Big data” is the term used to describe this massive portfolio of data, which is growing exponentially. The general view is that big data will have a dramatic impact on enhancing productivity, profits and risk management, but big data in itself yields limited value until it has been processed and analyzed.
Analytics is the process of (and tools for) analyzing data with the objective of drawing meaningful conclusions. Major companies and organizations have recognized the opportunity that big data and analytics provide, and many are making significant investments to better understand the impact of these capabilities on their businesses (for an example, see panel, page 17). One area where we see significant potential is in the transformation of the audit.
Transforming the Audit
As we continue to operate in one of the toughest and most uneven economic climates in modern times, the relevance of the role of auditors in the financial markets is more important than ever. Audit firms must continue their robust audits to serve the public interest by increasing quality on a continuous basis and by delivering more insights and value to the users of financial statements. Professional skepticism and a continued focus on the quality of audit evidence are required throughout an audit. Meanwhile, companies are expecting an enhanced dialogue with their auditors and more relevant insights.
While the profession has long recognized the impact of data analysis on enhancing the quality and relevance of the audit, mainstream use of this technique has been hampered due to a lack of efficient technology solutions, problems with data capture and concerns about privacy. However, recent technology advancements in big data and analytics are providing an opportunity to rethink the way in which an audit is executed.
The transformed audit will expand beyond sample–based testing to include analysis of entire populations of audit–relevant data (transaction activity and master data from key business processes), using intelligent analytics to deliver a higher quality of audit evidence and more relevant business insights. Big data and analytics are enabling auditors to better identify financial reporting, fraud and operational business risks, and tailor their approach to deliver a more relevant audit.
While we are making significant progress and are beginning to see the benefits of big data and analytics in the audit, we recognize that this is a journey. A good way to describe where we are as a profession is to draw parallels with the TV and film subscription service Netflix.
When the company started in 1997, it adopted a DVD–by–mail model. Netflix always knew that the future was in online streaming of movies, but the technology was not ready at that time, nor was high–speed consumer broadband as prevalent as it has since become.
Today, we are engaged in the audit equivalent of DVD–by–mail, moving data from our clients to EY for use by auditors. What we really want is to have intelligent audit appliances that reside within companies’ data centers and stream the results of our proprietary analytics to audit teams. But the technology to accomplish this vision is still in its infancy and, in the interim, we are delivering audit analytics by processing large client data sets within our environment, integrating analytics into our audit approach and getting companies comfortable with the future of audit.
The transition to this future won’t happen overnight. It’s a massive leap to go from traditional audit approaches to one that fully integrates big data and analytics in a seamless manner.
Barriers to Integration
There are a number of barriers to the successful integration of big data and analytics into the audit, though none are insurmountable. The first is data capture: if auditors are unable to efficiently and cost–effectively capture company data, they will not be able to use analytics in the audit. Companies invest significantly in protecting their data, with multilayered approval processes and technology safeguards. As a result, the process of obtaining client approval for sharing data with auditors can be time–consuming. In some cases, companies have been reluctant to provide data, citing security concerns.
Moreover, auditors encounter hundreds of different accounting systems and, in many cases, multiple systems within the same company. Data extraction has not historically been a core competency within audit, and companies don’t necessarily have this competency either. This results in multiple attempts and a lot of data-related back and forth between the company and the auditor.
Today, extraction of data is primarily focused on general ledger data. However, embracing big data to support the audit will mean obtaining sub-ledger information, such as revenue or procurement–cycle data, for key business processes. This increases the complexity of data extraction and the volumes of data to be processed.
While it is reasonably easy to use descriptive analytics to understand the business and identify potential risk areas, using analytics to produce audit evidence in response to those risks is a lot more difficult. One problem with relying on analytics to produce audit evidence relates to the “black box” nature of the way in which analytics works, with algorithms or rules used to transform data and produce visualizations or reports. When the auditor gets to this stage, they need to find the appropriate balance between applying auditor judgment and relying on the results of these analytics.
The value of integrating big data and analytics into the audit will only be realized when used by auditors to influence the scope, nature and extent of the audit. This will require them to develop new skills focused on knowing what questions to ask of the data, as well as the ability to use analytics output to produce audit evidence, draw audit conclusions and derive meaningful business insights.
In addition, it requires a ground-up initiative to better understand and influence the education students get at universities and colleges, enhancing learning and development programs, and establishing the appropriate implementation and enablement programs to support audit teams to integrate big data and analytics into the audit effectively.
Analytics Dilemmas
A further issue is how auditing standards and regulations can be aligned with the use of data analytics. In general, the auditing profession is governed by standards that were conceived years ago and that did not contemplate the ability to leverage big data. Below are four areas that require further consideration.
Substantive analytical procedures: these examine the reasonableness of relationships in financial statement items to uncover variations from expected trends. However, the standard doesn’t cover using big data–based analytics to provide “substantive evidence.” One of the key differences with analytics techniques is that the procedures are used to identify unusual transactions or misstatements, based on the analysis of the data, and usually without the auditor establishing an expectation.
Big data and these kind of analytics techniques did not exist when the standard was conceived, so thet were not considered as a source of audit evidence. The gap creates uncertainty regarding the relevance and applicability of analytics in providing anything more than indicative evidence.
Validating the data used for analytics: as auditors receive information from the client, they determine its clerical accuracy and completeness, and whether it is appropriate as audit evidence. This applies whether they receive printed documents (such as contracts) or electronic data.
But audit analytics do not use or rely on reports generated by the system; instead, relevant master and transaction data is extracted directly from the underlying databases. Procedures are then performed to validate the accuracy and completeness of the data, and it is reconciled to system-generated reports. The auditor is then confident that their analysis is based on the same data the company uses to produce its financial information.
While the standards provide some guidance in this area, they could not have anticipated the type and volume of data that auditors are extracting. Inevitably, there are limitations in the extent to which auditors can derive evidence from the procedures that may be performed in relation to such data.
Defining audit evidence: the standards provide a hierarchy of evidence, with third–party evidence at the top and management inquiries at the bottom. However, the standards do not indicate what type of evidence analytics provides. It is possible to relate some of these types of tests to the current framework in the standards, but not all. Without a proper description of the type of evidence that analytics provides, auditors are reluctant to claim it as evidence, thus negating the benefits.
Precision: an audit is designed to detect a material misstatement. When companies record revenues amounting to billions of dollars and users of the financial statements expect them to be free of material misstatements, what level of precision do the auditors require of their data analytics? The standards need to provide more guidance in this area.
Ultimately, the audit of the future could look quite different from the audit of today. Auditors will be able to use larger data sets and analytics to better understand the business, identify key risk areas and deliver enhanced quality and coverage while providing more business value.
But to achieve this transformation, the profession will need to work closely with key stakeholders, from the businesses they are auditing to the regulators and standard–setters.
Roshan Ramlukan is a partner in EY’s Global Assurance Team and leads the organization’s Audit Transformation Analytics initiative. He is based in Boston.
This article first appeared in Financial Executive magazine.