Internal Audit Data Analytics Program – 4 Common Hurdles to Overcome

Common Challenges

Possible Solution(s)

Lack of understanding of how to obtain necessary data

Step 1: Ensure you understand the data requirements of the test you want to perform.

Step 2: Review the format of data required by your data analytic tool.

Step 3: Speak with (or partner with) a person from the operational area being reviewed (or a person from Information Technology) to collaborate on where the necessary data can be extracted.

Inability to access the data

Step 1: Get “read only” access to the necessary systems.

Step 2: If access is not permitted or staff do not have the technical knowledge to pull their own reports, work with Information Technology to have the necessary reports provided.

Data analytic procedures result in so many exceptions that only a sample of exceptions can be reviewed

Step 1: Select a sample of exception to review. It’s important that the sample is diverse and covers different items that could be driving the exception (such as product codes, dates, etc.)

Step 2: Speak with management and review supporting documentation to determine if the sampled item is a true exception or a false positive.

Step 3: Rerun the test based on the items acquired from sampling to reduce the number of exceptions. Resample as necessary.

Try the following when designing tests to reduce false positives:

• Discuss possible allowable variations with management and incorporate these into testing.
• Discuss time periods where policy requirements were put in place or modified. Update population to reflect these time periods.
• Ensure assumptions are properly applied to the population. To do this, the population may need to be segmented by common data attributes to customize assumptions.

Data analytic procedures do not reflect changes in data availability or emerging risks

Step 1: Prior to executing all tests, review procedures for the following:

1. Input Data
   • Is it still accurate?
   • Have data fields within the data used been changed?
   • Have new data sources become available? If so, determine how they should be incorporated.
2. Testing Assumptions

1. • Have business controls changed?
   • Have clients or products changed?
   • Do new emerging risks need to be considered?