Diligent One Platform World tour ad April 2024 TeamMate ESG advertising banner 2023

Local Authority Internal Audit Virtual Forum

20 April 2022

Please note:

  • All Institute responses are boxed and highlighted blue
  • Where the chair comments in that capacity this box is highlighted in yellow
  • For confidentiality, the identities of all delegates/attendees are anonymised

Institute's welcome

Good afternoon, everybody. I am John Wood, CEO at the Chartered IIA UK and Ireland.  

The topic for today is ‘Data Analytics – no longer negotiable’, anyone who uses the internet to buy goods and services, which is just about everyone these days, will have noticed data analytics at work. Data analytics has therefore emerged as a catch-all term for any form of data gathering and analysis that leads to informed decision making. It is the process of collecting and analysing data about a subject to help make decisions, hopefully ones that are better informed.

The concept of data analytics has become a mandate for internal audit functions. The question isn’t “if”. It isn’t even “when.” The time is now; the question is how? If you have not yet started or have only dabbled in the world of data analytics, it is time to learn about it and harness the power of information.

Is it a daunting proposition? It can be, and there is a learning curve, but even small audit functions can take advantage of the power that data analytics can provide. It can further your reach into, and visibility within, your organisation, allowing you to stay relevant and contribute to your organisation’s betterment by providing greater value.

But short of an investment in new technology and applications, your organisation may already have enterprise software such as SharePoint and Excel that can accomplish many things if it is set up properly. It is a question of having the talent on board and inclination to do so. Today, our speakers will tackle the ‘how’ question in terms of using data analytics to strengthen the assurance you provide to your stakeholders.

In addition to our guest speakers, we are also joined from the Institute by:

  • Liz Sandwith, Chief Professional Practices Advisor,
  • Derek Jamieson, Director of Regions
  • Piyush Fatania, Head of Audit, Risk, Assurance and Insurance Services, Gloucestershire County Council, and member of the Institute’s Council and our Chair for today.

Chair's opening comments

Among the many important developments that began in the 20th century, there were two key developments. One was the move away from recording data and information on physical repositories, ledgers, documents and paper in genera,l and on to digital media. The second was the volume and complexity of data and information began to grow exponentially. Councils produce a large amount of data and the challenge for auditors became how to get hold of this data and meaningfully analyse it. Using data analytics is a way to extract large amounts of data and to analyse it.

Data analytics itself is not new. We used to talk about computer-assisted audit techniques (CAATs) many years ago. However, many internal audit teams are not fully benefiting from the transformative capabilities of data analytics, with auditors often reverting to traditional sampling and manual processes time after time.

It seems that what internal auditors need is a gentle nudge out of the door and on to a route that will see them seamlessly using data analytics as a part of their everyday work; a roadmap that will help them to harness the power of data analytics. In addition, these skills can bring huge benefits to the way we deliver our work and transform how the second and third lines use data analytics to identify, manage and monitor a council’s risks.

The world is changing. Control environments have changed with remote working, staff shortages and different operating conditions. Risks emerge from all directions and at any time, and management can often be blindsided and struggle to anticipate such events. When data is available but not used in a prescriptive manner, it may fail to identify emerging risks or generate risk-sensing insights.

Data analytics can provide councils with rapid and continuous insight on processes and controls, while advanced business intelligence software can provide visual insight into risk exposure and underlying trends.

Furthermore, the opportunity to add value at all stages of the audit life cycle through analytics is growing and can change the way we provide assurance. If the use of data analytics is not embraced there is a missed opportunity to raise the profile of the internal audit function – and to add significant value and insight to stakeholders across the wider organisation.

To talk to us today, I am delighted to say we are joined by Rupert Bamberger, Executive Director of Change, Rebecca Pomeroy and Rob Brown, Senior Data Analysts, all from SWAP Internal Audit Services. Can I also say congratulations to our presenters today, as they have been shortlisted for the Audit and Risk Awards – Outstanding Team – Public Sector.   

Key takeaways

Slides from the session are attached here.

  • It has been a challenge to instigate and progress our data analytics journey and hopefully this presentation will help provide a gentle nudge as to how we broke down the challenge.
  • Given the future of internal audit, we have worked to grow our data analytics functionality within the last couple of years, however SWAP has faced challenges given the number of organisations, systems and data maturity of the organisations we audit in evolving their data analytics approach.
  • Coming from a non-data background could be a drawback on one hand but equally it can help break down the challenge, essentially data analytics is a challenge just like any other we face in internal audit.
  • We have benefited from the size of SWAP and from economies of scale given the size of the team. Being a not-for-profit organisation, we started small with one FTE Data Analyst when we had an auditor vacancy. We took a leap of faith and converted the internal audit post to a data analyst post and built from there.
  • Is there the possibility of having someone in your team dedicate some of their time to data analytics, e.g. a quarter of their role?
  • It is important to recognise that this will all take time and it is a learning curve.
  • A key mantra for us was ‘what gets measured, gets done’, so we tracked what audits were utilising data analytics and whether the trends were showing the numbers of audits going up or down. If this isn’t monitored, there is a risk that data analytics remains untouched.
  • It was essential to constantly keep data analytics on the agenda including making sure it was discussed at team meetings, 1-2-1s and individually.
  • It was important that we took our SWAP internal auditor on the journey with us, and we resolved to get auditors involved with data. Persistence was key and we almost bombarded them with the concept of data to keep the conversation going.
  • With regards to training, staff undertook some basic training initially and we also linked up with a training provider to advance this, which was useful as this promoted understanding why and where data could be valuable.
  • We met with the Assistant Directors as Heads of IA on a quarterly basis to discuss their upcoming plans and identify opportunities where data analytics could be used. These discussions often also prompt other projects.
  • We regularly record case studies on a particular topic and these are stored on MS Teams so auditors can watch these ‘on-demand’. These can provide teaching on a particular subject and shared knowledge whilst promoting upskilling.
  • We recently hosted a ‘drop-in session’ for auditors, which provided a good opportunity to raise any concerns and pick up on frustrations early whilst reminding them to continuously think about data analytics.
  • We can monitor which members of staff are using data analytics so we know who is engaging and can reach out accordingly. We have been able to do more work because of this, it’s about bringing everyone on the journey together.
  • Involvement in forums, such as the Chartered IIA Data Analytics Forum has been important, as it has allowed us to talk to others trying the same things.
  • Using Power BI has allowed us to create a data analytics dashboard, which includes information on the audit areas, team and audited organisation where data analytics has been used. This has promoted friendly competition between the teams.
  • It’s been important to support and empower auditors in using data analytics so they can do this themselves. The audit management system is used to capture details of data analytics performed which is reported upon regularly.
  • We have developed a library of areas where we have previously undertaken data analytics, which can be searched. This includes whether any value was added, the time taken with the task etc. which can help auditors assess the value of what was completed.
  • Gaining access to data can be a big stumbling block, so we have recently recruited a Data Integration Analyst, which sits between the SWAP partners and SWAP internal audit teams. They work alongside the auditors but develop a greater knowledge of the council’s systems. It is early days, so we’re not sure of the outcome of this yet.

Chair's closing comments

Thank you, all. It was interesting to hear SWAP’s journey with data analytics. Depending on where you are with your journey, it can be intimidating to try if the language used is too technical. It’s about simplifying – that is the key thing about data analytics – don’t over-complicate it. It is simply another tool which helps us to conduct our work. Lots of us already use data analytics without realising. Big things have small beginnings – taking the first step is the most important. Develop a strategy, establish who will be involved, what software is required and target the audits where you will try it.

A key part of that strategy is allowing some wiggle room and that space to learn and even get it wrong, but not to be put off by that. Consider it a learning opportunity. Data analytics is not for everyone. There will be key people that like it and want to do it, who can drive data analytics within your team, who can help and advise others.   

Institute's closing comments

Thank you all. We are currently finalising our programme of sessions and topics for the second half of 2022. Our topic for the May session, 25th May 2022 at 3.30pm is a change to the published programme – CIPFA Report – Internal Audit Untapped.

Data and cyber by the sea – 11 May 2022 in person all day event - This data and cyber event brings you an exciting array of subject matter experts from a range of organisations. These experts will explore the permanently hot topics of auditing cyber security and harnessing data analytics. The event will include both practical demonstrations and real-life examples.

Data Analytics Working Group – SWAP are members and valued contributors to our working group. If you are interested in joining the group please reach out to Derek Jamieson – derek.jamieson@iia.org.uk

Thank you for attending. As always, if you have any ideas or suggestions for what we might include in future agendas, please contact Liz Sandwith liz.sandwith@iia.org.uk

Q&A and chatbox comments

 

Q: Being fairly new to DA, do you have any recommendations for analysing key areas to start. What is going to provide the most useful results?

A: In terms of areas to start, we would suggest starting with the low hanging fruit, such as key financial control areas, such as accounts payable or credit cards for example are probably where the most successful data resides in local authorities. We’re still working out the useful results and sometimes it really is trial and error. Sometimes you will do something quickly with data analytics and get good results, other times you will spend a lot of time and yield no results. 

Q: What tools do you use to conduct the analytics?

A: We tend to use the Microsoft Office suite, such as Excel for most things. We’ve also started using Power BI, which was a learning curve but now it is easy to use. We also use some software called Arbutus as a specific tool which is more powerful than Excel.  

Q: Can you give some practical examples of where data analytics has added value to an audit please?

A: With key financial control audits, it has allowed for whole population testing and has provided quick ways of adding value. We have also been able to produce some dashboards which we’ve handed back to the second line to use as their ongoing monitoring tool. We also used Power BI to build a dashboard for financial data which they’re now using for lots of other audits and taken the work done and linking this to schools and school audits which has been useful.  

Q: If you are using Excel, what level of knowledge do you need to have? Is Excel training for the team a good place to start?

A: Excel training is useful and SWAP invested in this at the start. However, YouTube has some good videos on Excel that anyone can watch and is obviously free. Microsoft Learn is also a valuable tool.

Q: Do you find that you can plan what data analytics can be performed before starting an audit? Or does it tend to be an evolving process during an audit?

A: It really depends on the audit. For some areas you can plan ahead and we are trying to move towards more data driven audits and plan before the audit starts. However, it might be that we speak to an auditor during the audit too – there is no one size fits all approach, as long as we add value.

Q: Do you work with the Council's own in-house Business Intelligence Teams?

A: Yes – it’s what we’re looking to do. It is a new role so working with the Business Intelligence Teams will enable us to learn about their data and systems. They and SWAP will benefit from help and advice along the way, so it’s very much our vision for the future.