The challenges of auditing & analytics

Technology is both the biggest threat to an accounting practice in 2018 and its greatest salvation. Attendees at the 48th Annual Virginia Accounting & Auditing Conference (A&A), held in three locations around the state last fall, learned about how various facets of technology, like data analytics and cyber security, will affect the future of work.  

VSCPA member Joan Renner, CPA, shareholder at Renner & Co. in Alexandria, touched on her own career in her session “Today’s Analytical Procedures — A Practical Approach.” Her session covered the challenges that come in marrying technological advances in the area of data analytics to the rigorous Generally Accepted Auditing Standards that already exist. 

“The challenge in this particular topic is that we know our auditing standards. There are people who know data analytics software, but they aren’t auditors,” she said. “The challenge is connecting what data analytics can do with what we do every day.” 

Renner pointed out that U.S. Generally Accepted Auditing Standards (GAAS) haven’t changed. Audit procedures are still aimed at assessing and addressing the risk of material misstatement. Data analytics are best viewed as a tool to accomplish those goals. 

Auditors start by gaining an understanding of a business and its systems, then walk through key controls and perform planning analytical procedures before assessing audit risk. They then address those risks with substantive tests, including analytical procedures, perform those analytical procedures, then evaluate their findings and issue a report.  

“It’s not a black box where you put out a bunch of charts,” Renner said. “It’s addressing a risk you may have assessed and reducing that risk to an acceptably low level.” 

Analytical procedures can also help by bringing in nonfinancial data — a head count of registrants for an event, or a monthly customer count from a point-of-sale system, or even the number of meals served at a banquet. Those figures can serve as plausible approximations for certain types of financial data.  

Other uses include identifying “fuzzy duplicates” in databases — Brookings Institution vs. The Brookings Institute, for example — or in finding potential fraud indicators, such as multiple employees being shown with the same address or bank account. Organizations could also make use of Benford’s Law, which deals with the statistical frequency of the first digit of numbers in sets of data, in analysis. 

“Analytical procedures are powerful tools. They support audit effectiveness because they show things that don’t look right,” Renner said. “They support audit efficiency because when we get to a point where things look right, we’re done.” 

Another application for data analytics — one that the VSCPA has touched on before — is in auditing a larger sample size, or even an entire population. 

“I remember editing big, heavy books that were written in pen,” Renner said. “You couldn’t possibly look at every entry. You had to sample. I believe in the value of sampling. Sampling is darn good. If you have a sample size that corresponds to your materiality level and the size of your organization, that’s good.  

“There’s nothing wrong with sampling. It’s just that if we had electronic books forever, we wouldn’t have been encouraged to do sampling. We’d have been encouraged to do things like this all along.” 

Some analytics software is even more capable of identifying risk. MindBridge incorporates artificial intelligence (AI) technology and can evaluate every transaction in a general ledger by risk — high, medium or low. Tableau is aimed at creating attractive data visualizations to impart information to non-accountants.  

Software that incorporates AI can go even further in analyzing risks like numerous transactions being processed by the same person, or being processed by the CFO on a Saturday. 

“Typically in big companies, people might not work on nights and weekends,” Renner said. “If you see somebody going into the office on nights and weekends, that’s a sign of a risky transaction that needs to be looked at more closely.” 

You may already be using a widely used analytics tool: Excel. The Microsoft product offers analytic capabilities and chart visualizations in an accessible format, although its limitations are clear. Users must scrub data into a usable format and must know the proper formulas. Excel does not control the integrity of data or facilitate audit documentation. 

The American Institute of CPAs (AICPA) offers limited guidance in the analytics area. Essentially, if a product moves your audit procedures forward, it’s appropriate. 

“They don’t tell you what software to use for what procedures,” Renner said. “They tell you to use your best judgment, but stay tuned for further developments in this area.”