By Tom O’Reilly and Jim Tarantino

Internal Auditors have been using data analytics for more than 25 years. With such a long runway, why do many teams still struggle to effectively integrate analytics into their processes? 

I posted about this topic recently in the Internal Audit Collective’s dedicated data analytics space and on LinkedIn, sharing common reasons data analytics efforts struggle to take hold. The points resonated with many, inspiring robust discussions in both forums. Commenters shared fantastic insights and ideas for moving the needle. But the consensus is clear: None of us has all the answers. 

‍Sometimes, raising the right questions can be enough to make progress. 

I recently sat down with Jim Tarantino, the instructor of the Internal Audit Collective’s soon-to-be-released data analytics training program, DRIVE, to refine and expand on the original list. The pain points below have blocked the progress of many data analytics projects, becoming roadblocks to success. Understanding these potential roadblocks gives Internal Auditors a fighting chance of avoiding them.

1. Access Barriers

Pain Point & Impact

Enterprise data is the fuel and prerequisite for the risk and control intelligence Internal Audit is trying to generate. Unfortunately, politics and bureaucracy often make it difficult for Internal Audit to gain access to it. Low access to high-quality data is the #1 blocker to data analytics program success. 

How It Happens

Silos tend to emerge as organizations grow in size and complexity. Data ends up housed in separate silos, with departmental leaders — protective of their data, which may be sensitive — limiting access. Access barriers may also originate in general company politics or a single C-Suite leader’s preferences. 

While I won’t offer ideas for every pain point, one simple change can make a difference in this area: Internal Audit’s charter should include the provision that it must be able to access all organizational data to carry out its scope of work. CAEs should be responsible for having this conversation with leadership.  

2. Data Validation Issues

Pain Point & Impact

Ensuring data accuracy, completeness, and reliability is a challenge for any organization. Accuracy relates to whether data is correct and error-free, completeness to whether all relevant and critical information is present, and reliability to whether the data and its sources can be depended upon to remain credible and consistent over time. A lack of quality data significantly reduces analytics’ value to the business, offering a poor basis for decision-making and potentially increasing reputational, compliance, and other risks.

How It Happens

Internal Audit’s findings hinge on the quality of its evidence. Poor evidence creates indefensible arguments. The stronger the evidence, the stronger the arguments and more defensible the positions that Internal Audit holds. 

At the end of the day, it’s about value and trust. Make sure source data and analytic results are high-quality enough to generate insight that management will find valuable, and sufficiently trustworthy to gain their buy-in. 

3. Data Literacy Gaps

Pain Point & Impact

Analytics efforts can get derailed even in organizations with high-quality data and best-in-class tools. You won’t get far if your team lacks the technical and analytical literacy needed to extract value from your data and technologies. Data literacy gaps can halt progress at many junctures: 

1. Do you know where to find the data? 
2. Do you know how to get the data? 
3. Is the data of sufficient quality to achieve the objectives? 
4. Do you know potential analytical approaches to test risks and controls, given the data?
5. Do you know how to interpret the data in the context of the business? 
6. Do you know how to report the data effectively (i.e., format, volume, cadence)? 

All activities are vital for converting data into risk and control insights and other benefits (e.g., improved audit coverage, efficiency, and accuracy; better decision-making; enhanced risk assessments; continuous risk monitoring). Analytics’ value and impact are reduced when Internal Auditors get hung up at any point in the process.

How It Happens

Many Internal Audit departments are not staffing with data literacy skills in mind or incentivizing skills development and retention in existing teams. While the real need is to cultivate broader skills around finding, accessing, assessing, interpreting, and reporting data analytics, training often focuses primarily on the analytics software and its specific features. 

In addition, data analytics is often lumped together with IT Audit or other specialties rather than treated as a distinct and necessary competency for every auditor. While coding and advanced analytics will reside with experts for the time being, the basic ability to handle digital evidence has gone from being a specialized skill to a core competency. The profession must evolve accordingly. Internal Audit departments need to invest time defining the baseline analytics skills they expect from all team members and making them part of training rubrics, hiring processes, and job descriptions.

4. Resourcing Challenges

Pain Point & Impact

Indeed, data analytics projects often falter due to resourcing challenges. The one team member highly skilled in data analytics leaves, pulled into the business or lured away by another organization, leaving Internal Audit without the necessary expertise. An analytics-focused consultant or third-party provider is no longer in the budget, causing analytics efforts to slow or stop entirely. Internal Audit leadership isn’t specifically recruiting or training for data analytics competencies, limiting the team's ability to scale analytics efforts. 

In each scenario, vital capabilities, expertise, momentum, and traction are lost. Data analytics services are either suspended or reabsorbed by other staff — who may or may not have the bandwidth and competency to perform tasks effectively. Some teams find themselves back at square one. 

How It Happens

Internal Audit departments often lack well-thought-out strategies for building, scaling, and sustaining data analytics resources. It takes significant effort to vet and hire qualified talent, broaden and incentivize data literacy, mature and codify analytics practices, and manage adoption to a larger group. 

Instead, analytics superstars are often treated as lone wolves, overloaded with requests and left with no time to document or scale their processes. Overreliance on external service providers becomes a key risk as budgets fail to keep pace with rising external service costs. And if your team lacks analytics competency across the board? Good luck.

5. Lack of Professional Practice Integration

Pain Point & Impact

It’s difficult to get full value from analytics without adjusting Internal Audit’s professional practices and guidelines. Often, methodologies and processes haven’t been updated to incorporate the extra time or steps needed to integrate analytics. As a result, Internal Auditors default to traditional behaviors and practices to get audits completed, leaving analytics unused or underused.

How It Happens

Teams often perform data analytics as a simple overlay to their existing professional practices. This approach typically doesn’t account for the extra time and activities required to brainstorm what analytics are feasible and valuable, or perform timely data discovery (e.g., location, permissions, format, content, quality). 

In addition, people default to established behaviors when incentivized to do so. When Internal Auditors are told by leadership that “on time and on budget” is their priority, the extra time and effort investment  of adopting analytics can easily get pushed by the wayside. Leaders should align professional practice expectations with audit scheduling, resourcing, and timelines that incentivize data analytics and allow time for their adoption.

6. Short-Term Vs. Long-Term Thinking 

Pain Point & Impact

Over-concentration on immediate audit support often dovetails with a lack of focus on building sustainable infrastructure for more automated, data-enabled audits in the future. The bulk of analytics are “one and done,” and departments fail to achieve potential efficiencies from repeatable and continuous analytics.

How It Happens

The data literacy, resourcing, and professional practice challenges outlined above are compounded by the “here and now” realities of Internal Audit. As one Internal Audit leader commented on LinkedIn, CAEs are naturally focused on — and likely incentivized by — getting through the audit plan, responding to emerging risks and issues, conforming with standards, and other priorities. 

As a result, departments may lack an Internal Audit strategic plan, long-term roadmap, or business case for needed investments supporting maturity and growth. This often translates to a lack of investment in personnel, enabling technologies, analytic routines, and data pipelines enabling repeatable and reusable analytics. 

7. Technology Misalignment

Pain Point & Impact

The analytics tools used by Internal Audit are not aligned with what the business is using, leading to compatibility issues, a lack of support from the business, and unrealized gains. It also complicates the process of using guest auditors or rotational environments. 

It all boils down to transferability. If Internal Audit’s data analytics applications aren’t the same as the enterprise’s, it makes technology and data transfer between Internal Audit and enterprise owners harder and less likely. Plus, analytics technologies don’t come cheap. Aligning Internal Audit and enterprise applications could streamline technology acquisition and licensing and support cost savings and economies of scale.

How It Happens

In most cases, Internal Audit’s goal in using analytics is to solve problems in their audit projects. The ultimate goal, however, is for the business to adopt the analytic and run with it, improving the business. Internal Audit’s recommended solutions can ideally become controls the business uses to mitigate risk. 

Using different analytics tools in different parts of the business, however, creates significant friction. This gives departmental leaders a reason not to implement: “Well, I’m using a different application, so I’m not going to adopt what Internal Audit is suggesting.” 

8. Business Readiness

Pain Point & Impact

Further, business partners may not be prepared to consume and act on analytics-driven insights, limiting adoption and greatly reducing impact. A lack of readiness can also create counterproductive distrust in the metrics. 

At their best, analytics drive action and behavioral changes that help the organization preserve, protect, enhance, and create value. Accordingly, as Internal Audit Manager Jon Taber commented in the Internal Audit Collective’s Data Analytics space, “The follow-up to the analysis is more important than the analysis.” As Taber explained, in an ideal world, data analytics should answer an important question to which management or Internal Audit needs a continuous answer, so that analytics are used (and regularly reviewed) to drive behavior and decision-making.

How It Happens

Often, stakeholders simply don’t understand the effort and investment required to “do” data analytics. What Internal Audit delivers may be out of line with what they’re expecting. For example, Internal Audit may present results in a format stakeholders don’t readily understand, at a volume or cadence they’re not prepared for, involving protocols or process changes they weren’t expecting. There could also be a mismatch between how Internal Audit and the business would operationalize results.

Analytics don’t live in a vacuum. Programs must consider and align with stakeholder readiness and requirements and support audit objectives, strategic planning, and future audit initiatives. When analytics efforts are out of sync with the overall organization, they can destabilize rather than enable. 

9. Personal Resistance to Change

Pain Point & Impact

Some Internal Auditors resist adopting new analytics tools and practices, doing the bare minimum to check the data analytics box. They may delegate their data analytics tasks to another internal resource, further delaying the acquisition of digital literacy.

How It Happens

Personal resistance often happens when Internal Auditors can’t see a clear connection between data analytics practices and more effective, efficient audit outcomes. In some cases, they’ve been introduced to analytics technologies that seem to lack relevance outside the department. Further, as discussed above, the extra effort required to use analytics may not align with incentives for on-time, on-budget audit performance metrics.

10. Lack of Departmental Mandate

Pain Point & Impact

Data analytics efforts lack needed investments (e.g., time, budget, strategic focus) from Internal Audit management. As a result, Internal Auditors’ analytics technologies and skill sets can't keep pace with enterprise data growth and digital process complexity. Analytics priorities, timing, and formats may be misaligned with departmental strategy and what would deliver value to the business. 

How It Happens

Data analytics is not considered effectively in Internal Audit’s vision, charter, mandate, or strategic objectives. The department lacks a true strategy or maturity roadmap (e.g., planned investments).

This often happens when Internal Audit has been told by organizational leadership to use analytics, but Internal Audit approaches implementation as an isolated technology exercise, failing to understand the organizational change management needed for success. 

11. No Performance Metrics

Pain Point & Impact

There are no clear KPIs to measure the success or impact of data analytics in Internal Audit. As the old adages go, what isn’t measured can’t be improved and what gets measured gets done. Accordingly, Internal Audit will be challenged to improve their analytics over time without formally tracking and measuring their performance. A lack of performance metrics also leaves a gaping hole in the business case for future analytics investments.

How It Happens

Every Internal Audit department uses performance metrics. The problem arises when none of them address analytics, because auditors are likely to focus on meeting the other performance metrics. 

Working with the audit committee and administrative reporting manager to develop agreed-upon performance metrics for analytics creates a path to a long-term, sustainable analytics program.

12. Lack of Data Governance Maturity 

Pain Point & Impact

As several commenters noted in our online discussions, data analytics efforts often stall when the organization’s digital ecosystem (i.e., data, applications, functional SMEs) is not yet mature enough to support data analytics in audit projects. Without quality data and functional SMEs to help Internal Audit teams navigate the enterprise data, auditors bear the burden of cleaning, preparing, and “brute-force” understanding the data.

How It Happens

The effectiveness of data and technology infrastructure, business applications, and expert IT and data analytics resources in the ecosystem supporting Internal Audit is one of the biggest drivers of analytics effectiveness. 

Poor or absent enterprise data governance results in poor data quality, and analytics are only as good as their underlying data. In addition, poorly functioning business applications and reporting systems are difficult to query, and new business applications helmed by novice functional SMEs are unlikely to yield significant value. 

Persevere With Courage and Resilience

In an excellent comment on Tom’s LinkedIn post, an Internal Audit Director highlighted two crucial ingredients for succeeding with any Internal Audit data analytics project: 

“Courage because results and outcomes will likely take an investment of time. Fostering a culture of failing fast when teams are already pressed for resources can be challenging. Resilience because it’s an iterative process. Building this capability across your team requires everyone to keep getting back on the bike.” 

‍The Internal Auditor of the future is fully data-enabled. We can’t let these challenges block our progress. As you forge ahead on your analytics journey, be courageous and resilient. Work around the roadblocks, keep iterating, and keep sharing the lessons you learn along the way. 

‍Ready to level up your data analytics game and start working toward solutions? Instructor Jim Tarantino leads the Internal Audit Collective’s new data analytics program, DRIVE, designed to enable Internal Auditors of all levels to better integrate data analytics into their work. The course will be available for sign up this week.