Ed. Note-Joe Oringel, Principal at Visual Risk IQ recently wrote a series of blog posts on advancing your business through the use of data analytics and audit. I asked Joe if I could repost his articles, which he graciously allowed me to do. So today I begin a day 3-day series of blog posts which reprint his post. Today are Tips 1-2.
For many people today, Monday January 5, is the first work day of 2015. We compliance and audit professionals are like our many co-workers and friends in that we have new goals and ideas that we expect should set this year apart. We want to grow and develop personally and professionally and have even greater career success. Inside and even outside of our current roles. But how?
Even more than in previous years, 2015 is shaping up as the year that Analytics will be adopted by the audit and compliance profession, at least according to Internal Auditor, the global professional journal for internal auditors. See article titled “The Year Ahead: 2015.”
This article quotes several high profile Chief Audit Executives (CAE’s) on the subject of Analytics. Raytheon’s Larry Harrington, a frequent keynote speaker for the IIA says that “you will see greater use of data analytics to increase audit coverage without increasing costs” and that “internal audit will leverage analytics from other lines of defense,” such as compliance and risk management. Increased use of Analytics will lead to greater value from audit and compliance, as measured by management. But if this was easy, wouldn’t we all be doing it already? How should we overcome obstacles such as finding the right people, training, and budgets (as cited by the CAE’s in this article)
Visual Risk IQ has been helping audit and compliance professionals see and understand their data since 2006. We work with all leading audit-specific tools (e.g. CaseWare IDEA, ACL, and newcomer Analyzer, from Arbutus Software), and also with general purpose analytics and visual reporting tools like SQL, Tableau, Oversight, and more. Importantly, we have completed hundreds of engagements for clients across a wide variety of industries.
These five tips are: 1) Consider skills and experience of the team, not individuals, when planning a data analytics project. 2) Begin with the business objectives in mind, and map from these objectives to available data 3) Understand your data, and explore it fully before developing exception queries 4) Consider outlier, metric, and exception queries 5) Supplement necessary skills with internal or external resources
We’ll be expanding on each of these five tips in blog posts later this week, but here is some information on the first and perhaps most important one.
Tip 1 – Your People
You should consider skills and experience of the Team, not individuals, when planning a data analytics project. As part of our consulting projects, and for our inward assessment of our own team members, we use an analytics-focused Body of Knowledge framework that has the following seven key components.
- Project Management
- Data Acquisition and Manipulation
- Statistical techniques
- Visual Reporting techniques
- Communication
- Audit and Compliance Domain expertise
- Change Management and Strategic Thinking
In our experience, data analytics projects succeed because of project expectations and corresponding competencies of team members in these seven areas. It’s especially important to note that these body of knowledge components are rarely (if ever?) found at a high level within a single individual, and therefore a team approach is needed to accomplish successful an analytics projects. People that have greater skills at project management or communication of issues may not have the requisite technical experience when it comes to data acquisition and manipulation, or statistical techniques. Similarly, it is common for stronger data specialists to be weaker on audit or compliance domain expertise.
So when planning an audit analytics project, be sure that you’ve built a team that has each of these key elements in their skill set, and that they have the incentives and team structure to work together and learn from each other’s expertise.
Tip 2-Brainstorming
Yesterday we started a multi-part post on the importance of building audit data analytics capabilities, together with some “how-to” tips. Our first tip was how this is actually as much of a people challenge as a technical undertaking. One particular “secret” is that a combination of skills are needed to accomplish these analytics projects, and we see many departments make the mistake of assigning a single individual to carry out a project, without sufficient assistance or at least oversight from colleagues that have complementary skills.
In our data analytics consulting practice, we use a Body of Knowledge framework to identify needed skills for a particular project, and then match at least one “expert” with an “apprentice” that is looking to add to these same skills. Together our teams bring excellent qualifications in each of these domains, but it’s rare that they all arrive in the form of a single consultant. That framework was published here yesterday.
Today’s tip is to “Begin with the business objectives in mind, and map from these objectives to available digital data.” Too often, we see compliance and audit teams request data and begin to interrogate it before understanding the data fully or taking steps to validate control totals and/or data completeness. A related mistake is to exhaustively test a single data file without considering supplemental data sources that may yield greater insight or answer related business questions.
A recent example of why to begin with business questions was a Payroll project that we completed for a retail client. Our team was tasked with searching for “off-the-clock” work. If we had focused only on available data files, we could have answered questions about meal breaks, rest breaks, and overtime but perhaps missed other hours worked but not paid. By focusing on the business question first, we identified badge data and cash register data to identify if employees were in the store and ringing sales, yet were off the clock at the time of badge swipes or point-of-sale,
As such, the first step in any data analytics project is brainstorming. You can think of it as part of project planning. During this step, teams should identify the business questions that they want to answer with their analytics efforts, and cross-reference these business questions against available reports and digital data. If existing report(s) fully answer a business question, then a new query may not needed. But if a report does not currently exist, then analytics should be considered and understanding data sources becomes a key next step. During brainstorming, it is very important to understand the number and complexity and number of data sources that will be needed, and to focus only on a small enough number of business objectives so that the number of data sources does not get overwhelming. It is better to have a series of “small win” analytics efforts, than a larger, less successful project.
Joe Oringel is a CPA and CIA with 25 years of experience in internal auditing, fraud detection and forensics. He has over ten years of Big 4 external audit, internal audit, and advisory experience, most recently with PricewaterhouseCoopers. His corporate experience includes information security, internal auditing, and risk and control of large ERP systems for companies in highly regulated industries, including Pharmaceuticals, Utilities, and Financial Services. Partner Kim Jones and Joe founded Visual Risk IQ in 2006 as an advisory firm focused solely on Data Analytics, Visual Reporting, and Continuous Auditing and Monitoring. He can be reached at joe.oringel@visualriskiq.com
This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author.
© Joe Oringel 2015
FCPA Compliance and Ethics Blog 