Auditors are required to “gain an understanding of internal control” on all audits because—in theory—this knowledge will help them refine their assessment of risk and modify their audit approach accordingly.
The reality is much different.
Internal control is abstract. It’s about process, and auditors just want to know if the final numbers are right. There are only so many different types of tests auditors can perform, and in most cases, the audit won’t change regardless of what the auditor learns about internal control.
The sad truth is that most auditors find internal control important for complying with professional standards but largely irrelevant when it comes to the actual audit.
Data analytics might change that dynamic in order to make internal control more exciting and accessible.
Internal Control as an Assessment of Analytics Readiness
The path to internal control relevance begins with auditors understanding that their clients are working just as hard as CPA firms are to incorporate data analytics into their business models. Any insight auditors can provide about this digital transformation is a significant value add.
The first requirement of data analytics is accurate and complete data, which in return requires a reliable information system. Complete and accurate data—isn’t that the objective of internal control?
The auditor’s understanding of internal control and the client’s need for high-quality data are two sides of the same coin. If auditors viewed their walkthroughs and other internal control procedures as a window into the client’s ability to produce timely, high-quality data (its “analytics readiness”), then the value of the internal control work would be more apparent.
Auditors Need to Own Data Quality
Organizations undertaking digital transformation struggle with data quality, and they make significant investments to clean it. Someone will ask, “What do we have to do to make sure these kinds of errors don’t happen in the future?” The answer is improved internal control. And that is why auditors need to get out ahead of this issue and have conversations about internal control before the data scientists beat them to it.
If auditors want to be in the room where strategy happens, then owning data quality is their ticket. Internal controls are the key to data quality.
It may be a stretch to suggest that walkthroughs will become game changers on most audits. But when evaluated within the context of data analytics, these and other control procedures certainly have the potential to provide much more value in the future than they do today.