturation of an audit program for a relatively small cost in a short period of time. 

Of course, there are data analytics LinkedIn groups within pretty much every major city, which can be valuable for sharing ideas and best practices. 

And the IIA has always been a big driver of leadership around analytics. They have a number of white papers and blogs. What's relevant to you or what may make the biggest difference in your particular situation would be highly variable depending upon where you are in your cycle.

Still have analytic questions? You can learn more about adopting analytics in our Auditor’s Playbook here.