KNOWLEDGE CENTER


The Five Legged Sheep that knows Data Analytics and Internal Audit

KNOWLEDGE CENTER



The Five Legged Sheep that knows Data Analytics and Internal Audit





Is it possible to get all the required set of skills in your business area?

The reason that most companies are not advancing as quickly as they should with data analytics for audit is a human one, rather than a technical one. You cannot train an old dog new tricks. A leopard doesn’t change its spots. People in their cubicles at work are difficult to budge (unless you offer them donuts!). 

What are the factors? For the people that have been in their job for a long time. The main factor is fear. It's kinda like the French. Why don’t they want to speak English to you, even if you don’t speak a word of French? Germans in a party will immediately and politely all switch to English if they see a non-German person come in the room. The French will look the other way and continue in French. Why is that? The main reason is fear of getting it wrong. For French people, making mistakes in English makes you look stupid. So best not do that in public.
And the same goes with data analytics. Internal auditors that are comfortable with their Sarbanes-Oxley checklists and their methodology that they brought with them from the Big 4 audit firm are a bit wary when we start showing them lots of graphs. They don’t know where the information in the graph came from. They don’t know how to interpret the graph. They don’t know what to use it for. If they start using it in a meeting, maybe the auditee will catch them out and make them look silly.

It is much easier for an auditor to talk about item number 24 of their sample of contracts, than it is for them to talk about a graph. An auditor can pick a contract and easily say to the auditee, “Do you know why we are still ordering from this supplier, despite the contract being out of date”. It is harder for them to say “the dashboard shows that this supplier has a positive balance, do you know why that is?”.

And why is that? Let’s look at the last question. First of all, knowing that suppliers generally have creditor balances is not given to everyone. Not everyone in the audit department is aware that accounting journal entries for supplier invoices are entered as credit lines, and that therefore the suppliers are called “creditors” because they usually have a “creditor” balance (negative balance), rather than a “debtor” balance (positive balance).

Secondly, if the auditor is aware that suppliers are normally creditors, then they might not, however, be able to think of any reason why this particular supplier has a debtor balance. If they can’t think of any reason why that might be the case, then they will probably feel confused and dismiss the graph as incorrect. They might not be able to think, “oh, the supplier could have a debtor balance because we sent back some returns and didn’t receive money for the debit-notes; or because we didn’t get paid for those year-end rebates; or because we overpaid the supplier by mistake; or because we paid the same invoice twice.”

Not knowing the possible reasons behind an anomaly on the graph can create fear and rejection of the graph itself. Then there is also the technical aspect. If the auditor understands that suppliers are normally creditors, that this is indeed an anomaly, and if the auditor can also think of a lot of reasons why the anomaly may have occurred,… they might still be wary of the graph. And the main reason for this is that they don’t know where the figures came from. They may or may not know who created the graph. But they actually have no idea of which data was used to make it. They might worry that there was a mistake along the way, that the person doing it maybe only included payment lines for the last period and not the invoices relating to those lines from the period prior to that. There are indeed many ways in which we can make false analysis - graphs that look nice, but that are completely incorrect.

So, an auditor presented with a new graph- if that auditor understands the main principles - may still rightly be wary of using it, until he/ she has fully understood where the data producing the graph came from.

And this is where we really get into deep water. Just as there are few are the people who are fluent in both German and French, … there are few people who can understand the business implications and processes behind the graph, as well as the underlying data that was used to make the graph.

For the lucky few, for whom both sides of the story are transparent, it will be possible to go to the person who created the graph and ask to quickly check the SQL or QLIK query that made it. That person would be able to see which filters were applied.

If that auditor also understands the SAP system, they will be able to go even further and check:
  • Did we take into consideration the opening balance?
  • Did we use the correct amount field? (i.e. we didn’t add up document currency that is in multiple currency codes, rather than the amount in local currency)
  • ​Did we filter on the correct dates? (i.e. did we use the posting date rather than the input date the document date, the due date or the clearing date)
  • ​Did we consider closed items as well as open items? (SAP often splits the same types of documents across different tables)
  • ​Did we abruptly filter only on certain document types, or did we take all supplier movements (consultants often take the easy way out, filtering on standard document types to get, for example “the list of supplier invoices - thanks to document type RE”. But, for the poor auditor that doesn’t look under the bonnet, little do they know that actually there are lots of other invoices in there that are not of document type RE because they were entered manually into the system. Furthermore, if you don’t consider the cancellations, and other manual entries, your numbers, and so your graph will not reflect the reality…)
It is, therefore, understandable that an auditor, presented with a simple looking graph may be very hesitant to use it on his/ her audit, rather than using the normal check list of 25 samples. Let’s not forget that auditors are there to challenge and review. Which means that those being audited naturally like to challenge them back. An audit closing meeting will usually start the heart beating slightly faster for most people.

Our customers often ask us, “Where do I find someone that knows both audit and data analytics?”. That person can be hard to find, not because either topic is rocket science, but simply because data analysts think that they are too cool for audit and auditors think that they are too important for data analytics.

These days, the best staff members are those that are flexible and that have enough energy and determination to be able to cross-over between audit and data analytics, having the ability to vertically dive into a topic, such as a graph on supplier debtors, and have a deep enough level understanding and experience to be able to use that information effectively with the auditee. It is these types of high-energy, optimistic, and determined auditors that the auditee will not be able to scare off with some hard-to-understand terminology, re-directed discussion, or off-hand aggressive behaviour.

But, just as the French guy at the party that is excited to speak in English and get everyone to join in, in an “English corner evening” to welcome their non-French-speaking guest is a rare commodity, so such auditors are still rare today.

By Claire Worledge

Claire spent 10 years working for Deloitte, managing the data analytics team. In 2010, she created Aufinia. Aufinia has worked for 50 different companies that use SAP over the years. Today, a lot of their work is for MNCs using SAP who are based in Europe, APAC and the US. Aufinia also works for some major retail companies based in China. 

Claire is a Certified Information Systems Auditor (CISA), Certified Fraud Examiner (CFE) and Certified ACL Data Analyst (ACDA). Aufinia is a global OEM partner with QLIK and also a Galvanize reseller partner for Vietnam and China. Claire has a Masters in IT from University College London, as well as a Bachelors in Biochemistry. 

Want to get instant access to a FREE eBook that outlines the 300 must-have data analytics? 

Click below to download our free eBook and we can guarantee it will help you become a recognised leader by starting the transformation of internal control and internal audit!

Is it possible to get all the required set of skills in your business area?

The reason that most companies are not advancing as quickly as they should with data analytics for audit is a human one, rather than a technical one. You cannot train an old dog new tricks. A leopard doesn’t change its spots. People in their cubicles at work are difficult to budge (unless you offer them donuts!). 

What are the factors? For the people that have been in their job for a long time. The main factor is fear. It's kinda like the French. Why don’t they want to speak English to you, even if you don’t speak a word of French? Germans in a party will immediately and politely all switch to English if they see a non-German person come in the room. The French will look the other way and continue in French. Why is that? The main reason is fear of getting it wrong. For French people, making mistakes in English makes you look stupid. So best not do that in public.
And the same goes with data analytics. Internal auditors that are comfortable with their Sarbanes-Oxley checklists and their methodology that they brought with them from the Big 4 audit firm are a bit wary when we start showing them lots of graphs. They don’t know where the information in the graph came from. They don’t know how to interpret the graph. They don’t know what to use it for. If they start using it in a meeting, maybe the auditee will catch them out and make them look silly.

It is much easier for an auditor to talk about item number 24 of their sample of contracts, than it is for them to talk about a graph. An auditor can pick a contract and easily say to the auditee, “Do you know why we are still ordering from this supplier, despite the contract being out of date”. It is harder for them to say “the dashboard shows that this supplier has a positive balance, do you know why that is?”.

And why is that? Let’s look at the last question. First of all, knowing that suppliers generally have creditor balances is not given to everyone. Not everyone in the audit department is aware that accounting journal entries for supplier invoices are entered as credit lines, and that therefore the suppliers are called “creditors” because they usually have a “creditor” balance (negative balance), rather than a “debtor” balance (positive balance).

Secondly, if the auditor is aware that suppliers are normally creditors, then they might not, however, be able to think of any reason why this particular supplier has a debtor balance. If they can’t think of any reason why that might be the case, then they will probably feel confused and dismiss the graph as incorrect. They might not be able to think, “oh, the supplier could have a debtor balance because we sent back some returns and didn’t receive money for the debit-notes; or because we didn’t get paid for those year-end rebates; or because we overpaid the supplier by mistake; or because we paid the same invoice twice.”

Not knowing the possible reasons behind an anomaly on the graph can create fear and rejection of the graph itself. Then there is also the technical aspect. If the auditor understands that suppliers are normally creditors, that this is indeed an anomaly, and if the auditor can also think of a lot of reasons why the anomaly may have occurred,… they might still be wary of the graph. And the main reason for this is that they don’t know where the figures came from. They may or may not know who created the graph. But they actually have no idea of which data was used to make it. They might worry that there was a mistake along the way, that the person doing it maybe only included payment lines for the last period and not the invoices relating to those lines from the period prior to that. There are indeed many ways in which we can make false analysis - graphs that look nice, but that are completely incorrect.

So, an auditor presented with a new graph- if that auditor understands the main principles - may still rightly be wary of using it, until he/ she has fully understood where the data producing the graph came from.

And this is where we really get into deep water. Just as there are few people who are fluent in both German and French, … there are few people who can understand the business implications and processes behind the graph, as well as the underlying data that was used to make the graph.

For the lucky few, for whom both sides of the story are transparent, it will be possible to go to the person who created the graph and ask to quickly check the SQL or QLIK query that made it. That person would be able to see which filters were applied.

If that auditor also understands the SAP system, they will be able to go even further and check:
  • Did we take into consideration the opening balance?
  • Did we use the correct amount field? (i.e. we didn’t add up document currency that is in multiple currency codes, rather than the amount in local currency)
  • ​Did we filter on the correct dates? (i.e. did we use the posting date rather than the input date the document date, the due date or the clearing date)
  • ​Did we consider closed items as well as open items? (SAP often splits the same types of documents across different tables)
  • ​Did we abruptly filter only on certain document types, or did we take all supplier movements (consultants often take the easy way out, filtering on standard document types to get, for example “the list of supplier invoices - thanks to document type RE”. But, for the poor auditor that doesn’t look under the bonnet, little do they know that actually there are lots of other invoices in there that are not of document type RE because they were entered manually into the system. Furthermore, if you don’t consider the cancellations, and other manual entries, your numbers, and so your graph will not reflect the reality…)
It is, therefore, understandable that an auditor, presented with a simple looking graph may be very hesitant to use it on his/ her audit, rather than using the normal check list of 25 samples. Let’s not forget that auditors are there to challenge and review. Which means that those being audited naturally like to challenge them back. An audit closing meeting will usually start the heart beating slightly faster for most people.

Our customers often ask us, “Where do I find someone that knows both audit and data analytics?”. That person can be hard to find, not because either topic is rocket science, but simply because data analysts think that they are too cool for audit and auditors think that they are too important for data analytics.

These days, the best staff members are those that are flexible and that have enough energy and determination to be able to cross-over between audit and data analytics, having the ability to vertically dive into a topic, such as a graph on supplier debtors, and have a deep enough level understanding and experience to be able to use that information effectively with the auditee. It is these types of high-energy, optimistic, and determined auditors that the auditee will not be able to scare off with some hard-to-understand terminology, re-directed discussion, or off-hand aggressive behaviour.

But, just as the French guy at the party that is excited to speak in English and get everyone to join in, in an “English corner evening” to welcome their non-French-speaking guest is a rare commodity, so such auditors are still rare today.

Thanks for reading!

By Claire Worledge

Claire spent 10 years working for Deloitte, managing the data analytics team. In 2010, she created Aufinia. Aufinia has worked for 50 different companies that use SAP over the years. Today, a lot of their work is for MNCs using SAP who are based in Europe, APAC and the US. Aufinia also works for some major retail companies based in China. 

Claire is a Certified Information Systems Auditor (CISA), Certified Fraud Examiner (CFE) and Certified ACL Data Analyst (ACDA). Aufinia is a global OEM partner with QLIK and also a Galvanize reseller partner for Vietnam and China. Claire has a Masters in IT from University College London, as well as a Bachelors in Biochemistry. 

Want to get instant access to a FREE eBook that outlines the 300 must-have data analytics? 

Click below to download our free eBook and we can guarantee it will help you become a recognised leader by starting the transformation of internal control and internal audit!

Copyright © 2021 - Aufinia
For more support contact cjw@aufinia.com

Copyright © 2021 - Aufinia
For more support contact cjw@aufinia.com