Digital Auditing in Action

Although the industry has been discussing automation and data analytics for years, hearing how this is being done in practice never gets old. We all want to know how other departments have been incorporating next-gen capabilities and approaches in their engagements.

In this episode of AuditTalk, CrossCountry Consulting digital auditing experts Karalee Britt (Partner), Steve Coppolino (Director), Matt Johnson (Senior Consultant), and Kyle Slack (Senior Consultant) share digital trends, best practices, and practical use cases seen in other internal audit departments for leveraging technology to work smarter, not harder — including:

• Employing cloud collaboration tools to maximize productivity, team engagement, and audit & risk management.
• Using data analytics and visualization to provide valuable insights.
• Leveraging Analytics Process Automation (APA) and Robotics Process Automation (RPA) to drive efficiencies and increase audit coverage.

Watch the full AuditTalk video for step by step walkthroughs of specific use cases for these key technologies, and read the can’t-miss highlights below.

Optimizing with Cloud Collaboration Tools  

“What do we mean when we say cloud collaboration? There’s a lot in the cloud, but not everything in the cloud is a collaboration tool. The way we think about it is that collaboration tools are a way for our teams to work together on documents or deliverables — as well as engage with each other in real time — while we’re in different locations. These tools are housed in the central cloud, thereby being accessible by other users for key activities including organizing team efforts on our work products as well as creating that valuable single source of truth.” – Karalee Britt, Partner, CrossCountry Consulting

“Using collaboration tools for data and documents centralization has been a real benefit to both our teams and our customers. Having a single source of truth for documents has removed version control challenges and provided easy access to documents and data needed to perform testing or other reporting functionality. With one of our clients, we found that by centralizing documentation within a tool and standardizing the nomenclature, we were able to support not only knowledge sharing and the audit trails for any of the changes, but also facilitate using the data for automation purposes, which we’ll hear more about later.” -Steve Coppolino, Director, CrossCountry Consulting

“Your internal audit teams really can do more with collaboration tools. We can leverage available capabilities and support various stages of the audit lifecycle… These tools have supported an agile audit methodology, audit plan management, audit documentation requests that use that central document and data repository, and also shared document editing that supports workpaper development and reviews. In one instance, we actually leveraged a ticketing system that recorded audit deficiencies, tagged the responsible parties, tracked remediation activities, and also helped facilitate reporting and providing that status of the remediation to leadership.” -Steve Coppolino, Director, CrossCountry Consulting

Providing Insights with Data Analytics and Visualizations

“Data analytics is the process of analyzing sets of data to find patterns, trends, and correlations that assist in making business decisions. The keywords here are making business decisions. Businesses have a lot of data, but most don’t know what to do with it. 

1. The first step in establishing an internal audit data analytics program is defining the objectives. What are you trying to achieve, and who is responsible for what parts of the project? Once everything is defined, you can move onto expectations. It can be very challenging, especially for higher management, to get a grasp on what data analytics is and how it’s going to be beneficial for the company. When you’re going through this process, you need to manage expectations — don’t promise the world when you’re first diving into data analytics. 
2. The second step is to determine the relevant analytics for audit. While there are key analytics that are relevant to all companies, each company needs to determine what is most important to them. A technology company could have different goals compared to a real estate company, especially when it comes to key metrics and analytics. Additionally, every project I have helped out with has involved working with the IT department. You’ll need to explain what systems you need, how many people will need access to those systems, and what level of permissions you’ll need. 
3. The third step is to identify the relevant systems, availability, and quality of data. In data analytics, you live by the phrase, ‘garbage in, garbage out.’ If the data you’re working with is not good at the start, there’s no way you’re going to pull anything meaningful out of it. Therefore, before you start, you need to make sure all relevant systems have clean data. This might require building in controls around data entry, especially if it’s entered manually. A few examples that I’ve seen in my work include ​​instituting standardized forms (especially when uploading to ERP or CRM systems), building in controls around character limits (especially if you’re entering data in manually), and strict due dates for time sensitive data. For example, maybe all data needs to be submitted two weeks after quarter end, because if you’re working with outdated data, then you can’t pull meaningful analysis out of it. 
4. The last step is to actually acquire the data, and develop and implement data analytics. This is where the magic happens — we’re pulling the data and building the data analytics to get more insights about your company. This last step is obviously the main reason why you’re here, but please note that there’s just a lot of planning ahead. Any good project manager knows, the better the plan, the better the results.” – Matt Johnson, Senior Consultant, CrossCountry Consulting

“Data visualization is an excellent way of conveying a message using raw data. Instead of looking through raw data points, a user can look through an interactive visual — whether it be a simple bar chart or a complex tree map to gain a better understanding of the data and its meaning. 

• You can utilize visualizations to assist in identifying relationships, trends, and patterns within your data. This is the investigative part of data analytics, and sometimes you find things you weren’t even expecting. Once you identify an outlier, visualizations give you opportunity to drill down into your data. For example, if you notice a month’s revenue increased by tenfold compared to the prior year, a user can isolate that month’s data and see what is causing that difference. 
• Through visualization programs, you can set up reports that are sent monthly, weekly — and if you’re having fun — daily. No more waiting for responses on emails or someone preparing an Excel report. The visualization program will automatically pull data from a system, generate the report, and send it out to key stakeholders for that particular process.” – Matt Johnson, Senior Consultant, CrossCountry Consulting

“I hope everyone is thinking about how to implement automation into their current internal audit process — but where do you start? There are steps that we found helpful when identifying a potential candidate.

1. The first step is identifying what you would like to automate. I always like to say that automation is born from frustration. If you ever see a task that’s annoying to you, that might be a good candidate. In general, these processes are simple, repetitive, and aren’t really constantly changing. There is some flexibility here, but the more standardized the report or the process, the better the candidate. 
2. The next step is to take a deep dive into that process and start to document the steps that are taken. This involves connecting with the key stakeholders in charge of a process, and documenting those steps in a standardized way through programs such as Visio or other process flow programs, a Word document, or an Excel sheet. 
3. The last step is putting pen to paper and actually building out the automation through the various tools at your disposal. I get questions from my clients, ‘what is the best tool?’ My answer is always the dreaded, ‘it depends.’ I can’t recommend a blanket tool because a lot of things affect my tool recommendation. It depends on the environment of the client, the systems the company uses, and the tools that are currently available through a company.” – Matt Johnson, Senior Consultant, CrossCountry Consulting

“Analytics process automation or APA refers to the ability for the end user to write and develop automations for their needs without having to go to another department like IT. This is possible because these tools we’re discussing have matured to where any business user can quickly learn and deploy automations within their department. Automation programs have moved away from requiring a strict coding background to low- or no-code programs that are accessible to everyone. These programs help solve some of the largest issues with data analytics. They can pull from multiple data sources and aggregate them while reducing the risk of human error.” – Matt Johnson, Senior Consultant, CrossCountry Consulting

Leveraging RPA to Drive Efficiencies and Increase Audit Coverage

“What is Robotics Process Automation, or RPA? It’s a technology where a specialized computer program — or bot as we call it —  is configured to emulate the actions of a human interacting with digital systems to execute a business process. RPA bots utilize the user interface to interpret information, trigger responses, and communicate with applications to perform a vast variety of repetitive tasks. A great benefit of RPA operating in this way is that it’s a non-invasive technology. RPA can leverage existing IT infrastructure without causing disruption to underlying systems. This makes it relatively straightforward and cost-effective to implement in comparison to traditional computer programming developing methods.” — Kyle Slack, Senior Consultant, CrossCountry Consulting

“What can RPA do for you?

1. Mimicking human actions with the user interface. RPA bots interact with web and computer applications through a computer’s user interface, which is the same way humans interact with these applications. This allows bots to mimic many user actions such as clicking, typing, and using hotkeys or shortcuts. You can combine these smaller actions together in a sequence, enabling RPA bots to navigate through a website, search a database, move files and folders around, copy and paste data, fill in forms and so much more.
2. Extracting data and manipulating data. RPA bots can extract individual pieces of data or entire data tables if it’s in a structured format with consistent labeling or location — think of an Excel spreadsheet where you’re always going to find the data in columns A through L. It’s capable of extracting data from multiple sources — a website or web application, an Excel spreadsheet, a PDF form, text, or CSV documents. Once data has been extracted from a source, that data can be manipulated and populated into another source like an online forum, a new spreadsheet, or an ERP system. Common data manipulation used in RPA is sorting and filtering data tables, combining and rearranging columns, replacing or reformatting data values, or simple calculations like counts, sums, and multiplication. RPA can also replicate many of the formulas you may use often in Excel like VLOOKUPs and SUMIFs. 
3. Scalability, scheduling, and monitoring. RPA bots can run many different process automations — but not at the same time. They have to go one at a time, but they can be scheduled to run these process automations at regular intervals or on demand. RPA bots can be run on virtual machines. This allows the bot to run unattended 24/7 without interrupting a user’s ability to complete work on a host device like their own laptop. Some RPA tools also include features that track and log everything that a bot does during its execution of the automation, and what changes people made to the bots, creating a useful audit trail in both cases. This can be helpful if you’re using RPA on your own, so you know what happened during the bot’s execution. It’s also very helpful if you’re auditing an RPA process, so you can see all the actions that took place during the automation’s run.” — Kyle Slack, Senior Consultant, CrossCountry Consulting

“How do you utilize RPA to aid an internal audit team and your audit processes? There are many automation opportunities across the audit life cycle, and I’ll walk through a couple of specific use cases. RPA is especially useful for gathering data or documentation, like identifying a population, collecting control evidence, and gathering reports or data needed as inputs for a compliance audit. It’s useful for data entry like generating a control work paper or populating a control lead sheet, whether that be an Excel or GRC tool for administrative tasks like sending out document requests lists, issue due date emails, reminder emails, etc. It’s also great for simple, but large-scale validations and calculations like a periodic access review or a reconciliation of some sort.”  — Kyle Slack, Senior Consultant, CrossCountry Consulting

“To wrap up, I’ll speak a little bit on comparing APA and RPA. They both have their own strengths and weaknesses. APA is preferred when a process is super data intensive, like when you’re dealing with complex calculations or analytics, whereas RPA is really better for transactional processes that have repeating steps for independent transactions or processes that utilize the user interface a lot. It’s important to note that these technologies can be utilized together to create the final automation solution. They both have built in integration to a ton of widely used applications like Microsoft Office Suite, workflow ticketing systems, audit tools and many more, which can make it even easier to build some of these automations.” — Kyle Slack, Senior Consultant, CrossCountry Consulting

Stay tuned for more AuditTalk video interviews with audit community leaders about industry issues, insights, and experiences!