Internal Audit in the Digital Age
September 3, 2018
KPMG LLP (KPMG) and Forbes surveyed more than 400 Chief Financial Officers and
audit committee chairs, and a key result was a “value gap” between what they viewed as
priorities and what they received from their Internal Audit function.
An effective Internal Audit function should not only magnify what the organization already knows, but also present new findings, offer new perspectives, and provide new ways of gleaning such insights.
An effective Internal Audit function should not only magnify what the organization already knows, but also present new findings, offer new perspectives, and provide new ways of gleaning such insights. Responding to emerging risks and being proactive in identifying and mitigating risks is now expected in addition to assessing controls already in place. To successfully meet these expectations, Internal Audit functions need to embrace technology and hone critical thinking and communication skills.
These challenges are happening against the backdrop of a new inflection point of technology in the economy. The 2016 World Economic Forum in Davos, Switzerland referred to this as the “Fourth Industrial Revolution.” As society rapidly adopts digital technologies and digital business models, this sets the stage to transform every
aspect of life, particularly the future of work and employment. Colleges and universities will need to prepare the future workforce for this reality and transform their own business processes to remain competitive.
There are three key trends from the Fourth Industrial Revolution that impact college and university internal audit organizations:
1. Data Analytics leverage data to gain insights and evaluate risks. The Internet of Things, social media, and mobile devices are creating a treasure trove of information that can be analyzed along with the traditional transactional data maintained in college and university information technology systems. The results of such analysis can be utilized to guide and focus internal audit activities.
As demonstrated in the graphic, the integration of technology-enabled data and analytical tools and techniques impact all phases of the internal audit life-cycle (risk assessment, planning, scoping, execution, and reporting) and can help internal audit organizations provide greater insights and help mitigate risks.
One example of an interesting and effective application of data analytics is the evaluation of student engagement and retention. Student engagement and retention is a critical component for the success of an institution and its students. Retaining students increases revenue and school rankings. It also improves students’ chances of post-higher education success upon graduation. To measure student engagement and predict retention, data analytic routines evaluated student interaction with the institution. The data for this analysis came from school e-mails, online learning portals (e.g., interactions, grades, assignments), dining hall usage, access badge swipes into gyms and student centers, social media usage, and interactions with professors.
Assembling the data and making comparisons across different cohorts of the student population allows for an evaluation of student engagement success across different schools and colleges, departments, majors, living arrangements, and campus locations. Leading and lagging organizational units can then be identified, allowing risk-based internal audit projects to find leading student engagement practices that can be migrated to lagging units.
2. Culture Risk gained the attention of organizational leaders as the cause of many misconduct incidents impacting the public’s trust in educational institutions. A quick review of college and university scandals include athletic departments, child abuse, misleading external reporting, financial aid, and campus security. The impact on institutional reputations is a stark reminder of the importance of culture. Even if an institution has a well defined strategy and internal control procedures, if its culture does not support the execution, then success is unlikely. Culture can be observed, monitored, and changed over time to encourage desired behaviors. A broad culture program addressing the issues of governance, compliance, and risk management, can also focus on an understanding of how institutions make decisions and how those decisions are influenced by culture. Internal Audit can help by:
• Assessing the institutional culture
• Completing an evaluation of performance measures to ensure desired behaviors are rewarded
• Surfacing culture risks though data analytics
• Participating in investigations involving potential misconduct
• Evaluating the cultural impact resulting from the findings of all audits conducted by the Internal
Audit department
The use of IA can increase the effectiveness of college and university operations when resources are tight by improving the execution of controls and freeing staff from routine tasks to allow for more analysis.
3. Intelligent Automation (IA) is touching all lives. Amazon’s Alexa helps manage homes and self-driving cars are on the horizon. New tools and technologies are making it possible to automate many of the routine operational functions of an organization. We are seeing organizations adopt IA and automate transaction processing, report results, review and organize large volumes of data, manage call centers, and automate routine controls. The use of IA can increase the effectiveness of college and university operations when resources are tight by improving the execution of controls and freeing staff from routine tasks to allow for more analysis. Internal Audit organizations need to address IA in three different ways:
• Review integration of governance, risk, and control considerations throughout the automation
program’s life cycle as it is deployed
• Help the organization identify opportunities to embed automation-enabled controls activities into
business processes
• Capitalize on IA innovations to increase the effiency and effectiveness of internal audit activities
Because of these ever-growing technology tools, the internal audit community has an opportunity to
embrace change. Internal audit departments can serve as a strategic partner with the board and senior
management to assess and manage risks in new ways in light of intelligent automation, cyber-physical
systems, and digital labor.
Internal audit professionals should learn about the capabilities of new technologies, synchronize with
senior management on the strategy and approach, and define internal audit’s role in the digital
transformation. Internal auditors should also think about the “art of the possible” in executing internal
audit responsibilities and evolve the “possible” into proofs of concepts before bringing them to life.
About the Author
Joseph E. Seibert
Joseph E. Seibert is a partner in KPMG’s Internal Audit & Enterprise Risk Practice with more than 35 years serving higher education clients.
Read Full Author Bio