Viewpoints: Putting Automation to Work

What tasks are being automated?

Organizations initially developed automation to enhance the customer experience and help expedite common first-line processes. With these successes, more companies are now allocating funding and resources to internal audit. 

To understand where automation should be applied, the function should focus on how much time and effort is saved through its use. This will allow it to rank which areas should be addressed first to provide the biggest return on investment. To date, that has been areas with highly repeatable controls and processes. 

What are some challenges in adopting automation?

Many organizations’ controls are highly manual, which makes it difficult to quickly adopt automation. Organizations need to be strategic about the areas they want to automate. Internal auditors can help because they come across a wide range of issues and problems on the job. Once their understanding is paired with a forward-thinking approach, one that aligns the audit plan with an organization’s overarching objectives, it should be much easier to decide which departments and processes would most benefit from automation.

Another pain point is around skills and training. While it may be easy to go outside of the organization to obtain the skills to develop and implement automation, who is going to be responsible for overseeing these changes in the long term?

Finding and retaining or training employees can be time-consuming and costly, but it’s an important investment to make. When companies introduce automation, it’s critical to have employees who not only oversee the process but can use data to make smarter decisions moving forward.

Another challenge relates to funding and internal audit’s reputation in adding value. Internal audit is often viewed as a cost center and not as a strategic function, and therefore automation funding may end up elsewhere. However, leaders who view internal audit strategically and make the right investments will have a competitive advantage over their peers and will reap the enormous benefits automation presents for expanding risk coverage and driving enterprise value.

What are the biggest benefits of automation? 

With growing responsibility for risk oversight, especially in complex areas such as cybersecurity and ESG, today’s internal audit teams are busier than ever. Automation can replace time-consuming and repetitive processes with more efficient workflows that reduce costs and eliminate the need for additional headcount.

There are only so many controls that a single internal auditor can check manually, and the assessments typically reflect a single moment in time. But when automation is appropriately integrated, it can provide continuous, real-time insights and constant assurance that controls are working as they should, reducing the risk of a compliance breach. This continuous monitoring also scales easily: As audit work increases with organizational growth, automation scales with those needs. 

Moreover, automation reduces the risk of human error — which is never fully avoidable when using manual processes. All auditors strive to reduce human error, of course, but error reduction is particularly important in industries where accuracy is crucial, such as manufacturing, finance, and healthcare. 

What are some considerations for auditors using automation? 

Before they begin using automation, auditors should have a clear understanding of the processes they want to implement, as well as their underlying documentation. This includes system specifications, policies, and procedures.

Keeping the aforementioned risks in mind, audit teams should identify vulnerabilities and potential impacts on objectives, focusing on areas where automation has the highest risk exposure. Making sure that the automated systems adhere to relevant regulatory requirements, industry standards, and internal governance frameworks is also key, especially where data protection, privacy, and cybersecurity are concerned. Additionally, auditors should ensure the data used in automated processes is reliable and complete. The same goes for any controls implemented within automated systems. Audit teams should thoroughly review access controls, segregation of duties, error handling mechanisms, and monitoring and logging practices. 

Finally, keep in mind that while automated processes are designed to perform specific tasks efficiently, they may lack the flexibility and adaptability of human workers. Unforeseen circumstances or changes in requirements may call for human intervention or system reconfiguration. Audit analytics solutions that offer scalability and can adapt to changing needs may address these concerns and potential risks.

IIA Resource:

Auditing Business Applications