The ongoing era of digital transformation taking place in the region promises profound change and great opportunity, but it also brings new risks and uncertainties. As the business function that evaluates risk management, internal audit could be critical to making an organisation’s digital transformation a success. Equally, unless the function embraces the transformation itself, it could become ineffective and irrelevant.
What does internal audit entail exactly? Internal audit is an ongoing assurance system that constantly evaluates a company’s internal operations, risk management and governance processes. As a result, internal audit has continuous and comprehensive access to a company’s data, making the system data-driven, and hence far more effective and accurate in its method. Essentially, internal auditors are the gatekeepers protecting the integrity of an organisation. With the drive of digitalisation across businesses, they have the opportunity now, more than ever, to become valued advisers in addition to their traditional role.
In many organisations in the Gulf region, internal audit is still regarded as a cost centre rather than necessary business support. In such an environment, persuading stakeholders to invest in new systems that will take internal audit to the next level is challenging. However, for a company that is serious about a holistic transformation, digitising the internal audit function concurrently with other units will increase the value that internal auditors can offer to senior executives, audit committees and boards.
One key method to demonstrate the value of a data-driven audit is by conducting a pilot audit in one specific area or process within the organisation. With a pilot audit, organisations are likely to see five main benefits: a more comprehensive view of the entire business operation, an increase in production with the removal of significant inefficiencies, the ability to better predict risks, a more proactive approach to evaluating and amending the digitised audit plan, and a more usable tool for management.
More comprehensive
The main advantage of data-driven internal audit is to shift away from approximating risk using samples, to covering all risk quantitatively by using data analytics. Where previously 25 out of 1 million invoices would be sampled, insights can now be drawn from the entire population. By showing trends and validating exceptions, it enables internal auditors to focus on the risks that matter and build benchmarks of what constitutes good practice.
More productive
A further advantage of a data-driven audit is that data analytics can remove significant inefficiencies in the internal audit process. For example, a Gulf bank introduced an internal audit project focused on the quality of customer data. Traditionally, this would have involved taking a sample, but due to data analytics and robotics process automation, a dashboard was created that contained more than 20 key indicators, including dormant accounts and outdated “know your customer” data. Instead of taking three to four weeks to complete the work as before, the internal audit was completed in several hours.
More predictive
Internal audit can develop models of how processes and controls may behave in the future by collecting vast amounts of data and analysing it, allowing risks to be flagged ahead of time. In construction, for example, it is important to identify issues as they occur to influence the outcome.
As another example, airports spend billions of dollars on the construction of new terminals and runways — programmes that are usually late and go over budget. This is where internal audit can add tremendous value, acting as a third line of defence. Using artificial intelligence (AI) and machine learning, data can be extracted from the project schedule, inventories, and workflows to predict whether the project will be completed on time and/or where potential delays may arise.
More proactive
By digitising their audit plan, organisations can change the plan whenever they need it, rather than at the end of an annual cycle. They can re-evaluate their audit plan regularly and reallocate resources to where the business is at risk, facilitating more value-added discussions and providing more insight into the organisation.
More usable
Finally, the development of data visualisation tools means that automated audits can produce easy-to-use one-page summaries that internal audit or management can access on any device.
The digital transformation of internal audit is a prime example of how automation can augment human judgement, rather than replace it. To ensure that internal audit can contribute the full value and benefits of its function, senior executives, audit committees and boards in the region need to encourage the investment in internal audit innovation and automation. Only then internal auditors will be freed from laborious tasks and have the capacity and opportunity to strengthen their role as trusted and valued advisers.
— Bhuvana Krishnamoorthy is Partner, Mena Risk Advisory, at EY.
