Final Report: Data Analytics Maturity

2016

Vonya Global:

Data Analytics Maturity

Final Report

October 2016

Table of Contents

Executive Summary .......................................................................................................................... 3

Maturity Curve Explained ................................................................................................................. 4

Comparative Analysis ....................................................................................................................... 4

Internal Audit Department Charter .................................................................................................. 5

Maturity Factors ............................................................................................................................... 6

Maturity Comparison........................................................................................................................ 9

Maturity Curve ................................................................................................................................ 10

Global Comparison ......................................................................................................................... 11

Page | 3 Data Analytic Maturity

© Copyright 2016 – Vonya Global LLC – All rights reserved

Executive Summary

Vonya Global surveyed a cross-section of business professionals in order to assess the deployment

of data analytics within the internal audit profession. The participants were mostly internal

auditors, from a variety of organizations and industries. The goal of the study was to plot the use

of data analytics along a maturity curve.

The majority of the information was collected via an online survey that was open for 8 weeks and

accessible through the Vonya Global website. Respondents volunteered their time and their

responses were anonymous.

Data Analytics has been a trending topic in the internal audit profession for over 20 years and it

continues gaining momentum as the concerns around “Big Data” have grown. There are numerous

software tools ranging from desktop to cloud to enterprise applications. Many software providers

have created visualization tools to aid the presentation of data and to help executives make data

driven decisions, some of these tools are “bolt-ons” to current data analytic software while others

are stand alone applications.

A search of the Institute of Internal Auditors (www.theia.org) webiste reveals 213 entries for Data

Analytics in North America alone. This includes white papers, continuing education sessions,

opinion pieces, and entries from the IIA Common Body of Knowledge (CBOK). With all of this

information available, and the incredible investment by the software companies, many are left

wondering why more internal audit departments don’t leverage data analytics. While many

studies have been completed on the use of data analytics, this study observes data analytics on a

maturity curve.

While this is the first such study conducted by Vonya Global on the topic, the firm has released

previous reports on the Strategic Role of Internal Audit and Fraud Risk Mangement. The Strategic

Role of Internal Audit contrasts the opinions of Internal Auditors with those of Executive

Management on Internal Audit’s ability to fill a strategic role within the organization. The Report

on Fraud Risk Management also contrasted the opinions of Internal Auditors with those of

Executive Management on the effectiveness of fraud risk management strategies. Both reports

can be downloaded from the Vonya Global website.

SUMMARIZED STUDY DEMOGRAPHICS

Responses by Company Type:

Private 29% Public Large Cap 28% Public Mid or Small Cap 22% Accounting Firm / Consulting Firm 9% Not-for-Profit 5% Government 4% Higher Education 3%

Responses by Employee Type:

Chief Audit Executive 41%

Internal Auditor 37%

Other Management 10%

Consultant 7%

Executive Management 3%

Board Member 2%

Responses by Location:

North America 61% Asia 13% Europe 10% Africa 5% South America 5% Australia / Pacific 3% Middle East 2%

Average Time to Complete Study:

4 Minutes

Rounding errors may cause the numbers about to not equal 100%

Page | 4 Data Analytic Maturity

© Copyright 2016 – Vonya Global LLC – All rights reserved

Maturity Curve Explained

The term "maturity" relates to the degree of formality and optimization of processes, from ad hoc

practices, to formally defined steps, to managed results, to active optimization of the processes.

In this study, Vonya Global used a 6-level process maturity continuum - where the highest level is

“Optimized,” an ideal state where processes would be systematically managed by a combination

of process optimization and continuous process improvement, and the lowest level is “Not at all,”

where an internal audit department doesn’t use data analytics.

The 6 stages on the maturity curve included:

1. Not at all

2. Informal

3. Periodic

4. Moderate

5. Advanced

6. Optimized

Comparative Analysis

Two additional data points were collected as part of the study:

Ability of the Internal Audit Department to fulfill its charter and add value to its

stakeholders.

Whether data analytics enhances the Internal Audit Department’s ability to add value to

its stakeholders.

The expectation in this report was to compare and contrast the information collected.

“I see three key challenges after years of

working to mature our Data Analytics

(DA) application:

1. Having individuals enthused and

dedicated to conducting the DA.

2. Gaining access to the right data

at the right time.

3. Understanding the data needed

and how to use the data to meet

related objectives."

Page | 5 Data Analytic Maturity

© Copyright 2016 – Vonya Global LLC – All rights reserved

Internal Audit Department Charter

Internal auditing is an independent, objective assurance and consulting activity designed to add

value and improve an organization's operations. It helps an organization accomplish its objectives

by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk

management, control, and governance processes (source: The Institute of Internal Auditors).

An internal audit charter is a formal document approved by the audit committee that defines the

internal audit department’s purpose, authority, and responsibility. A charter establishes internal

audit’s position within an organization; authorizes it to access records, personnel, and physical

property that are relevant to internal audit work; and defines the scope of internal audit activities.

The Institute of Internal Auditors (IIA) provides a template for an internal audit charter on its

website.

The internal audit charter sets the standard for the internal audit department and corresponding

expectations. Meeting the expectations defined in the charter is the primary responsitility of

internal audit. Respondents to this study almost universally believe their internal audit

department fulfills its charter and adds value to the organization. As depicted in the chart on the

left, 70% strongly agree while another 25% slightly agree that internal audit fulfills its charter.

Is it possible to fulfill the internal audit charter without having a

robust data analytics practice?

The question above is one of the prevailing questions many data analytic software providers have

been asking for more than a decade. The answer depends on a variety of factors and will begin to

take shape on the folowing page.

Page | 6 Data Analytic Maturity

© Copyright 2016 – Vonya Global LLC – All rights reserved

Maturity Factors

The study revealed the investment into data analyics is based on:

Available time allocated to the internal audit team

Access to software tools

Mission/Vision/Strategy of the Internal Audit Department

Internal Audit Department Budget

Skills within the Internal Audit Department (#1)

Data integrity (#3)

Access to data (#2)

0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

Data Access

Data Integrity

Skill

Budget

Mission/Vision/Strategy

Tools

Time

What is your biggest challenge with Data Analytics?

“Data analytics allows us to

identify trends and themes in

data to improve our decision

making and to identify anomalies

and outliers for further root

cause analysis. This allows us to

more efficiently deploy our

resources for maximum value.”

Page | 7 Data Analytic Maturity

© Copyright 2016 – Vonya Global LLC – All rights reserved

While internal audit can fulfill its charter without a data analytics program, a robust data analytics

program could make the process easier and also help add value to the organization.

Understanding the challenges associated with data analytics should clarify the steps required to

advance through the data analytic maturity curve. In order to advance:

1. Time must be budgeted and allocated.

“Time - The use of data analytics, especially at the infancy stage requires a significant

investment in time to identify good data sets and meaningful analytics, which are often

arrived at through trial and error. When trying to accomplish audits timely, that unknown

quantity of time required to get value of analytics is too hard to incorporate.”

2. Tools must be available.

We struggle with having the right “Resources/tools available to gather and analyze large

files timely.”

3. Data analytics must be part of the mission of internal.

“Transforming the culture, mindset, and process of Internal Audit to build data analytics

into the DNA of every auditors into every audits we do.”

4. Funding must be available to purchase the tools and provide training.

“The variety of data received for so many audits requires constant changes in our

approach to analysis as well as in the analyses themselves. It is difficult then to keep the

staff current on all the potential methodologies available.”

5. Auditors must learn the appropriate skills.

“Having someone knowledgeable who can perform analytics and thinking through what

analytics will help us accomplish the audit objective.”

“Training the audit staff on the selected data analytic software and then maintaining

proficiency with the data analytic software since it is infrequently used.”

Page | 8 Data Analytic Maturity

© Copyright 2016 – Vonya Global LLC – All rights reserved

6. The data must be readily available.

My biggest challenge is “Getting the right data. Knowing what to analyze and getting the

output. Using the right tools for analysis.”

“We have so many disparate systems that data acquisition seems to be our biggest

challenge.”

7. The data must be accurate.

“A lot of struggles within our data warehouses to accurately identify all of our tables and

what everything is mapped to.”

Page | 9 Data Analytic Maturity

© Copyright 2016 – Vonya Global LLC – All rights reserved

Maturity Comparison

Value drives decisions, especially when it comes to data analytics. Those who percieve value in

data analytics make the required investments to move up the maturity curve. Whereas those how

perceive less value in data analytics do not make the investments to move up the maturity curve.

“It allows the auditors to use a risk based approach and reduce the data sets down to the

highest risk subsets that can then be sampled/reviewed.”

As depicted in the charts on the left, the respondents to the study who are at the top of the

maturity curve find far move value in their data analytics program than those who are at the

bottom. As decribed in the previous section, there are many factors that impact an internal audit

departments ability to leverage data analytics.

“Data analytics allows us to identify trends and themes in data to improve our decision

making and to identify anomalies and outliers for further root cause analysis. This allows

us to more efficiently deploy our resources for maximum value.”

Page | 10 Data Analytic Maturity

© Copyright 2016 – Vonya Global LLC – All rights reserved

Maturity Curve

Nearly 80% of the respondents to this study classified themselves at a maturity of either Moderate

or lower, yet over 50% responded that the use of data analytics enhances internal audit’s ability

to add value.

“The use of data analytics affords us "time savings (greater testing efficiency), provides

the ability to analyze entire populations (greater testing effectiveness), directs audit focus

at high risk areas by using planning analytics, and allows more effective presentations to

audit customers as evidence of our findings.”

With proper use of data analytics, “information is more readily available in an easily

digestible format to enhance decision making” and it provides “transparency into

potential business problems.”

The use of data analyatics allows for 100 percent population testing which should increase

“audit testing efficiencies over exception analysis” and create “stronger audit evidence”

when making “process improvement recommendations.”

The AICPA released a white paper in 2014 that stated: “Although auditors embrace and make

extensive use of information technology, little has been done to consider how auditing might be

transformed by it. For the most part, IT has been used to computerize and improve the efficiency

of established processes rather than transform or replace them. Consequently, improvements

have been incremental rather than transformative.”

According to 2016 statement made by the Corporate Executive Board, “Nearly two-thirds of audit

departments recently made or are planning to make significant investments in data analytics.”

If both of the above statements are correct, more internal audit departments will be advancing

through the data analytic maturity in the near term. Internal Audit departments will then move

beyond the incremental and into the transformative.

Page | 11 Data Analytic Maturity

© Copyright 2016 – Vonya Global LLC – All rights reserved

Global Comparison

Based on the responses to the study, the global internal audit community is slightly more advanced

than audit departments in North America. However, there was not enough data collected to break

this information down further by country or region.

Conclusion

The purpose of this study was to plot the use of data analytics on a maturity curve to provide a

benchmark for internal audit departments. The reponses indicate that the mature data anlaytic

programs provide the most value. There are many options for data analytics ranging from standard

desktop applications to robust enterprise solutions.

There are many factors which limit the use of data analytics, as described on page 6, some of which

are outside the control of the internal audit department. Advancing up the maturity curve is a step-

by-step process that requires adressing each obstacle one at a time. It also requires commitment

and dedication over a long period of time. Based on the opinions expressed in this study, it appears

the reward is worth the effort.

This report is a publication of Vonya Global LLC; an international consulting firm specialized in

enhancing corporate governance by providing internal audit, internal control and risk assurance

services to a wide range of companies. Duplication without the expressed written consent of

Vonya Global is strictly prohibited. For more information about Vonya Global please visit

www.vonyaglobal.com.