Technology and the audit - PricewaterhouseCoopers

1. Set the strategy
A technology strategy should contemplate:
• the level of maturity and engagement of the business controls:
–
–
if business controls monitoring is not technology-based, internal
audit can focus on areas where technology could provide deeper
and more analytical information
if the business controls are sophisticated, internal audit may be better
focused on the framework’s effectiveness.
• opportunities to replace more traditional audit techniques with technology
that can test entire populations against specific risks. The new tools that are
emerging are significantly changing our ability not only to execute an audit
efficiently and systematically, but also to enhance audit quality and value
while demonstrating the merits of a more analytical monitoring strategy.
2. Assess the skills/capability gap
Where an organisation is considering business-led technology to monitor controls
continuously, internal audit will need the appropriate business, risk, data and IT skills
to evaluate and challenge the implementation. Such skills will also enable internal audit
to provide a higher level of assurance over the business monitoring process. Without
these skills – either within the audit function or sourced externally – there is a risk that
internal audit will lose pace with one of the key organisational monitoring mechanisms.
Where an organisation has not yet focused on the benefits of continuous monitoring
by the business, internal audit is likely to require access to and deep knowledge of
tools as well as the skills referred to above. In this situation internal audit will also have
a leadership role in demonstrating the value to the business of investing in greater use
of technology and analysis with regard to the control framework.
3. Take action: Quick wins
At this stage you might want to achieve some quick wins and consider how to pilot
your approach. This should be addressed in the context of the organisation’s risks
and internal audit plan. For example:
• Are there risks that could be quickly and efficiently monitored using
techniques such as business monitoring daily reports, exception reports
and dashboards?
• Can in-built internal audit modules, such as control validation, be used?
• Is the organisation ready for more sophisticated risk-monitoring systems,
such as continuous monitoring of fraud risk or environmental risk?
• Do you have a business unit or area in mind which could be the best place
to pilot your new approach?
Summary
Technology will be part of the future of internal audit. To maintain its edge,
internal audit needs to include in its strategy a technology stream. The goal is
to deliver greater efficiency, depth and breadth of coverage for the audit, while
also providing an increased level of comfort and insights to the business.
PricewaterhouseCoopers |