The impact of digitisation on internal audit

Automation is rapidly developing the audit sector. As processes become automated, auditors can spend more time on the outputs and inputs of the audit.

The application of machine learning means that every transaction can be vetted, and algorithms can identify discrepancies that can be investigated by the auditor.

Industry expert: Matthew Porter

We spoke to Matthew Porter, Manager (Business Risk Services) at Grant Thornton UK LLP, about the impact and benefits of digitisation on internal audits.

BPP: Where have you already seen the biggest impact of digitisation on the internal audit function?

MP: I think over the past few years the digitisation of internal audit has led to teams really embracing new tools, new skills, and new ways of working. Internal audit teams understand that they need to be tech savvy in order to work efficiently as a modern audit team.

One way I am seeing this is through the interaction with more data-focused tools. I am now commonly seeing organisations and internal audit teams use visualisation tools such as Power BI or ETL (Extract/Transform/Load) tools such as Alteryx.

This trend has certainly led to a new focus within the audits. I am seeing a shift into specific data areas, master data management, holistic data governance reviews, and end-user computing.

This shift in skills, approach, and focus has now developed a real appetite for progression, we are seeing more and more internal audit teams looking to see how they can take their tools and skills further and look into automation. These teams are in turn seeing the benefits of digitisation and understand that automation of their testing and embedding this within the business, could drive real positive change.

BPP: How could data analytics transform internal audits?

MP: Data analytics can transform almost all areas of internal audit, right from planning through to fieldwork, reporting and beyond. I believe this is when we will see the greatest benefits. When internal audit teams are using analytics in the planning of audits to scope risks, and when they’re embedded in reports using statistical analysis and visualisation, this adds additional value to reporting.

I believe this is why automation should be front and foremost in auditors’ minds, because when you have effective automation, where analytics are continuously available at your fingertips, it means you can use analytics at all stages of an audit to make it more efficient, timely, risk-based decisions.

Also, I think with UK SOX coming in and a need for compliance to the tighter controls of regulations, this will mean more time and effort for organisations, but if they’re able to embed analytics or the automation of controls, this will drastically decrease the burden on internal audit teams.

BPP: What skills do you think the modern internal auditor will need by 2030?

MP: I think there will be a wider skillset within internal audit teams by 2030. There will be a desire for more tech-focused skillsets and a greater understanding of advance technology.

At a basic level, it will start with increased use of visualisation tools such as Power BI, and tools that introduce analytics and can be embedded into reporting. More advanced teams will then look to build on this with enhanced tools, and I think we will see much more automation of testing being brought into internal audit as it’s the natural progression to establish risk-based, continuous testing that drives real-time benefits to an organisation.

I think the scope of internal audit will also change, with a need for a much deeper understanding of more advanced technological processes. I think this will cover everything from cyber security right the way through to artificial intelligence and machine learning. To audit these, teams may not need to be technical experts, but they will be required to have understanding, frameworks, and procedures in place to audit them in the same way we now audit processes such as accounts payable and payroll, as these areas are growing in importance, and this is where value against risk is most effectively invested.

BPP: How will this benefit an organisation and the work that they do?

MP: The technological evolution of internal audit into a more tech-focused proposition will have many benefits to an organisation.

Organisations will need to stay on top of new and emerging tech risks, both internally and externally. A well prepared and skilled internal audit team will have the ability to understand these new risks, how to audit them, and how to deliver value through their audits.

The use of analytics and automation will give greater coverage and comfort when testing, enabling testing of 100% of populations and to focus on high-risk exceptions rather than relying on old methods, such as sampling. Automation will then allow more real-time exception testing, not just seeing what the organisation has been doing wrong, but what the issues are now, and testing them in a timely manner to ensure failures in processes and controls are remediated before the impact is felt.

Finally, with the implementation of UK SOX and other potential regulations, a robust analytics resource in an internal audit that understands its organisations systems and controls will enable much easier compliance to any new regulation and will drive much greater consistency and comfort.

Our partnership

The BPP and Grant Thornton partnership brings together the strength of BPP’s history as a leading provider of financial and professional services education, and Grant Thornton’s recognised status as one of the world’s leading organisations of independent advisory, tax and audit. Our blended experience and expertise has resulted in the creation of two high quality data apprenticeships that amalgamates the technical skills requirements of data analytics and internal audit with extensive real world business insight. The result are programmes with practical application from their outset.

If you’re looking for specific data courses to plug skills gaps in your internal audit team or you require a more in-depth consultation to support with workplace planning, we’re here to help.

View courses

Matthew Porter

Matthew is a Manager within Grant Thornton’s Business Risk Services team and has over 10 years’ experience specialising in data analytics across internal audit, external audit and bespoke analytics.

He has a wide range of experience within data analytics, from running graduate training programmes through to embedding analytics at FTSE 100 clients.

Matthew has experience across multiple sectors, from charitable through to retail and manufacturing and has delivered analytics from controls automation through to data governance.