DATA-DRIVEN INTERNAL AUDIT – II PRACTICAL CASE STUDIES

BACKGROUND

Internal auditors are effective in their
delivery of professional services only by conducting value-added services.
Important value drivers for management are:

– cost savings / optimisation,

– prevention or detection of frauds,

– compliance with procedures and regulations.

These can only be achieved in today’s day and
age by adoption of technology for all stages in the life-cycle of the internal
audit. It may necessitate getting the data from multiple sources, analysing
huge quanta of data, comprehensively quantifying the findings and presentation
of data in intelligent form to various stakeholders for action to be taken for
improvement/s.

Let’s add the fact that we are moving to
remote auditing, again a necessity in today’s circumstances and which would
most probably become the new normal in times to come. Remote auditing is
already being practised by many organisations where internal auditors carry out
internal auditing for global, geographically-spread entities from their
internal audit teams based out of India.

In our earlier article (Pages 11-13; BCAJ,
August, 2020), we have discussed the necessity of adopting a data-driven
internal audit approach for efficient and effective internal audit, basically
explaining ‘why’. Now, we are offering the methodology to be adopted for making
it happen, in other words, ‘how’ to do it.

STAGES IN DATA-DRIVEN INTERNAL AUDIT

Using what you know

(1) DETERMINE WHETHER DATA ANALYTICS IS APPROPRIATE
FOR THE AUDIT

The potential benefits of using Data
Analytics can be judged from the audit objectives and the expected problems, as
well as from the data volume, the number of records and the number of fields.
Special consideration should be given to the usefulness of additional analysis
over what is currently provided by the system and whether any special factors
apply, such as fraud detection and investigation, Value for Money audits (in
obtaining performance statistics) and special projects.

(2) CONSIDER AUDIT OBJECTIVES AND WHERE DATA
ANALYTICS CAN BE USED

Data Analytics can be used in different areas
with different goals and objectives. Data Analytics is generally used to
validate the accuracy and the integrity of data, to display data in different
ways and to generate analysis that would otherwise not be available. It can
also be helpful in identifying unusual or strange items, testing the validity
of items by cross-checking them against other information, or re-performing
calculations.

Although Data Analytics allows you to
increase your coverage by investigating a large number of items and potentially covering 100% of transactions, you may still want to extract
and analyse a portion of the database by using the sampling tasks within. You
could examine a subset of the population (a sample), to predict the financial
result of errors, or to assess how frequently a particular event or attribute occurs
in the population as a whole.

The quality of the data, your knowledge of
the database and your experience will contribute to the success of Data
Analytics processes. With time you will be able to increase or widen the scope
of investigations (for example, conducting tests which cannot be done manually)
to produce complex and useful analyses, or to find anomalies that you never thought
were feasible.

It is also not unusual that far more
exceptional items and queries are identified when using Data Analytics than other methods and that these may require follow-up time. However, the use
of Data Analytics may replace other tests and save time overall. Clearly, the
cost of using the Data Analytics Tool must be balanced against the benefits.

Case Study 1 – General Ledger – What is our
Audit Objective?

Management override and posting of fictitious
journals to the General Ledger is a common way of committing fraud; and one of
the key audit procedures is to test the appropriateness of journal entries
recorded in the General Ledger.

The objectives may include testing for risk
or unusual transactions such as:

• Journals with no description,

•  Journals not balancing,

• Journals containing keywords,

•  Journals posted by unauthorised users,

•  Journals posted just below approval limits,

• Journals posted to suspense or contra
  accounts.

Case Study 2 – Accounts Receivable – What is
our Audit Objective?

Accounts Receivable is one of the largest
assets of a business; therefore, there is a need to audit and gain assurance
that the amounts stated are accurate and reasonable.

The objectives may include:

• Identify large and / or unusual credit
  notes raised in the review period,
• Capture customers with significant write-offs
  during the year,

Preparing data for analysis

(3) DETERMINE DATA REQUIRED AND ARRANGE DOWNLOAD
WITH PREPARATION

Data download is the most technical stage in the
process, often requiring assistance and co-operation from Information
Technology (IT). Before downloading or analysing the data, it is necessary to
identify the required data. Data may be required from more than one file or
database. It is important at this stage that the user understands the
availability and the details of the databases. You may also have to examine the
data dictionary to determine the file structure and the relationships between
databases and tables.

In determining what data is required, it may
be easier to request and import all fields. However, in some cases this may
result in large file sizes and it may be time-consuming to define all the
fields while importing the files. Therefore, it may be better to be selective,
ignoring blank fields, long descriptive fields and information that is not
needed. At the same time, key information should not be omitted.

Case Study 1 – General Ledger – Planning –
What Data is Required?

The Auditor needs to obtain a full General
Ledger transactions history for the audit year after all the year-end
(period-end) postings have been completed by the client. To carry out a
completeness test on the General Ledger transactions, the ‘Final’ Closing Trial
Balances at the current and previous year-ends are required. Where possible,
obtain a system-generated report as a PDF file, or observe the export of the
Trial Balance, this will give assurance over the integrity and completeness of
the Trial Balance figures from the Accounting Software or ERP system.

General ledger initial check for preparing
the data

Field Statistics can be used to verify the
completeness and accuracy of data like incorrect totals, unusual trends,
missing values and incorrect date periods in the General Ledger. This pre-check
in the data preparation stage allows the Auditor a greater chance of
identifying any issues that will cause invalid test results. Comparing
difference in totals obtained from the client for the Transaction Totals in the
General Ledger with the Field Statistics should be clarified with the client
before proceeding further with the Analytic tests.

Case Study 2 – Accounts Receivable – Planning
– What Data is Required?

The Auditor should requisition the ‘AR
Customer-wise open items at the year-end’ data. This data provides more details
than a simple list of balances because often an Auditor wants to test a sample
of unpaid invoices rather than testing the whole customer balance. Further, the
Auditor should obtain the ‘Accounts Receivable Transactions’ during the year to
analyse customer receipts in the year, to test for likely recoverability. Apart
from this, more detailed Data Analytics can be performed on the sales invoices
and credit notes, as well as cut-off analysis.

Accounts receivable initial check for
preparing the data

Field Statistics can be used to verify the completeness and accuracy of
data like incorrect totals, unusual trends, missing values and incorrect date
periods in the Accounts Receivable (AR) ledger. This pre-check in the data
preparation stage offers the Auditor a better chance of identifying any issues
that could cause invalid test results. Comparing difference in totals obtained
from the client for the AR Debit Credit Totals with the Field Statistics should
be clarified with the client before proceeding further with the Analytic tests.

Validating data

(4) USE ANALYTIC TASKS

Case Study 1 – General Ledger – Highlighting
Key Words within Journal Entry Descriptions

Objective – To isolate and extract any manual journal entries using key words or
unusual journal descriptions. These can include, but not be limited to,
‘adjustment, cancel, missing, suspense’.

Technique – Apply a search command on the manual journal entries which have been
posted with the defined unusual descriptions by using a text search command.

Interpretation of Results – Records shown when using the above
criteria would display records which have description narratives that include
key terms such as ‘adjustment’, ‘cancel’, ‘suspense’ and ‘missing’, and may
require further investigation.

When determining which manual journal entries
to select for testing, and also what description should be tested, it is
helpful to know that financial statements can be misstated through a variety of
fraudulent journal entries and adjustments, including:

• Writing off liabilities to income,
• Adjustments to reserves and allowances
  (understated or overstated),

Therefore, when defining the narratives to
search for, you will need to tailor the said search to the type of manual
journal entry that the Auditor is aiming to test.

Case Study 2 – Accounts Receivable –
Detecting suppression of Sales

Objective – To test for gaps in invoicing sequences which may indicate unrecorded
sales and / or deleted invoices.

Technique – Gap Detection is used to detect gaps in data. These could be gaps
within purely numeric or alpha-numeric sequential reference numbers, or these
could be gaps within a sequence of dates. Perform a Gap Detection on the field
‘Invoice Number’.

Interpretation of Results – Any gaps in invoicing sequences require
further investigation to ensure that revenue has been correctly allocated, as
well as to check for improper revenue recognition which can be accomplished by
manipulating income records, causing material misstatement.

Discovering patterns, outliers, trends using
pre-built analytic intelligence

The Discover task provides insights through
patterns, duplicates, trends and outliers by mapping data to high-risk elements
using the Data Analytical Tool’s predefined Analytic Intelligence.

(5) REVIEW AND HOUSEKEEPING

As with any software application, all work
done in Data Analytic Tools must be reviewed. Review procedures are often
compliance-based, verifying that the documentation is complete and that
reconciliations have been carried out. The actual history logs from each analytical
activity should also be reviewed.

Backup of all the project folders must be
done meticulously and regularly.

Clear operating instructions with full
details on how to obtain files, convert them and download them should be
documented for each project and kept easily accessible for the Audit Teams who
will take up the project in the ensuing review period. If necessary, logic
diagrams with appropriate explanatory comments should be placed in the Audit
working-paper file so that a different auditor could pick up the project in the
following year.

CONCLUSION

By embedding data analytics in every stage of the audit process and
mining the vast (and growing) repositories of data available (both internal and
external), Auditors can deliver unprecedented real-time insight, as well as
enhanced levels of assurance to management and audit committees.

Businesses are faced with unprecedented
complexity, volatility and uncertainty. Key stakeholders can’t wait for
Auditor’s analysis of historical data. They must be alerted to issues at once
and be assured of repetitive monitoring of key risks. Data Analytics empowers
Audit to deliver, as well as to serve the business more proactively in audit
planning, scoping and risk assessments, and by monitoring key risk indicators
closely and concurrently. Auditor’s use of data analytics in every phase of the
audit can help management and the audit committee make the right decision at
the right time.