As Audit delves into data to bring even greater assurance to organisations and markets, it can also bring attention to performance, risk and regulation issues. And with advances in cognitive computing underway, the potential is growing.
The amount of data being collected by organisations is exponentially increasing, but a key challenge for management is to harness it and extract the most valuable information for decision making.
"The general feeling is that there is all of this data, but it can be hard to make sense of it all, though it should be able to give you insights," says Peter Russell, Australian National Head of Audit Data & Analytics (D&A), KPMG.
When organisations delve into their information, and ask the right questions, they can achieve a more transparent view of their status.
"Data can allow you to make better business decisions and create better solutions, and products and services for customers," Russell says.
In the audit process, data can aid greater accuracy, leading to more confidence in the outcome. This is vital when boards, stakeholders and the public are scrutinising companies tightly. However, the relationship between D&A and Audit can also run deeper, with Audit in a clear position to help organisations see the value of their data.
Russell says when an auditor is armed with all the data that is available to the business and the relevant market, there is potential to do a "diagnostic of the 'patient' in a way that could never be completed before".
"Now you can X-Ray the business, and also the industry, to give them information about the health of their performance, and the risk associated with their performance, as well as comparing that against other indicators from data that is available," he says.
This process is further explained by Roger O’Donnell, Global Head of D&A, Audit, KPMG International, and Bill O’Mara, Global Head of Audit, KPMG International, in a report, Data and analytics in the audit:
“It helps to think of a company’s financial information as being organised in layers… Using the D&A tools, we can start by analysing the general ledger… From here – the top-line ‘quantitative’ analysis – we can proceed to an in-depth ‘qualitative’ analysis of the books, examining the specific and relevant sub-ledgers.”
Christina Flux, Senior Manager, Audit & Assurance, KPMG, adds that D&A is helping auditors to look at 100 percent of information sets, rather than relying on manual sampling.
"By looking at 100 percent of the data, you may realise there is something you don’t know, such as a 'process on the side', or a 'little exception' to the rule," she says. "Is this an outlier? Is it unexpected? Maybe it is part of the way they do business, but we hadn't programmed the routine fully."
In addition to looking at what exists now, D&A can help auditors and companies predict what could occur in future. O’Donnell and O’Mara explain:
“Predictive analytics can play a significant role in assessing the forward-looking assumptions that are also involved in arriving at some of the numbers. For example whether a company’s projections about future revenue are reasonable estimates.
Flux says the combination of assessing existing information and looking ahead means auditors get a better understanding of how organisations manage every step in their processes, which can help build a more robust and useful audit.
As Audit delves into data, it has the opportunity to highlight to organisations how their information can be used to change outcomes. A simple example could be with public transport. Russell says with electronic ticketing, information on customer behaviour is at the company's fingertips, which can be used to enhance the customer experience.
"A customer can be on their iPhone and see that bus 270 is coming along, and you can tell them whether it is full, and that there is another bus in 2 minutes," he says.
From the business standpoint, it gives insight into transport requirements, enabling better planning to occur.
"And then from an auditing standpoint, you get all of that data, and you can validate the data back to every bus trip that was taken, so you can get much better audit evidence as well," he says.
Flux says D&A is not just for large corporations, but smaller companies can also benefit.
"One audit team did a data analysis of a small organisation and found out there were duplicate vendors in the system with other relevant information missing. This is consistent for so many smaller organisations," she says.
As risk becomes more interconnected, D&A can help organisations better identify and understand their exposure, enabling them to act. This spirals to help stakeholders have more confidence in an organisation.
"By analysing the data you can identify outliers that can point you to problems and excesses of risk. You may see you have a huge portfolio of loans that are maturing, and that could lead to market issues," Russell says.
Russell provides the example of a company that was fined for sending vast quantities of money to the US, which was all done by one customer.
"From a data point of view, if you could see that just one customer was doing all of the deals, you would ask, 'what is going on here, what is the risk here, who is this customer?' It allows you to understand the risks in a way that you couldn't before," he says.
Other issues unveiled could be an over-reliance on one supplier or demographic, or people in a geographic region that are changing their behaviour.
"A lot of what can be found are customer activity risks. We identified for a bank that one customer had 300 deposit accounts. Customers can game your system and do things you are not even aware of,” he says.
Since the global financial crisis, regulation of financial institutions, insurance organisations and other sectors that sell products and services has increased, and it can be challenging to keep up with changing requirements.
An audit of data could detect issues that are misaligned with regulation. Russell says in one instance, a company that was regulated to sell to people over 18 years old was found to be selling to younger customers. It also had a flood of customers aged 116. An investigation discovered that during a system change, a random date of birth was entered for all migrated customers.
D&A may be enhancing assurance, along with bringing deeper insight into their risks and regulatory challenges. However, further insights are on the way with cognitive computing. KPMG's Dynamic Audit is engaging the power of IBM Watson to take Audit into the future.
"It is a fascinating area of research and investment. Cognitive is about reading and interpreting information. For example, reading and interpreting loan files to look for risk," Russell says.
O’Donnell and O’Mara explain: “The use of cognitive technologies and machine learning, the development of process robotics – all of these are exciting areas that could have far-reaching potential for the audit.”
Russell also sees great potential for cognitive computing to bring immense insight to organisations, and fuel further confidence in the audit process and capital markets.
Russell expects that as D&A takes a more central role in the way people conduct and gain value from the audit process, formal audit reporting will shift.
“More integrated reporting could include the required financial results, along with environmental statements, the whole framework. The D&A findings need to be in a corporate governance statement, as well as in the information that organisations are putting into the marketplace."
Flux explains that the audit effort can be spread across the year, allowing auditors to report more regularly to management.
“When systems are well-controlled we may be able to move to continuous auditing where the audit team receives an automated alert that a specific event has happened, such as a 3-way match control being disabled, a user’s approval threshold exceeding a certain limit or assigning an inconsistent combination of roles to a user,” she says.
Overall, D&A in an audit supports an auditor’s primary responsibility to express an opinion on financial information. Incorporating D&A throughout the audit, and throughout the year, goes even further to also analyse information relevant to the business’ operations, performance, internal controls and future concerns.
© 2018 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.