Mobile Edition
Print
Get the Mag
Weekly UpdatesiN THIS TOUGH ECONOMIC CLIMATE, INTERNAL AUDIT shops around the world are under pressure to be as efficient as possible. How to do more with less is a question on everyone's mind. One answer could be to invest in audit technology. Many software tools claim to make internal audit shops more efficient and effective, enabling them to run their own back-office operations smarter, while extending the reach and quality of their audit assurance.
New research from The IIA gives useful insight into where and how internal auditors currently use IT audit tools. It high lights some of the areas where better use of such technologies could help audit shops. Software is never a guaranteed solution: The survey flags some familiar complaints about cumbersome tools that are difficult to use and hard to learn. But the survey concludes that many audit shops are not making the best use of available tools and should reconsider their use of software. Moreover, some shops seem unwilling or unable to invest in such software.
The IT Audit Benchmarking Study 2009, published by The IIA Research Foundation's Global Audit Information Network, reflects the views of 138 organizations with annual revenues between US $1 billion and US $10 billion. Approximately three-fourths of these firms were from the United States; other countries or locations represented include Canada (8 percent), Australia and Hong Kong (2.2 percent each), and Albania, Ger many, and Switzerland (1.4 percent each). The majority of the audit shops that participated in the survey are small or medium sized--a third have between three and six internal audit staff members, and a further third have between seven and 15. Not surprisingly then, for the vast majority of the audit shops in the survey, specialist IT auditors are few in number: three-quarters of respondents have three or fewer specialists.
Over the next two years, these audit shops will have to make their limited resources stretch even further. Asked what big challenges they will face over the next 24 months, respondents said IT audit projects would be hit by budget restrictions, a lack of internal resources, and insufficient overall knowledge about IT. They are also worried that the increasing complexity of their organizations' IT systems will make it harder for them to add value.
Amid the gloom there was optimism. Three-quarters of survey respondents say they have the skills and training needed to address these issues. Indeed, most audit shops are using software tools, and doing so with success.
[GRAPHIC OMITTED]
[GRAPHIC OMITTED]
[GRAPHIC OMITTED]
EXTRACTION AND ANALYSIS TOOLS
The most commonly used IT audit tool is, not surprisingly, data analysis software. Three-quarters of respondents use some form of software to perform analysis, with ACL, Microsoft Excel and Access, and IDEA the most commonly cited.
Respondents listed numerous benefits of this category of software. Data analysis tools increase the efficiency of audits, make trends easier to spot, and help auditors find meaning in a mass of data. Instead of working with a limited sample of data--such as a cross section of invoices--these tools can analyze all of it, giving better audit coverage. Some respondents said their ability to use data analysis tools has enhanced their independence. It enables them to provide their own insights to management and the external auditors, for example, rather than relying on information provided to them.
Internal auditors in the survey use data analysis tools to focus their fieldwork on the most likely problem areas. The soft ware helps them spot anomalies, fraud indicators, and other control red flags that they wouldn't have seen otherwise. It also helps them spot problems such as segregation of duty conflicts and unwarranted user access rights to IT systems.
Auditors can only use data analysis tools if they have the right data avail able to begin with; data extraction tools, which make this possible, were the second most widely used category of audit software, the survey found. Two-thirds of respondents use some kind of extraction tool. The most often cited are ACL, application queries, SAP, and SQL.
The benefits that respondents associated with these tools are similar to those found with data analysis software: improved productivity and efficiency, and the ability to find meaning in data by cutting and dicing or drilling down to the required level of detail. Internal auditors say they are using data extraction tools to spot fraud, expenses abuse, and a failure to record staff taking annual leave, for example.
STUMBLING BLOCKS
While most internal auditors are using the software tools available in these two categories, many are not. Nearly one in five respondents say they do not use data analysis software; a third do not use data extraction software. The survey does not explore why these auditors are not using tools that seem to benefit so many of their peers. But it does highlight some of the problems encountered by auditors who do use the tools, which may help explain why these popular types of software are not used more widely.
When asked to comment on any problems associated with the data analysis tools they used, some auditors complain that they are not user friendly and require a high degree of training. Some say accessing the data needed for analysis is difficult--it might be in a format that is not susceptible to analysis, for example.
Respondents say training needs and steep learning curves are a problem with extraction tools too, as is the difficulty of obtaining data in the correct format. Some say it is difficult to find an extraction tool that works well with other soft ware used in the organization, and it can be difficult to integrate a tool used only by the internal audit shop. Respondents also have problems accessing data, saying that sometimes data owners drag their heels, causing unnecessary delays.
LESS WIDELY USED TOOLS
The survey also explored the extent to which internal auditors use tools for tasks outside these core areas of data analysis and extraction, and it found a surprisingly low level of usage. Just over half the survey respondents say they do not use compliance software, for example. A quarter do use a tool in this category, but no two respondents named the same one, indicating that the market may be highly fragmented. Control self-assessment tools are not widely used either. Only one in five auditors use a software tool to automate this task, and Excel is clearly the most widely used--no other product comes close. Continuous audit software also is not widely popular. Only a quarter of respondents say they use it; ACL is the most cited tool.
[GRAPHIC OMITTED]
[GRAPHIC OMITTED]
The survey noted wider implementation of tools that internal auditors can use to make their day-to-day work practices more efficient. But even in this category software usage is not as widespread as one might expect. Most respondents (57 percent) do not use software to assess risks for the annual audit plan. And those using automated workpapers are in the majority, but just slightly (52 percent use them; 48 percent do not).
The auditors not using tools in these categories might want to reconsider, as respondents who are using them listed several benefits. They say that audit planning and risk assessment tools help auditors track risks consistently and provide a standard format for all risk assessments and risk calculations, as well as facilitate comparison of risks across the organization. Such tools also save time when performing new risk assessments. When asked to detail some of the successes they have achieved with tools in this category, respondents say they can prepare their annual audit plan more quickly. They also mention the ease and consistency with which they can update risk criteria as an audit assignment progresses. And they can determine at a glance which areas of the business are "high risk"--for example, because there were flagged concerns about the control environment or it was easy to see that an area had not been audited for a long time.
Tools to automate audit workpapers are popular for their standardized tem plates, which helps auditors to be more productive and results in more consistent reporting styles. They also facilitate review and sharing of audit files with peers, which leads to better quality work overall. Centralized storage of workpapers makes it easier for auditors to access information and improves the organization of the audit shop as a whole. Such tools also help ensure workpapers comply with The IIA's International Standards for the Professional Practice of Internal Auditing (Standards) and facilitate audit tracking and repeat or follow-up assignments, which helps cut audit planning rime and staff workload.
When asked to share their success stories, respondents say they use workpaper automation tools to track audit issues and the related responses more easily. They are able to issue draft reports much sooner after finishing their audit fieldwork, and colleagues working on the same assignment can review workpapers from remote locations. Some audit shops have eliminated all hard copies of workpapers, which saves office space and reduces waste.
Tools in this category aren't without problems. Internal auditors say software bugs have wiped out valuable information in some instances, and the ability to maintain all papers electronically means that in some audit shops every thing is kept, clogging systems with unneeded material.
OPPORTUNITY FOR IMPROVEMENT
Difficulties aside, the survey results still beg the question: Why don't more auditors use tools that many of their peers say improve back-office efficiency and the quality of their audit provision? While the survey does not attempt to address that issue, it does note that lack of technology use is an area where many internal audit shops could improve their efforts.
FEED