Audit

Analytics
Drivers for a successful
implementation of data
analytics within the
internal audit function

The internal audit function plays an important role within the organization to monitor the
effectiveness of internal control on various topics. In the current data-driven era we are
living in, it will be hard to argue that internal control testing can be done effectively and
efficiently by manual control testing and process reviews. Data analytics seems to be the
right answer to gain an integral insight into the effectiveness of internal controls, and spot
any anomalies in the data that may need to be addressed. Implementing data analytics
(audit analytics) within the internal audit function is however not easily done. Especially
international organizations with decentralized IT face challenges to successfully
implement audit analytics. At Randstad we have experienced this rollercoaster ride, and
would like to share our insights on which drivers for success can be identified when
implementing audit analytics. In the market we see a large focus on technological aspects,
but in practice we have experienced that technology might be the least of our concerns.
 INTRODUCTION: AUDIT ANALYTICS,
The biggest OBVIOUS BENEFITS

challenge in audit As an example, we would like to ask you this question:

what is the main topic during seminars, conferences

analytics is not in concerning data analytics? What is most literature

about? How is the education system (e.g. universities)
responding?
the technology
Chances are your response will involve technology: you
read about great tooling, data lakes, the need for you to
recruit data analysts and, very important, you must do it
all very quickly.

However, the biggest challenge is not technology. The IT

component is obviously important, but it is ill-advised to
consider the implementation of audit analytics to be just
about technology.

Of course, we are not here to argue with the fact that

technology is a very important driver to enhance the
capabilities of the auditor. The benefits of being able to
run effective data analytics within the internal audit
function are obvious. The same seminars will usually
underline these benefits as much as they can: data ana-
lytics in the audit will provide the auditor with more
efficiency in his work, and will enable him to cover more
ground in the audit executions. Moreover, the auditor
will be able to create more transparency and basis for
audit results towards the business.

Rightly so, the benefits are obvious, and it seems easy

enough to implement. These benefits are well known
within the audit community. The benefits are however
usually based on the premise of having a good techno-
logical basis as the key to success. One could hire a good
data analyst and build an advanced analytics platform,
and just go live. In some cases, this could work, reality is,
however, more challenging.

In most cases more complex factors play a pivotal role

in the success of audit analytics, which are not easily
Stephan Idema MSc LLM bypassed by just having a good data analyst or a suitable
is a senior manager at KPMG Risk
& Regulatory. analytics platform. Factors that most corporate enterpri-
[email protected] ses must deal with are, for example:
•• a complex corporate organization (internationally
oriented and therefore different laws, regulations and
frameworks, decentralized IT environment and dif-
ferent core processes);
•• the human side of the digital transformation that
Paul Weel MSc RE CISSP CISM comes with implementing audit analytics;
is associate director Global Business •• integrating the audit analytics within the internal
Risk & Audit at Randstad N.V.
audit process and way of working.
[email protected]

Transparency of information 29
 IT
CASE STUDY: HOW THE RANDSTAD
JOURNEY ON AUDIT ANALYTICS EVOLVED

In 2015, Randstad management articulated the ambition

to further strengthen and mature the risk and audit func-
Business IT
Controls tion. The risk management, internal controls and audit
capabilities were set up years before. Taking the function
to the next level meant extending existing capabilities
Manual Data and perspectives, with the intent not only to ensure
Analytics continuity, but also to increase impact and added value
to the organization. Integrating data analytics into the
Manual way of working for the global risk and audit function was
identified as one of the drivers for this.
Behaviour
To set up the audit analytics capability, several starting
Today Tomorrow points were defined:
•• build analytics once, use often;
Figure 1. Classical internal audit control testing vs. control •• in line with the organization culture, the approach
testing and data analytics. has to be pragmatic: it will be a ‘lean start-up’;
•• the analytics must be ‘IIA-proof’;
•• security and privacy have to be ensured;
The success of really transforming the internal audit •• a sustainable top down approach, rather than datami-
function to the internal audit of tomorrow is where data ning and ad hoc analytics.
analytics is embedded in the audit approach, and a pre-
requisite of gaining insights into the level of control and This meant that a structured approach had to be applied,
the effectiveness thereof with the auditee’s organization. combined with the willingness to fail fast and often. In
the initial steps of the process, technical experts were
This success we are talking about is currently perceived insourced to support the initiative in combination with
as a ‘technical’ black box. In our opinion this black box process experts. With a focus on enabling technical capa-
is not only of technological nature, but has a lot more bilities, projects were started to run analytics projects
complexities added to it. In this article, we tend to open in several countries, and in parallel develop technical
this black box and offer some transparency based on the platforms, data models and analytics methodologies.
experiences we have gained in setting up the internal
audit analytics function. With successes and failures, lots of iterations, frustrati-
ons and, as a result, lessons learned, this evolved into a
To do this, we will start to describe the experiences we comprehensive vision and approach on audit analytics
have gained in setting up audit analytics. Based on our covering technology, audit methodology, learning &
story, we will outline our key drivers for success, regar- development and supporting tooling & templates. Yet at
ding the implementation of audit analytics. Furthermore, the same time, it resulted into an approach, which is in
we will move in to detail on how these drivers influ- line with the organizational context, fit for its purpose,
ence each other, and the importance of a balancing act and general requirements, such as GDPR.
between the drivers.
Yet at the same time, the results of the analytics pro-
jects and contribution to audits showed interesting and
promising results: by the end of 2017 a framework of 120
analytics was defined, out of which 65 were made availa-
Data Analytics within the internal audit ble through standard and validated scripts.

The key benefits in performing data analytics

within the internal audit function are
predominantly:
1. more efficiency in the audit execution;
2. cover more ground in the audit executions;
3. create more transparency and more basis for
audit results/findings.

30 Audit Analytics
Drivers for successful Audit Analytics
Looking back at the journey and summarizing the cen-
The way the audit
tral perspective, a model emerged identifying drivers for
successful audit analytics. The journey the Randstad risk
analytics organization is
& audit function has gone through, addressed challenges
in five categories: organizational fit, internal organiza- set up is also a key driver
tion of the audit analytics, supporting technical tooling
and structure, audit methodology alignment and integra- for success
tion and skills, capabilities and awareness.

At different times in the journey, different types of chal-

lenges emerged. For example, when Randstad started
expanding methodologies and technologies, the next •• centrally organized versus decentralized organization;
challenge became the fit and application within the •• diverse IT landscape regarding key systems versus a
organizational context. This in turn translated into standardized IT infrastructure;
developments in the audit analytics organization. Then, •• many audit topics versus a high focus on a few speci-
the human component became a point of attention, fic audit topics;
translating into addressing audit methodology align- •• uniform processes among local entities versus divers
ment and related skills/capabilities. In turn, this was processes among local entities;
further supported by updating the technical structures. •• similar law, regulations and culture versus a diverse
During our journey it became clear to us that these landscape of law, regulations and culture;
challenges where not individual of nature, but are •• aligned risk appetite versus locally defined risk
interacting with each other, and form an interplay of appetite.
success drivers.
We do not perceive the organizational structure as a
Next, we will go through the five identified challenges constant that cannot be changed, but as something that
in more detail, and illustrate what this means in the cannot be greatly influenced in order to set up the analy-
Randstad context. In the following chapter we will try to tics organization. Therefore, one must consider how the
transform these challenges into an early model, that will analytics organization can best fit the overall organizati-
be the starting point in understanding which drivers onal structure, rather than the other way around. The les-
have an impact on the success of audit analytics. sons learned regarding this challenge are that it is vital
to assess how the organizational structure may impact
your methodology and setup for audit analytics. This can
IMPLEMENTING DATA ANALYTICS: KEY have both huge technical as procedural implications on
DRIVERS FOR SUCCESS setting up your audit analytics organization.

In the previous chapter, we discussed how Randstad Audit Analytics organization

experienced the implementation of audit analytics and The way the audit analytics organization is set up, is also
the challenges and learnings that have been gained over a key driver for success. There are a lot of choices one can
the years. In this chapter we will further dissect the make when setting up the organizational structure, and
identified challenges, and translate them into drivers for defining the roles and responsibilities within the analy-
success in implementing audit analytics. tics or audit team. The key decision is perhaps whether
or not you want to carve out the analytics execution and
Organizational fit delegate this to a specialized analytics team, or whether
The first question one might want to ask before setting you want to assign the role of data analyst to the auditor
up an analytics program is: ‘how does this fit within the himself. This decision will have a great impact on a lot of
organizational structure?’. The organizational structure other things that have to be considered when setting up
is something that cannot be changed overnight, and yet it a data analytics program. Other key factors that we have
will greatly determine how your data analytics program identified in setting up the analytics organization:
must be set up. In case this isn’t thought through carefully •• central data analyst team versus analytic capability
in the setup phase of audit analytics, one might encounter for the local auditor;
an organizational misfit regarding choices that have been •• a central data analytics platform or a limited set of
made concerning technology or analytics governance. We local tooling;
will outline the key factors that will have an impact on •• separate development, execution and presentation
the way audit analytics has to be set up: versus generic skillset.

Compact 2018 4 Transparency of information 31

 Audit Analytics technical structure •• data analytics as a serviced add-on to the audit
The third key driver we mention is the technical struc- approach versus a fully integrated audit analytics
ture that will enable the auditors to execute the data ana- approach;
lytics. As said in the introduction, this topic usually plays •• data analytics as pre-audit work to determine focus
a central role at seminars, conferences and literature and scope versus data analytics as integral control
about data analytics. In our opinion it is one of many dri- testing to substantiate audit findings (or both!).
vers for success, and not necessarily the most important
one. Decisions that have been made earlier in the previ- Skills, capabilities and awareness
ous two drivers will have a big impact on what choices The last defined driver for success is the skillset of the
one should make in this area. Areas to consider are: auditor to fully leverage data analytics. The skillset
•• implementing a central platform or work with local does not only imply the execution of the analytics, but
tools; also how to present the analytic results, and explain its
•• implementing an advanced data analytics platform implication to the business and the auditee. It is vital that
versus choosing low entry data analytics tooling; the message comes across clearly, and how the analytics
•• using advanced data visualization tools or using low support the audit findings. This requires both technical
entry visualization tools. knowledge regarding the analytics process and generic
audit know-how, but most importantly it requires in-
Audit methodology alignment and integration depth knowledge on the data the analytics have been
The fourth key driver is - in our experience - the one that executed on. The following key choices need to be made:
is overlooked the most. People tend to see it as a given •• relying on well-equipped data analysts to execute and
that auditors will embrace data analytics, once it is deliver audit analytics versus training the auditor in
widely available to them. On the contrary however, we order to equip him or her to execute audit analytics;
have seen that auditors are somewhat reluctant in chan- •• relying on data analysts to interpret and understand
ging their classical way of working in a more data-driven analytics results and its impact on the audit versus
audit approach. The way that data analytics will be inte- relying on the auditor to understand the data and the
grated within the audit program or audit methodology is executed analytics and its impact on the audit.
a pivotal factor for success. The right decisions regarding
the following topics need to be made: The crucial choice that needs to be made, is whether you
•• integrate the analytics in the audit methodology will rely on the auditor to further deal with the audit
through a technology-centered approach (tech- analytics, or will they be assisted by a data analyst to
nology push) versus an audit-centered approach perform the technical part of the audit analytics? If you
(technology pull); choose the latter, you will be faced with the challenge to
create an effective synergy and collaboration between
the two, where the analyst understands the data and the
Figure 2. Key drivers for success. executed analytics (and visualizations), and the auditor
can put the implications of the analytic results in place
Audit Analytics: drivers for success for the audit findings. To create such a synergy might
not seem a major challenge at first. We have however
I. Organizational structure experienced that data analytics is not part of the DNA of
all auditors, and therefore it might be a bigger step to take
then initially presumed.

Model: drivers for success

When we summarize our experiences in a visual over-
II. Audit methodology III. Analytics methodology view, it would look like the model presented in Figure 2
below. The model shows the interconnection between
all the five drivers that have an impact on the success of
your data analytics implementation. A decision made
regarding one of the key drivers will in the end influence
the decisions that have been made regarding one or more
other drivers. Each organization that is about to imple-
IV. Skills and capabilities V. Analytics technology ment data analytics must find the right balance between
the identified drivers for success.

32 Audit Analytics
IMPLEMENTING DATA ANALYTICS – CONCLUDING REMARKS
A BALANCING ACT
In this article we summarized the importance of data
Does having this model make audit analytics succes- analytics in the internal audit, the road that Randstad has
sful? For Randstad, it is not this model that made audit taken to implement audit analytics, the challenges and
analytics where it is today. Assembling all the lessons lessons learned along the way, and how these lessons can
learned and the root cause analyses of all the ‘failures’ be translated into a model of key drivers for success. The
the organization experienced, this model emerged. It is as goal of this article is to codify our journey and correspon-
such a reflection of what management has learned in the ding lessons learned, and communicate the experiences
journey so far. At the same time, it is a means to an end: to the audit community, so they can profit from them.
it facilitates discussions in evaluating where an organi-
zation stands today regarding analytics, and which key The important message that we want to communicate,
challenges need to be addressed next. It thereby sup- is that implementing audit analytics is far from just a
ports management conversations and decision-making technological challenge. By implementing data analytics,
moving forward. a large change is brought to the internal audit organiza-
tion. The auditors need to change their way of working,
Ultimately, it is all about bringing the configuration of and make a paradigm shift towards a data-driven audit.
the different drivers in balance. In implementing audit One cannot underestimate the implications of such a
analytics, Randstad has, so far, failed repeatedly. In most change by focusing mainly on the technological success
cases the lessons learned analyzed: where there is pain, of data analytics.
there is growth. It identified that an unbalance in the
configuration of the drivers was the root cause. Reflecting on these developments and audit analytics
initiatives, one should really take this paradigm shift
There are multiple factors to be addressed during the into account. What does audit analytics mean in the old
implementation. These factors can sometimes be oppo- world, but also in the new world?
sites of each other, creating a ‘devilish elastic’. In the
Randstad journey a big push was made to set a central Ultimately a key challenge is how to go through the para-
solution, facilitate a technical platform and integrate digm change, and how to support (or not support) audi-
analytics in the audit methodology. In the course of tors in making the paradigm change? Understanding
2017 a lesson learned was picked up from this push: the and embracing audit analytics might not be their biggest
projects that were run centrally yielded positive results. challenge! Something Randstad Global Business Risk &
It did not translate however into the global risk and audit Audit is working on, daily!
community to start running audit analytics throughout
their internal audit projects.

Randstad has set the technology and methodology; the About the authors
key is to now also bring the professionals to the same S.X. Idema MSc LLM  works as a senior manager at KPMG
page in the journey. As audit analytics in its potential, Risk & Regulatory, and focuses on a wide variety of
complex legal and technical matters, such as data privacy,
fundamentally changes the way you run audits, it also intellectual property and software licensing.
means changing the auditor’s definition of how to do its Stephan has an academic background in the field of
work. Overwriting a line of thinking that has been there information studies and Law. He graduated in 2009 as a
for a very long time is maybe one of the biggest chal- Master of Science in Business Information Systems at the
University of Amsterdam. In 2011 he finished his Master of
lenges there is. Therefore, when the questions are asked Law with a focus on IT and privacy law, at the University of
on what Randstad is doing currently to implement audit Groningen. In 2016, Stephan finished his Executive Master
analytics, and what the current status is, the answer is of IT Audit at the University of Amsterdam.
as follows: ‘To get audit analytics to the next level, we P. Weel MSc RE CISSP CISM  is associate director Global
are currently going through a soft change process with Business Risk & Audit at Randstad N.V. Paul mainly
works on the cross-section of IT and business, with a
our risk & audit professionals, to get them to not only
specific interest in organizational development, business
embrace the technology, but also the change in the way development and soft change. Audit analytics is one of the
we perform our audits as a result. Overall, we are at the initiatives for which Paul is in the lead with Randstad risk
end of the beginning implementing audit analytics. & audit. 
Paul has an academic background in management
Ambitious to further develop and grow, we are looking
& business administration, with a Major in business
forward to failing very often, very fast.’ development at the University of Groningen. In 2008 he
finished the postgraduate IT audit at the Vrije Universiteit
of Amsterdam.

Compact 2018 4 Transparency of information 33