Articles Rami Bareket, CRISC, CISA Dec 11, 2023
As groundbreaking technology rapidly transforms the world, internal audit must adapt and leverage advanced tools to elevate their work.
When auditing a business process, understanding the process is crucial. In traditional audits, auditors rely on interviews with audit clients to comprehend the business process, often requesting examples from system records, reports, and documents.
The rapid development of artificial intelligence, machine learning, and process-mining technologies is offering a more comprehensive solution for internal auditors. By harnessing advanced tools, internal auditors receive broad, in-depth information about business processes and controls during their risk assessment, enabling them to better understand the processes and make audits more efficient.
Process-mining tools examine business processes by probing the transactions entered and generated within a system. They use this data to construct a flowchart of the process’s workflow, which provides insights into the various transaction workflows taken in the process and highlights the different operations and steps performed in each workflow. Additionally, the tools provide statistical information, such as transaction volumes and their proportions within each operation or stage.
Using the process-mining approach, internal auditors gain an understanding of the business process and its constituent actions and phases before interviewing the client. Armed with this knowledge, auditors can focus on asking qualitative questions related to the data, actions, and phases within the process. They can explore the reasons behind differences among workflows — particularly those less commonly taken — leading to more insightful audit discussions.
Advanced tools give internal auditors direct access to data needed to perform independent analysis. In the past, auditors needed to request data from the business unit, which required assistance from IT personnel. Then the auditor would need to verify that the data was accurate, which was time-consuming and error prone. Advanced tools streamline the gathering of data. The auditor has immediate access to the necessary data, which saves time, reduces the potential for errors in data retrieval, and ensures data integrity.
Improved Efficiency. Advanced audit tools enable audit teams to be more efficient and shorten audit times. Where past auditors approached their tasks without prior knowledge, modern auditors now enter engagements equipped with comprehensive insights about the business process under review. The tools provide a clear understanding of the various workflows within the process, including those that are less commonly followed. Additionally, auditors have access to detailed data and statistics related to the business process.
For example, auditors can quickly access key metrics such as the total number of suppliers engaged, the number of new suppliers added in a given year, and the annual expenditure associated with procurement activities. Armed with this knowledge, auditors can efficiently focus their efforts on areas of high importance and potential risk, optimizing their audit approach and ultimately enhancing the effectiveness of the audit process. An example is focusing on purchases from suppliers that have increased substantially over one year compared to purchases from other suppliers for the same goods or services.
Another audit application is examining complex contracts with suppliers in which substantial additions have been made to the agreement over several years. Focusing on such high-risk areas can enable audit teams to deliver more insightful audits.
Enhanced Analysis and Comparison. Organizations with multiple subsidiaries often use several different enterprise resource planning (ERP) systems. Internal auditors can use advanced tools to perform comprehensive analysis and compare business processes and data across their various entities and ERP systems.
This approach enables auditors to efficiently analyze and compare business processes to identify similarities, differences, and areas for improvement across the organization’s subsidiaries (see “Workflow Analysis”). By centralizing this analysis, companies can streamline their operations, enhance consistency, and establish best practices throughout the organization.
This capability gives internal auditors a holistic view of the organization’s operations, which produces better insights, data-driven decision-making, and enhanced coordination among an organization’s business units and subsidiaries. Ultimately, these gains can improve organizational performance and competitiveness.
As use of process-mining tools continues to grow within internal audit, organizations should consider when and how to hand the tools over to other assurance functions. For example, should they be used by the compliance and risk management functions of the second line, the managers of the business units in the first line, or both?
The answer to this question depends on various factors, including the organization’s maturity level in using advanced tools, the driving force behind their adoption, and the power dynamics within the control environment. One approach is for the second line to be responsible for using the tool for continuous monitoring and control, while internal audit evaluates how those functions use the tool, including verifying that users check and address all exceptions that have arisen.
By carefully considering the organizational context and aligning the use of process-mining tools with the appropriate stakeholders, organizations can maximize the tool’s benefits and effectively navigate the complexities of their control environment.
In addition to examining processes, internal auditors can use advanced tools to monitor, analyze, and detect anomalies in business transactions. Such testing can encompass evaluating the adequacy of the defined base rules, examining how the business monitors and addresses exceptions, and assessing whether the organization learns from past experiences to drive improvements. To obtain the most accurate results, auditors should follow some guiding principles.
Establish a direct connection to the production database. This connection to financial ERP, sales, human resources, and other systems makes it easier for auditors to retrieve and extract data. It is essential to ensure both quick response and retrieval times, while avoiding any negative impact on the production system such as slowing down response times or disrupting existing users. Striking the right balance is crucial to maintain system performance and user experience.
Define base rules. This comprehensive list of rules is designed to identify exceptions or anomalies. In the context of internal auditing, it serves as a checklist based on best practices specific to the business process being examined. For example, base rules in the procurement process include identifying instances where a supplier is duplicated in the master data, detecting duplicate payments made to suppliers, and flagging cases where a supplier’s bank account branch is located in a different country. These rules help ensure the accuracy and integrity of the audit process by highlighting irregularities or risks.
Minimize false-positive cases. A weakness of some analytics tools is that they flag many anomalies, but a large percentage of them are false positives. That is beginning to change as internal auditors begin to use AI and machine learning tools to identify and eliminate false-positive cases. Leveraging these tools in tandem with fine-tuning the base rules can further lower false positives. It is important to acknowledge instances where tools fail to detect suspicious movements or transactions during data retrieval. When this happens, auditors won’t know about these problems.
Ensure the tool investigates anomalies effectively. For example, internal auditors could investigate a suspicious invoice using a tool that enables them to drill down to the granularity of the billing-line level. The tool also could display all invoices from the same supplier with identical billing information and provide other relevant details the investigator requires. Such capabilities significantly facilitate the investigative process, reducing the time required for investigations and enhancing trust in the tool.
Select an intuitive interface. Just like any other software, advanced audit tools should have a user interface that provides the functionality users need and is easy to use.
As groundbreaking technology rapidly transforms the world, internal audit must adapt and leverage advanced tools to elevate the quality, efficiency, and optimization of audit work. Using these technology solutions effectively requires an unwavering commitment to innovation and progress from all relevant stakeholders, with internal auditors at the forefront. Internal audit must rise to the occasion. Empowered by knowledge and cutting-edge tools, it can shape the future of internal auditing, ensuring its relevance, effectiveness, and value in an ever-evolving world.
A version of this article was originally published in the IIA–Israel Journal.
Relevant Guidance for IIA Members: