Traditional audit methods served auditors for decades but as technology advances and What is Big Data & Data stakeholders’ expectations evolve, so does the Analytics? need for auditors to innovate and transform their approaches in order to keep pace with “Big data” is an evolving term that describes large demand. This publication describes some of the amounts of complex data coming from a variety of opportunities that new technologies, especially sources and processed at high velocities. “Big data” the use of audit data analytics, can offer for itself has very limited value until it has been mined audits of entities of all sizes. It also provides a and explored further for information. few tips which might be useful for practitioners, Small and Medium Sized Practices (SMPs) and “Data analytics” is the process of examining raw Professional Accountancy Organizations (PAOs) data with the purpose of drawing conclusions and as they support their members. supporting decision making. Data analytics is used by many companies to make better business decisions, predict future outcomes and manage risks. How is technology transforming the audit? Advances in technology and software solutions make it possible for auditors to fundamentally change the way a financial statement audit is done. Financial statement audits will still be a balance between traditional methodologies and new technology driven methods but now auditors have new tools and techniques available. Audits are already becoming semi-automated, meaning that hardware and software inputs are increasing and the use of information technology to computerize documentation, audit plans and working papers is already standard practice in the profession. The audits of the near future will likely include substantially more data analytics. Technology advances support the use of data analytics methods and introduce new forms of audit evidence and new ways of audit testing. What is new about audit data analytics? Classical analytical procedures consist of absolute comparisons of balances with prior year balances or with budgets and forecasts, ratio comparisons and trend analyses. They may also consist of comparisons based on financial or operational data designed to predict the balance in a financial statement classification and form part of the audit judgment process by challenging financial information or the lack of such information. Audit data analytics is much broader and deeper than traditional analytical procedures. It involves using powerful software tools and statistically complex procedures. These can include: cluster analysis; predictive models; data layering; visualizations; and “what if” scenarios that allow the exploration of new ways to analyze large sets of audit relevant data sourced from internal and external sources in order to produce audit evidence during risk assessment, analytical procedures, substantive procedures and control testing. What benefits do audit data analytics bring to practitioners? The advances in technologies and software solutions enable auditors to engage with audit data analytics in a variety of new ways, resulting in audits that are more: Focused as the auditor’s attention is directed toward areas of greater audit risks; • Insightful because they provide improved client service; and • Effective as audit teams can direct more time on complex areas where increased audit risk is present. • Key opportunities Data analytic techniques and methods enable audit teams to start Enhanced audit quality analyzing client data early in the audit process and begin identifying More relevant audit • areas that need further investigation. This enables problems to be • Identifying issues earlier identified as early as possible, and audit teams can tailor the audit approach to deliver a more relevant audit by adapting their audit • Larger populations plans accordingly. tested • M ore relevant evidence These more advanced methods also enable a forward looking, gathered dynamic process of Identification of anomalies, trends, correlations and fluctuations, pointing auditors to items where risks can be igher quality audit vidence • H present. Since more time is spent focusing on the areas where greater risk is detected, a better and more sophisticated risk analysis, fraud identification and monitoring is possible, enabling increased auditors’ focus. Performing transaction tests on entire populations rather than just testing samples lets auditors consider broader sets of audit relevant data and thus produce higher quality audit evidence. Further, since audit data analytics is a very broad concept, audit evidence can be gathered through various procedures including risk assessment, analytical procedures, substantive procedures and control testing. Auditors always need to first comply with professional ethics and Improved client service independence requirements when engaging with clients. Provided • Greater insight these requirements are considered appropriately, the use of data • Raising issues earlier analytics can add value over and above the traditional audit of historical financial statements. • Improved communication • P ossibility to visualize Audit data analytics help auditors to gain a better understanding of results their clients’ business and to provide further insight into risk and control assessments. Audit data analytics also provides unique opportunities to identify issues earlier in the audit process and to raise these issues with clients so that responsive actions can be taken in a timely manner. Communication with clients is enhanced because data can be visualized and understood in ways that are graphical, and easy to process and digest. In addition, clients can see their everyday data analyzed in new ways, enabling a fresh look and the opportunity to understand their own information from a different perspective. Increased effectiveness Data Analytics can be used to evaluate and assess large volumes of information quickly and can result in better understanding the entity ssess large volumes of • A and its systems. This provides opportunity for auditors to make data quickly better informed risk assessments so that further audit procedures • M ake better informed responsive to those risks are more focused and effective. risk assessments These methods also enable auditors to perform more frequent Increased auditors’ focus • testing at shorter intervals, rather than concentrating audit work • More frequent testing around year-end. Engaging in continuous testing and monitoring of data again leads to better risk identification, more accurate control More timely reporting • assessments, and more timely and relevant audit reporting. 5 Tips Tip #1 Embrace the use of technology in the audit process Expectations of investors, audit committees, regulators and other stakeholders regarding the use of technology advances on the nature of the audit are evolving rapidly. Large accounting firms are already making significant investments in developing home grown tools and methodologies surrounding audit data analytics in order to differentiate from competition, meet client demand, and respond to stakeholder expectations. Internal audit departments are also starting to employ data analytics significantly during internal audits, especially in areas such as fraud detection and risk management. Finally, financial reporting trends are also evolving rapidly. There is demand for real time information and on-demand reporting. Non-financial information is gaining importance and greater emphasis is being placed on predictive, forward looking information as opposed to historical information. Small- and medium-sized practices (SMPs) are yet to introduce these advances and reap the benefits. Major investments are required, such as human capital, hardware and software as well as developing implementation capabilities. PAOs can support practitioners and SMPs in a variety of ways, including: providing education opportunities; raising awareness among clients and members of the key benefits; developing toolkits and guidance; researching and recommending software and hardware options, including generic data analytics tools; and providing members with support to convey their views, comments and inputs to national and international standard setters. As clients, even small ones become better equipped technologically, it also becomes necessary for SMPs to start embracing the use of technology in the audit process. While it may seem like SMPs have a long way to go, as businesses become more comfortable in using technology in their operations and as their IT systems mature, management will also become more confident in making decisions based on data analytics. As management comes to appreciate the benefits offered by data analytics— e.g. reducing the amount of effort invested in both generating and interpreting the information needed for the audit— it will undoubtedly expect data analytics and technology to be used in the audit process itself. Tip #2 Audit standards will likely evolve Current audit standards deal with the use of audit analytics from the perspective of a risk based audit approach. This approach emphasizes an audit focused on understanding internal control, and —when appropriate— testing the effectiveness of the internal controls established by an entity. ISA 520, Analytical Procedures, deals with the auditor’s use of analytical procedures as substantive procedures and determines the auditor’s responsibility to perform analytical procedures near the end of the audit when forming an overall conclusion about the financial statements. ISA 315, Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment, provides the requirements for the use of analytical procedures during risk assessment. These standards discuss the possibility for auditors to use technology in the audit process through the use of Commuter Assisted Audit Techniques (CAATs). However, these concepts were conceived years ago when technology and the use of data analytics were not as advanced as they are today. Many challenges and questions arise with data analytics in the audit context of today that may need further guidance, including: Testing entire populations and how to deal with exceptions and the ability to measure results so precisely; • itting audit evidence derived from audit data analytics within the current requirements, and clarifying what • F kind of audit procedures they are; • I ntegrity of underlining data and how the auditor gains comfort about underlining data used in the procedures as well as what procedures are needed to validate data from non-traditional external sources (e.g. social media, internet). Standard setters do not want audit standards to inhibit ongoing innovations and developments in the area of audit data analytics and have already mapped these developments on their radar. On the other hand, careful consideration is required before the process of amending audit standards can take place, including gathering input from a wide range of stakeholders and considering linkages with other areas, such as education standards and professional ethics. The IAASB Data Analytics Working Group In mid-2015, the International Auditing and Assurance Standards Board (IAASB) established the Data Analytics Working Group (DAWG). Since its establishment, this group of IAASB members and subject matter experts have been exploring developments in the use of data analytics to enhance audit quality as well as determining how the IAASB can respond to some of the emerging developments in this area most effectively. In September 2016, DAWG issued a paper “Exploring the Growing Use of Technology in the Audit, Focus on Data Analytics”. The paper’s objective is to inform stakeholders about the ongoing work in this area and to gather their input on whether all relevant considerations regarding audit data analytics have been considered before any revisions to the International Standards on Auditing are attempted. Tip #3 Engaging in learning to become “analytically skilled” Increased automation and technological advances, including the use of audit data analytics, will not eliminate the need to involve skilled and trained auditors in the audit process. Humans will not be eliminated. However, their productivity will be increased by reducing repetitive tasks and increasing the speed at which data is handled to produce information needed, while exercising professional judgment. Auditors will always need to have a good foundation in traditional technical competences which are already a core body of knowledge studied in university and professional educational programs. However, a new set of skills will be required in the technologically advanced audit. Education is required in information technology, statistics, and modeling and this body of knowledge will need to be integrated in university and professional education programs for future accountants. Specialized IT auditors will be part of audit teams of technologically complex environments. However, as audit analytics becomes integrated through the audit process, all auditors will be expected to have a level of technological competency. Most auditors are familiar with spreadsheets and presentation methods but are not skilled in new technologies. A learning process is necessary to understand how to use new tools and how the results of audit data analytics can be employed to produce audit evidence and draw conclusions from that evidence. PAOs can play an instrumental role in this process by offering practicing members opportunities to engage in a learning process via training and Continuing Professional Development (CPD) programs or other focused learning to develop the newly acquired skills. Tip #4 Investments in both software and hardware are necessary The technology to successfully integrate a company’s data and audit applications is still developing and there are many issues to be addressed when successfully incorporating data analytics into the audit process. These issues include: complexities while extracting data from the company’s systems; encountering client data from multiple and diverse systems; validity of the source data; legal and regulatory challenges; and many other barriers. Large audit firms are investing significantly in developing customized and branded advanced data analytical tools but for many SMPs, these pioneering investments in hardware and software are a costly matter and simply beyond their resource availability. There are several good alternatives that SMPs can employ. These include: using third party vendors to process and analyze data; and using simple but powerful generic database tools with functionalities designed for auditors, such as the ability to access a variety of data sources and perform source data tests that are automated, traceable and repeatable. Some examples of tests that auditors can perform using these generic data analytics include: Testing for unauthorized journal entries • Even value entries • uplicate or split accounting and journal entries (e.g. • D Suspicious keyword descriptions • duplicate vendors or employees by address, name, Segregation of duties tests • bank account) Invoice number sequencing • • Dormant accounts Trend and probability analysis. • Tip #5 Using Data Analytics beyond traditional audit services The potential of using technology and especially data analytics can extend beyond the scope of traditional audits. It provides practitioners and SMPs with an opportunity to engage with clients across a variety of service lines and in innovative new ways. Auditors work with data on a daily basis and exploring new ways to analyze data is a natural evolution process for the accountancy profession. Provided auditors independence is not impaired, data analytics can be used to provide greater insights, offer consulting and advisory services, or engage via specialized assignments offering some targeted level of assurance in certain areas that provide clients with reduced risk and improved security. Some examples where data analytics can be employed in this way include: Fraud detection and forensic accounting • Tax and compliance consulting • Improvements in billing and cost management or business operations • Identifying revenue leakage, loss and potential • Risk identification and providing risk management insights/advice • Real time monitoring of controls • Using predictive models to improve forecasting • Integrated or sustainability reporting. • The role of the accountant from report writer to business partner is also gradually changing because accountants spend more time analyzing the company’s results. Analyzing patterns or potential issues as well as pulling data from different sources into one view where data can be overlapped and patterns can be recognized faster may be especially beneficial for small- and medium-sized enterprises (SMEs) which lack in-house monitoring and controlling departments and rely on external auditors and/or accountants to provide a greater insight into operational and compliance risks. Recognition The World Bank Centre for Financial Reporting Reform (CFRR) wishes to thank participating trainers and Professional Accountancy Organizations of the EU REPARIS Audit Training of Trainers Community of Practice (Audit ToT) who provided survey inputs while developing this publication (listed in order of country): Institute of Authorized Charted Auditors of Albania (IEKA), The Association of Accountants and Auditors of Republika Srpska (AAARS), Union of Accountants, Auditors and Financial Workers of Federation of Bosnia and Herzegovina (SRRF-FBH), Auditors Chamber in the Federation of Bosnia and Herzegovina, Institute of Certified Public Accountants of Bulgaria, Croatian Audit Chamber, Estonian Auditors’ Association, The Society of Certified Accountants and Auditors of Kosovo (SCAAK), Institute of Certified Auditors of the Republic of Macedonia (ICARM), Institute of Certified Accountants of Montenegro (ICAM), Chamber of Financial Auditors of Romania (CAFR), Chamber of Authorized Auditors of Serbia (CAA), Serbian Association of Accountants and Auditors (SAAA). Acknowledgements This publication is the product of a process of exchange of ideas and information among members of the Audit Training of Trainers Community of Practice (Audit ToT), under the EU-REPARIS Program. It was developed by Kalina Shukarova–Savovska, Senior Financial Management Specialist, CFRR, the World Bank, with contributions from Bonnie Ann Sirois Senior Financial Management Specialist, CFRR, the World Bank. The team wishes to thank certain members of the IAASB’s Data Analytics Working group, for their comments on this publication. © 2017 International Bank for Reconstruction and Development / The World Bank, 1818 H Street NW, Washington DC 20433, Telephone: 202- 473-1000, Internet: www.worldbank.org This work is a product of the staff of The World Bank with external contributions. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of The World Bank, its Board of Executive Directors, or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. Rights and Permissions:The material in this work is subject to copyright. Because The World Bank encourages dissemination of its knowledge, this work may be reproduced, in whole or in part, for noncommercial purposes as long as full attribution to this work is given. Any queries on rights and licenses, including subsidiary rights, should be addressed to World Bank Publications, The World Bank Group, 1818 H Street NW, Washington, DC 20433, USA; fax: 202-522-2625; e-mail: pubrights@worldbank.org.