Page 617 - ITGC_Audit Guides

GTAG — Introduction

2. Introduction • Productivity and cost savings
Data analysis technology has enabled a number
Data analysis as used by internal auditors is the process of of organizations to realize significant productivity
identifying, gathering, validating, analyzing, and interpreting improvements in audit planning, risk assessment,
various forms of data within an organization to further the and increasing the breadth and depth of audit
purpose and mission of internal auditing. Data analysis coverage during the engagement. Ultimately, this
is typically used throughout the execution of assessment has enabled audit departments to broaden the scope
activities as well as providing other value-added consulting of their assurance activities, without having to
activities. increase audit staff. In some circumstances, auto-
Data analysis technologies are computer programs the mation of analytic steps has lead to cost savings
auditor uses as part of the audit to process data of audit signifi- through the reduction of staff necessary to complete
cance to improve the effectiveness and efficiency of the audit the audit plan.
process. When data analysis is being used, the overall objec- • Efficiency in data access
tive and scope of an audit does not change. Data analysis Data analysis technologies enable auditors to access
must be seen as another tool that can be used to achieve the and query data by themselves, thereby decreasing
objective of the specific audit. their reliance on busy IT personnel having to run
Data analysis tools may consist of packaged, purpose- data extracts. This helps provide a higher degree
written utility programs or system management programs. of confidence in the accuracy and completeness
Different technologies fall under this concept, including
database interrogation tools (generic standard query
language–based tools) and audit-specific packages.

Opportunities Related Standards/Guidance
In today’s economic environment many companies are Standard 2300: Performing the Engagement
striving to reduce costs. Together with new audit standards, n Internal auditors must identify, analyze, evaluate,
this provides internal audit departments with an opportunity and document sufficient information to achieve
to make use of data analysis and makes the concept “do more the engagement’s objectives.
with less” a potential reality.
Data analysis also can be an enabling technology that Standard 2310: Identifying Information
assists audit departments in fulfilling their responsibilities to n Internal auditors must identify sufficient, reliable,
evaluate and improve the governance, risk management, and relevant, and useful information to achieve the
control (GRC) processes as part of the assurance function. engagement’s objectives.
Data analysis gives audit departments the ability to conduct Standard 2320: Analysis and Evaluation
assessments on the operating effectiveness of internal
controls and to look for indicators of emerging risk. The use n Internal auditors must base conclusions and
of data analysis throughout the audit cycle is discussed later engagement results on appropriate analyses and
in this section. evaluations.
In the days when mainframe computers ruled the business Practice Advisory 2320-1: Analytical Procedures
world, only the best funded internal audit functions could n Internal auditors may use analytical procedures
even consider moving data analysis activities into the depart- to obtain audit evidence. Analytical procedures
ment. Over the past decade, technology has advanced at a involve studying and comparing relationships
great speed, resulting in price reductions that have made it among both financial and nonfinancial information.
easier to implement data analysis within an organization. The application of analytical procedures is based
Through this, audit analytics have evolved from specialized on the premise that, in the absence of known
technology that was once the domain of specialized IT audi- conditions to the contrary, relationships among
tors into an essential technique that has a valuable role to information may reasonably be expected to exist
play in the majority of audit procedures. Many audit func- and continue. Examples of contrary conditions
tions now aim to integrate audit analytics throughout the include unusual or nonrecurring transactions or
audit process and expect all auditors to have an appropriate events; accounting, organizational, operational,
level of technological competency. environmental, and technological changes;
There are many benefits that may be realized from the use inefficiencies; ineffectiveness; errors; fraud; or
of data analysis, including:
illegal acts.

3