And the same goes with data analytics. Internal auditors that are comfortable with their Sarbanes-Oxley checklists and their methodology that they brought with them from the Big 4 audit firm are a bit wary when we start showing them lots of graphs. They don’t know where the information in the graph came from. They don’t know how to interpret the graph. They don’t know what to use it for. If they start using it in a meeting, maybe the auditee will catch them out and make them look silly.
It is much easier for an auditor to talk about item number 24 of their sample of contracts, than it is for them to talk about a graph. An auditor can pick a contract and easily say to the auditee, “Do you know why we are still ordering from this supplier, despite the contract being out of date”. It is harder for them to say “the dashboard shows that this supplier has a positive balance, do you know why that is?”.
And why is that? Let’s look at the last question. First of all, knowing that suppliers generally have creditor balances is not given to everyone. Not everyone in the audit department is aware that accounting journal entries for supplier invoices are entered as credit lines, and that therefore the suppliers are called “creditors” because they usually have a “creditor” balance (negative balance), rather than a “debtor” balance (positive balance).
Secondly, if the auditor is aware that suppliers are normally creditors, then they might not, however, be able to think of any reason why this particular supplier has a debtor balance. If they can’t think of any reason why that might be the case, then they will probably feel confused and dismiss the graph as incorrect. They might not be able to think, “oh, the supplier could have a debtor balance because we sent back some returns and didn’t receive money for the debit-notes; or because we didn’t get paid for those year-end rebates; or because we overpaid the supplier by mistake; or because we paid the same invoice twice.”
Not knowing the possible reasons behind an anomaly on the graph can create fear and rejection of the graph itself. Then there is also the technical aspect. If the auditor understands that suppliers are normally creditors, that this is indeed an anomaly, and if the auditor can also think of a lot of reasons why the anomaly may have occurred,… they might still be wary of the graph. And the main reason for this is that they don’t know where the figures came from. They may or may not know who created the graph. But they actually have no idea of which data was used to make it. They might worry that there was a mistake along the way, that the person doing it maybe only included payment lines for the last period and not the invoices relating to those lines from the period prior to that. There are indeed many ways in which we can make false analysis - graphs that look nice, but that are completely incorrect.
So, an auditor presented with a new graph- if that auditor understands the main principles - may still rightly be wary of using it, until he/ she has fully understood where the data producing the graph came from.
And this is where we really get into deep water. Just as there are few are the people who are fluent in both German and French, … there are few people who can understand the business implications and processes behind the graph, as well as the underlying data that was used to make the graph.
For the lucky few, for whom both sides of the story are transparent, it will be possible to go to the person who created the graph and ask to quickly check the SQL or QLIK query that made it. That person would be able to see which filters were applied.
If that auditor also understands the SAP system, they will be able to go even further and check: