Data and analytics (D&A) will change the focus of the audit process by removing virtually all transactional work and much of the effort in assessing key audit judgements. Auditing will always be about evaluating financial statements but with a reduction in process work, more time can be spent on business risks and the related consequences.
Most CEOs recognise the need to become a disruptor, rather than a disrupted business. In the 2015 KPMG CEO survey, 30% of CEOs stated a desire for increased risk-taking. D&A modelling will help by predicting the likely outcomes and the probabilities. CEOs that embrace it will be able to innovate with reduced and more measured risk and outperform those who do not.
Audit committees will also see their focus change with more opportunity to focus on business risk. D&A will take care of audit quality and key judgements far beyond the traditional manual audit. When you look at 100% of the transactions, or model every possible judgment, the need for debate over the accuracy of financial statements will diminish. Companies will also have absolute knowledge of the true level of outliers (both transactions and judgments) across the organisation and so be able to respond to these quickly and track remediation in real time.
The logical end point for D&A is therefore self-auditing, in real time, with outlier transactions and judgment immediately flagged by the system. A few companies already do some of this with impressive dynamic monitoring systems. However, the cost is prohibitive for all but the most wealthy. But as technology becomes more adaptable, and artificial intelligence is used to flip the tools to automatically fit different scenarios, the cost will reduce. Then, once clients have these in place, what does an external audit achieve other than to confirm nil exceptions?
But all this technological progress does not mean the need for judgement and analysis will be removed.
First, nil exceptions is a utopia which assumes no manual intervention and every transaction conforming to the norm. This is difficult to imagine. To some extent, knowing about every outlier can increase the responsibility for a detailed and careful impact assessment on the financial statements.
Second, the reliability of the complex tech identifying the outliers and their impact will need to be confirmed. Also the increased use of real-time technical data and predictive modelling (for example on complex judgements) will require a new type of auditor, and audit committee, who can understand this flow of information and whether systems really are ‘doing what they say on the tin’.
So the people involved in auditing will change, with tech specialists increasingly in demand as programmers, users and auditors of the technology. We will also need to find tech specialists who understand the world of business and its related risks. I suspect we will see technology specialists becoming non-executive directors in the future as well. The conversation about technological process might be short, but somebody on the audit committee will need to follow the detail.
In many ways the principle role of the audit committee will remain constant but technology will be much more central to their process. Their focus will shift towards using data outcomes to really inform a company’s business risks and governance process. The audit becomes a confirmatory ‘tick in the box’ with the more important analysis being a measure of company’s business risks, their risk appetite and risk mitigations. I can easily see a shift from ‘Audit Committees’ to ‘Audit & Risk committees’ and then ‘Risk Committees’.
Audit firms, companies and audit committees all need to make changes now to their recruitment strategies to reflect the coming changes and upskill their current workforce. There will be a challenging transitional period, when the supply of people with the right skills falls far short of the demand, while others catch up with the available - and rapidly changing – technology.
Despite this D&A revolution, the requirement for independent challenge and intelligent analysis will be as important as ever.