2020 has brought many challenges to internal audit, but data analytics could be a helpful tool. Sabrina Serafin interviews Bradley Carroll, Principal and leader of Frazier & Deeter’s Financial Services Industry Group and Data Analytics team. Bradley discusses how data analytics could enhance the performance of internal audit teams especially in a remote working environment.
Enjoyed this episode? Follow Culture of Compliance on iTunes, Google Podcasts, Spotify or wherever you listen to podcasts.
Culture of Compliance: Data Analytics in 2020
This transcript was assembled by hand and may contain some errors.
It has been edited for readability.
Sabrina Serafin Frazier & Deeter’s Culture of Compliance Podcast Series where we discuss compliance as a competitive advantage in today’s marketplace. I’m Sabrina Serafin, Partner and National leader of Frazier & Deeter’s Process, Risk and Governance Practice.
Today, we’re talking to Bradley Carroll, a principal in our firm who is leading both our Financial Services industry group and our internal data analytics team. Prior to joining Frazier & Deeter, Bradley served in senior audit rules for banks of varying sizes. Bradley, welcome.
Bradley Carroll Thanks, Sabrina. It’s great to be here.
Sabrina You know badly a recent survey published by Frazier and Deeter found that over 50% of respondents were considering an increase in their use of data analytics this year. So, today, we want to talk about how internal audit teams can use data analytics effectively to enhance their team’s performance, and how it might work to ramp up use of analytics under the current remote work environment.
Bradley, can you start us off by first defining what you think of when we say data analytics?
Bradley Sure, Sabrina. I would say that data analytics is very equivalent to internal audit, we’re constantly analyzing data, whether it be stratifying samples, whether we’re testing attributes, whether we’re mainly scanning, a lot about internal auditors have historically done, is analyze data.
When you hear the buzz word data analytics today, though, it’s not talking about yesterday, we’re talking about in today’s terminology we’re utilizing a software that is designed for auditors to be faster, more efficient, and provide better coverage. So, that’s going to help us eliminate our sampling risk, is going to help auditors analyze multiple simultaneous scenarios, looking for correlation among data to help us look for the anomalies and enter risk base or audits. In today’s society, companies are data hoards.
They just continue to compile data on all of us, and that’s where the term, “big data” comes from. But how do you get through that big data as an auditor? You need it, you need new tools. When we talk about data analytics, we’re talking about these new tools and the tools are not really new, but they have been around for a while. Back in the nineties, I used Mainframe focus at Wachovia Bank, so I’ve been using this for a long time, So, new is not really new, it’s just a new concept to something old is becoming much wider. That’s because we’ve got more powerful tools today, and their desktop versions instead of big, mainframe versions, you don’t have to learn the languages, it’s much more interactive and user friendly.
So, that’s why these are more widespread while they seem new. When we talk data analytics, we’re talking about these new tools that are much more widespread to provide better efficiency and help auditors add more value to what they’re doing.
Sabrina For those in the audience that are auditors, can you expand on the statement that you made, that it eliminates sampling risk?
Bradley Sure. So, we all know that sampling risk is the risk when you draw a sample that the sample leads an auditor to conclude one way and express that conclusion of the population based on the sample. The risk is that the population is not reflective of the sample characteristics. Your small sample provides one indication that is not reflective of your population. Using these new data analytic tools, we can eliminate sampling in certain areas so that we test the entire population. So, if you’re testing a population, you have no sample, therefore, you have no sampling risk.
Whatever the population tells you, from your analysis is what it is. One of the things that I have found is, when you’re eliminating the sampling risk there’s additional benefits. So, typically, in yesterday’s environment, we would tell a manager that we’ve selected the sample, and our sample error rate is 25%. We’re projecting that onto your population. So, you’ve got a 25% error rate of your population, which means you’ve got 100 misstatements. Go find them and go correct them. Okay, what if it’s not? What if your sample was highly skewed towards inaccuracies? And the true population really only has a 10% error rate. You’ve got managers out there looking for ghost inaccuracies that they don’t exist, but you told them, based on our sample, it’s 25%.
When you use data analytics, you can tell them, you have X number of misstatements in your population, and here they are. Now, that adds a tremendous amount of value. So, instead of telling them to go search for them, you’re telling them exactly which ones they are. When you get to that point, then you can provide a further data analytic and say, “These are the ones in your population. One of the similar characteristics we’ve noted about this, is that they all have this characteristic that’s really providing value to management”.
Sabrina So, you’ve got the auditors excited. You talked about big data and how organizations are just stewards and hoarders of data. So, there’s people listening who are thinking, “Great. This sounds wonderful, but how do we get started?” What’s your advice for teams who would be starting from the ground up?
Bradley So, the first thing that I would tell somebody who’s getting started is, what questions do you have? Define the questions to determine if data analytics can help you answer those questions? You can’t go out and just get a data analytic tool and think it’s a magic wand, and you can start doing data analytics. It’s just a methodology like everything in audit is, so what questions do you have about the data? Can a data analytic tool enhance your audit coverage? Then get into the evaluation of specific data analytic tools.
What tools are specifically geared towards manipulating the data and providing your answers? But who on your team has the aptitude? Do you have a strategic partner that can help you out to get you started? What is your budget? Do you need to do a cost benefit analysis?
And, most importantly, have you looked at the free trials that many of these data, analytics softwares offer, to see how they’re going to respond to your data? You need to talk to your IT department, or your data warehouse, whoever owns the data because data owners are very protective, and rightfully so. But they’re very protective of their data.
So, when you start talking about, I want to strip the data out, I want to get a data download, they get nervous, and again, it’s their data. They’re supposed to be protective of it. So, data access, you need to solve before you start selecting a tool. How are you going to get data access? Are you going to be granted data access? Are the two are going to be hooked up and running real-time? Are you going to get periodic downloads? Are you going to get ad hoc downloads fromdata upon request? All of this needs to be mapped out or thought out, because that’s going to depend on how you use data analytic tools, and what data analytic tools are going to be in the right situation for you.
You need to understand that data analytics is a step that’s along down the process. You first start with data access, then you’ve got to deal with data extraction, and then you have to deal with data cleansing, and then data manipulation, before you can get to data analysis. So, all of these are methodology components that you have to understand before you get started with this.
Sabrina Okay. So, can you walk us through an example, then of actually using analytics to support an audit?
Bradley So, Sabrina, we’ve had a tremendous opportunity here at Frazier & Deeter to use some of these in our PRG group. One that was really interesting was we had a small non-profit with limited staff, so their internal control structure is not mature just because of the small staff, so occasionally they like to have some targeted procedures that are specifically looking for any potential fraud. Well, we were able to use data analytics in this area where we compared their vendor file to their employee file to see if any employees were also listed as vendors.
So, just using a simple list matching technique, we used idea software to do this, and once we had the vendor and the employee file, we also looked at payroll to see if there were any ghost employees on payroll. We found that some employees and some vendors had common addresses. When we talked to management about this, management knew this and understood this but were very appreciative of the fact that we found this We were able to find that some of their vendors had multiple addresses, and, again, talking with management they were aware of this because they were different subscriptions. So, for example, AT&T might have an AT&T cable and an AT&T cellular, which have different addresses but it’s listed in the books as AT&T. So, our software picked those up as matches.
We also found one address with multiple vendors, and, again, we showed management this and they said, “That’s great that you’re able to find this. We knew that was happening but not to this extent.” And it forced them to go through and look at each one to validate it. So, this was a specifically geared towards any potential fraud that we were able to use data analytics for. We have geographical concentrations with clients that we look at. So, when we get their customer files, we can look to see how concentrated they are and how many dollars they have in a zip code or a state and how many clients they have. So, it can show a geographical concentration on a map.
We had another client that their model is a cost-plus model So, they’re hired to perform a service. They actually farm that service out to another vendor, and whatever that vendor charges them, they pay that vendor, provide a markup and then build their client. Well, there was an imbalance in the revenue and expenses, so they knew something was wrong. Using data analytics, we took the invoices from their vendors and compared it to the invoices that they had submitted to their customer and over the course of one quarter, we found that there was approximately $300,000 they had paid their vendors, but had not got an invoice to their client.
So, taking two different clients two different companies, two different AP systems, we were able to extract and manipulate the data and compare it. That was a huge, I mean, over one quarter, $300,000, that they had not invoiced but had paid out. We’ve done some journal entry testing, where we’ve looked for duplicate journal entries, missing journal entries, journal entries that are not balanced, journal entries that are over the limit for an approver or a poster. We’ve looked for journal entries that were posted on the weekends, off-schedule journal entry postings. So, there’s just tremendous things you can do
Sabrina Thank you, Bradley. Those are great examples, I heard you mentioned Idea, can you talk about other tools that you found most helpful for internal audit teams?
Bradley Yes. We use Teammate Analytics fairly widespread, because it is an Excel add-on. They probably wouldn’t be happy with me describing it that way, but that’s what gets people motivated to use it because it looks familiar, it feels familiar, and it’s a fairly powerful tool to get through a lot of your basic analytics. Yes, we’ve used Idea and ACL, both of those are very similar software, but we have clients who have one or the other, so we want to make sure that, in order to serve our clients, we’re familiar with both of those.
Tableau is a great presentation software. It is the one that draws the pictures, the graphs, one of the best ones that does that. A big competitor of Tableau that we also have is Power BI, we use Power BI to, to do the same things, to show the graph, to show the changes. And one we’re just getting into is KNIME, which is K N I M E, which is really good with big data sources.
We actually use KNIME to help out with a payroll that we were looking at for a client. The client had 500 employees, so it was a large payroll that it had across three different companies. In order to try to get their payroll, we use KNIME for that, which is one of our first introductions to KNIME and first, real uses of it. So, those are just some of the ones that we’ve used. There’re tons of them out there.
Most of them have free trials, which I would suggest looking at what software you think is going to work for you, and getting those free trials and giving it a test drive.
Sabrina Thanks, Bradley. Are there any other key pieces of advice you can offer for teams that are considering ramping up their use of analytics? Evaluating the different types of tools and solutions available? What are the key pieces of advice you want people to walk away from before heading into data analytics?
Bradley Number one is start now that’s the first and foremost thing. There’s a lot of intimidation with data analytics. The software tools, which causes inertia, we’ve always tested this way, will continue to test it this way. That’s not leading edge, that’s where you’re falling behind the average, but you mentioned earlier that 50% of our respondents say that they’re moving forward with the data analytic program so start now.
Talk to your staff, find someone who has the aptitude and the interests to pursue some of these trial versions of the software. Go through your audit program, look at the attributes you’re testing and say, “Could data analytics be used to test this attribute and will it provide more auto deficiencies?” Hookup with an inexperienced partner, Frazier & Deeter has several people who are experienced with data analytics. Bill Godshall just graduated from the Harvard Business Analytics program, which is a huge accomplishment.
We’re really proud of that and love to have that experience on the team, but don’t let intimidation and inertia stop you from this. The IIA over the past year has put out the Data Analytic Mandates Part 1 and 2, I would recommend to go on their website and download those. The IIA is telling you that they expect auditors to be using data analytics, so I’ll go back to what I say, start now.
Sabrina Well, Bradley, thank you so much for being with us today and sharing your experiences with data analytics with our listeners. And to our audience, thank you for listening to Frasier & Deeter’s Culture of Compliance Podcast. Please join us for our next episode as we continue to discuss transforming compliance requirements into investments in your business.