Expert Insights: Reshaping Internal Audit Processes With Intelligent Automation
Intelligent automation is a necessity for businesses seeking to optimize resources, mitigate risks, and accelerate growth. John Yui (Associate Director, CrossCountry Consulting), Shivan Bindal (Senior Director of Partner Solution Builds, AuditBoard), and Daniel Green (Director of Data & Analytics, CrossCountry Consulting) discuss how you can implement it within your internal audit team, including:
- Defining intelligent automation.
- Why it may be right for your audit team.
- Operationalizing automation and key steps towards maturity.
Watch the full conversation, and read the can’t-miss highlights below.
What are some potential applications of automation in internal audit?
Shivan Bindal (AuditBoard): Customers are starting from the perspective of the data they require, the data they have, and the organization of the data that they need. When they expand beyond just understanding their data, they’re looking into how their data is performing and helping them with their audit practice. How can they take that insight and go further to be more purposeful in identifying the highest-risk areas of their audit program as they look to deliver better business outcomes?
We see three common applications in which technology can make an immediate impact. One, in streamlining your PVC process, around gathering evidence faster, and more efficiently. Then, as you build on top of having your evidence collected, what can we do to further process that data, to automate testing procedures? And then finally, if you consider one and two together, can we automatically and continuously retrieve our evidence and process it so that we can test continuously? When we string those together, we get a continuous control monitoring outcome where we can identify deficiencies almost in real-time.
First and foremost, focus on those high-leverage areas of your business to drive impact. Think about how your data is being used today in your audit programs, and leverage that to identify the high-efficiency gains you’re going to get out of leveraging technology for automation.
Third, think about the process or the controls from an end-to-end standpoint. You don’t necessarily need to automate the whole thing. If you’re spending five minutes on one activity or five hours on one activity, I think that it’ll become more obvious where to invest your time.
Look across your organization; leverage the tools and technologies that are already in place. Leverage the strengths within your team. And last but certainly not least, learn from those who have done this before.
What is intelligent automation?
Danny Green (CrossCountry Consulting): There’s a variety of tooling and technology that fall into this category. Analytics process automation, or APA, is one of the best and perhaps most relevant tools in the world of internal audit and testing. It’s a data prep tool that helps you consume, aggregate, and prepare data — really huge and vast amounts of data. If you’ve ever done the type of testing that you’re sifting through large data sets, that type of tool is definitely your friend. There’s also robotic process automation or RPA. There are some similarities with APA, but the strength is really in the name, robotic. This is the tool with the arms and legs. It can replicate human-type activities like mouse clicks and keystrokes, and reading data from the screen. Given that, it’s most powerful when it’s used to replicate processes that are highly repetitive with a high volume. Then the others, process mining is interesting. It helps to identify inefficiencies within a process — where the bottlenecks are, where transactions get held up, how many and for how long. I think about process mining almost like an X-ray type of diagnostic tool for a process that’s based within a system.
Workflow management tools fall into this category, and something that’s probably top of everyone’s mind, AI is here too. There are a lot of fundamentals to get right before you get to that level of maturity and using AI tools. Getting data correct is really important before you can harness AI. You can buy automation tools off the shelf, but you can’t buy the value. The value sits within the process, not the tool. And it takes a strong and disciplined approach to find and deliver that value.
Why should internal audit automate?
John Yui (CrossCountry Consulting): Whether you are a two-person internal audit team or a 200-person internal audit team, there are very compelling reasons. These include increased efficiency, productivity, reduced costs, reduced errors, improved service, increased agility, or just freeing up your employees for other tasks. But also, the evolution of new risks impacting modern organizations necessitates the adoption of emerging technologies to help mitigate risks. Intelligent automation and analytics can help solve these common challenges. Compliance and regulatory requirements are often very repetitive in nature and are perfect candidates for automation. Most organizations also face some type of budget constraints. Automation can allow teams to effectively execute with fewer resources and budget.
How can my team get started with automation?
Danny Green (CrossCountry Consulting): There’s very, very significant value that can be unlocked. But without having seen [automation] before, without having approached it and done it, a lot of folks approach it with skepticism. With automation especially, you first have to crawl before you can run. Getting the fundamentals around system data and processes is the platform that you need to start automating. In internal audit, you might see those bigger focuses or value areas being around taking hours and costs out of the function to be more efficient and effective. Getting and aligning your value targets to what’s important to the entire organization is a really, really important part of the journey.
You first need a process or an idea for something that can be automated. Eventually, when you’re at scale, having a method of collecting those things from various contributors is a best practice. The second thing that you’ll always have to answer goes back to value. What do we stand to gain if we automate this? The very best processes to start with are the ones that are feasible and I guess easy, but also the ones that have incredibly high value. The next two steps can be very technical, but in their basic form, it’s about designing a solution that’s going to automate that process and then going about the process to develop it. Once it’s developed and tested, you can put it to functional use. The final stage is about maintaining that automated process, supporting it, and enhancing it for as long as it can add value. Whether it’s at the beginning or at a very advanced stage, following this entire life cycle greatly increases your chance of being successful with automation.
How do we get ready for automation? One of the biggest accelerants to automation in addition to a strong process is very strong data. Automation’s enabled most by process being rule-based and inputs being structured. And if data inputs to automation are not highly structured, meaning you have bad data spread around and it’s not accessible, then those are the issues to address before you start.
Leadership buy-in is incredibly important. We talked about focusing on value creation to align with their priorities. But better yet, it’s a great idea to have them come along in the journey, be a stakeholder, say what they would like to achieve within an automation program, and what their targets are. Mindset and culture are also incredibly important. You want to have people that challenge their mundane work and be on the lookout for ways to get it off their hands so they can focus on a higher-value contribution, or even upskill themselves on the tools that are in play here. There are a lot of concepts to be successful around automation that aren’t purely technical and those are really worth considering.
Looking for more thought leadership? Check out our on-demand webinar library for more leaders and experts discussing timely issues, insights, and experiences.
