We explore the key issues facing auditors as they embrace big data and analytics.
Historically, data was something you owned and was usually structured and generated by humans. However, technological advances over the last decade have broadened the definition to include unstructured and machine-generated data, as well as data that exists outside of corporate boundaries.
The term “big data” is used to describe this massive portfolio of data that is growing at an exponential rate. According to popular belief, big data will have a significant impact on increasing productivity, profits, and risk management. However, big data has limited value until it is processed and analysed.
Analytics is the process of analysing data in order to reach meaningful conclusions. Major corporations and organisations have recognised the opportunity that big data and analytics provide, and many are investing heavily to better understand the impact of these capabilities on their operations. One area where we see significant potential is in audit transformation.
Transforming the audit
As we continue to operate in one of the most difficult and uneven economic environments in modern history, the role of auditors in financial markets is more important than ever. Audit firms must continue to conduct rigorous audits in order to serve the public interest by continuously improving quality and providing more insights and value to financial statement users. Throughout an audit, professional scepticism and a constant focus on the quality of audit evidence are required. Meanwhile, businesses anticipate improved communication with their auditors and more relevant insights.
While the profession has long recognised the impact of data analysis on improving audit quality and relevance, widespread adoption of this technique has been hampered by a lack of efficient technology solutions, issues with data capture, and privacy concerns. However, recent technological advancements in big data and analytics are providing an opportunity to reconsider how an audit is carried out.
The transformed audit will go beyond sample-based testing to analyse entire populations of audit-relevant data (transaction activity and master data from key business processes), employing intelligent analytics to deliver higher quality audit evidence and more relevant business insights. Big data and analytics are allowing auditors to better identify financial reporting, fraud, and operational business risks, as well as tailor their approach to provide a more relevant audit.
While we are making significant progress and beginning to see the benefits of big data and analytics in the audit, we recognise that this is a long road ahead of us. Drawing parallels with the TV and film subscription service Netflix is a good way to describe where we are as a profession. When it first launched in 1997, the company used a DVD-by-mail model, sending movies to customers who returned them after an evening or a week of entertainment. Netflix always knew that online streaming of movies was the future, but the technology was not ready at the time, nor was high-speed consumer broadband as common as it is now.
Today, we are engaged in the audit equivalent of DVD-by-mail, moving data from our clients to EY for use by auditors. What we really want is to have intelligent audit appliances that reside within companies’ data centers and stream the results of our proprietary analytics to audit teams. But the technology to accomplish this vision is still in its infancy and, in the interim, we are delivering audit analytics by processing large client data sets within our environment, integrating analytics into our audit approach and getting companies comfortable with the future of audit.
The transition to this future won’t happen overnight. It’s a massive leap to go from traditional audit approaches to one that fully integrates big data and analytics in a seamless manner.
Barriers to integration
There are a number of barriers to the successful integration of big data and analytics into the audit, though they are not insurmountable.
The first is data capture: if auditors are unable to efficiently and cost-effectively capture company data, they will not be able to use analytics in the audit. Companies invest significantly in protecting their data, with multilayered approval processes and technology safeguards. As a result, the process of obtaining client approval for provision of data to the auditors can be time-consuming. In some cases, companies have refused or have been reluctant to provide data, citing security concerns.
Moreover, auditors encounter hundreds of different accounting systems and, in many cases, multiple systems within the same company. Data extraction has not historically been a core competency within audit, and companies don’t necessarily have this competency either. This results in multiple attempts and a lot of back and forth between the company and the auditor on data capture.
Today, extraction of data is primarily focused on general ledger data. However, embracing big data to support the audit will mean obtaining sub-ledger information, such as revenue or procurement-cycle data, for key business processes. This increases the complexity of data extraction and the volumes of data to be processed.
While it is reasonably easy to use descriptive analytics to understand the business and identify potential risk areas, using analytics to produce audit evidence in response to those risks is a lot more difficult. One problem with relying on analytics to produce audit evidence relates to the “black box” nature of the way in which analytics works, with algorithms or rules used to transform data and produce visualizations or reports. When the auditor gets to this stage, they need to find the appropriate balance between applying auditor judgment and relying on the results of these analytics.
he value of integrating big data and analytics into the audit will only be realized when used by auditors to influence the scope, nature and extent of the audit. This will require them to develop new skills focused on knowing what questions to ask of the data, and the ability to use analytics output to produce audit evidence, draw audit conclusions and derive meaningful business insights.
It requires a ground-up initiative to better understand and influence the education students get at universities and colleges, enhancing learning and development programs, and establishing the appropriate implementation and enablement programs to support audit teams to effectively integrate big data and analytics into the audit.
A further issue is how auditing standards and regulations can be aligned with the use of data analytics. In general, the auditing profession is governed by standards that were conceived some years ago and that did not contemplate the ability to leverage big data. Below are four areas that require further consideration.
- Substantive analytical procedures: These examine the reasonableness of relationships in financial statement items, to uncover variations from expected trends. However, the standard doesn’t cover using big data-based analytics to provide “substantive evidence.” One of the key differences with analytics techniques is that the procedures are used to identify unusual transactions or misstatements, based on the analysis of the data, and usually without the auditor establishing an expectation. Big data and these kind of analytics techniques did not exist when the standard was conceived, so were not considered as a source of audit evidence. The gap creates uncertainty regarding the relevance and applicability of analytics in providing anything more than indicative evidence.
- Validating the data used for analytics: As auditors receive information from the client, they determine its clerical accuracy and completeness, and whether it is appropriate as audit evidence. This applies whether they receive printed documents (such as contracts) or electronic data.But audit analytics do not use or rely on reports generated by the system; instead, relevant master and transaction data is extracted directly from the underlying databases. Procedures are then performed to validate the accuracy and completeness of the data, and it is reconciled to system-generated reports. The auditor is then confident that their analysis is based on the same data the company uses to produce its financial information.
While the standards provide some guidance in this area, they could not have anticipated the type and volume of data that auditors are extracting. Inevitably, there are limitations in the extent to which auditors can derive evidence from the procedures that may be performed in relation to such data.
- Defining audit evidence: The standards provide a hierarchy of evidence, with third-party evidence at the top and management inquiries at the bottom. However, the standards do not indicate what type of evidence analytics provides. It is possible to relate some of these types of tests to the current framework in the standards, but not all. Without a proper description of the type of evidence that analytics provides, auditors are reluctant to claim it as evidence, thus negating the benefits.
- Precision: An audit is designed to detect a material misstatement. When companies record revenues amounting to billions of dollars and users of the financial statements expect them to be free of material misstatements, what level of precision do the auditors require of their data analytics? The standards need to provide more guidance in this area.
Ultimately, the audit of the future could look quite different from the audit of today. Auditors will be able to use larger data sets and analytics to better understand the business, identify key risk areas and deliver enhanced quality and coverage while providing more business value. But to achieve this transformation, the profession will need to work closely with key stakeholders, from the businesses they are auditing to the regulators and standard-setters.