Stephen Coates - stephen.coates@egp.vn
Stephen Coates is an independent professional who provides real clear insight on matters affecting governance, risk, and compliance professionals, and internal auditors.
What is each about?
Data analytics and continuous controls monitoring are not new concepts. Internal auditors and business units have been using data analytics for many years to test controls and validate business progress.
The appeal of continuous control monitoring appears to have been rising in recent years. This is because when organisations invest in significant levels of data analytics to assist the internal audit function or the business as a whole, the next logical step is to make the process more organisationally holistic, and repeatable over time.
This demand for increased analytics has been driven by the big data[1] phenomenon brought about by increased online services. As analytics maturity rises within organisations the “repeatable over time” continuum moves to a more continuous arrangement.
Once organisations have established a foundation of significant analytics that are repeatable either in the internal audit plan, or within a business function, the natural next step is to implement a more frequent process. Where this occurs within the internal audit function to collect evidence and other indicators the nature of analytics is called continuous audit. Where the repeatable analytics occur as a feedback mechanism as part of management responsibilities the nature of analytics is called continuous control monitoring. This brief does not deal with continuous audit.
Who should own each?
The question of ownership depends on the nature of the organisation, and the maturity within business units to champion data analytics or continuous control monitoring.
Ownership generally goes with those who benefit the most from the outputs/outcomes. Traditionally data analytics is owned by either internal audit or management, dependent on the end user of the analysis. Continuous control monitoring by its very nature is traditionally owned by management. It is more often a feedback mechanism used by management to ensure controls operate as expected and can form an important element of the internal control environment.
Contrasting Benefits
Both data analytics and continuous control monitoring provide significant benefit for internal auditors and business unit leaders. They allow historical, real-time, or predictive insight into business and control issues.
The different skills sets, outcomes and investment needed of each largely determine the value and organisation will achieve from each.
Data Analytics
Data analytics has the benefit of being able to quickly identify and assess a particular business or control issue. This allows for a timely reporting to line management, senior management, and those charged with oversight. A problem or business issue can be articulated, and the relevant data sources analysed and compared to produce a data analytics outcome.
- Can access and analyse data from many disparate sources.
- Scripted routines allow analysis independent of the systems and people being audited.
- Sampling is redundant with 100% transaction coverage possible with unlimited file sizes.
- Data integrity is maintained through logical control ensuring read-only data access.
- Automated audit trails document steps taken.
- Test logic is captured with scripting/batching techniques.
- Results are achieved in a short period of time.
- Allows for the quantification of control weaknesses.
Continuous Control Monitoring
Continuous control monitoring is a more investment heavy process, that requires risk assessment, planning, review, and cross business line support.
The processes subject to continuous controls monitoring are often the more stable and mature ridged controls within the business.
Automating analytics processes in the form of continuous control monitoring brings additional organisational benefits including:
- Improved financial and operating controls.
- Rapid decision making and business improvement.
- Real time response to real-time issues.
- Implementing automated detective controls.
The maturity of an organisations use of analytics tends to go from simple data analytics through to continuous control monitoring, with several interim capabilities along the journey.
Implementation Considerations
The journey from simple data analytics to complex repeatable and continuous control monitoring is not easy. Despite the clear benefits of having a comprehensive repeatable set of analytics organisations still struggle with implementing effective enterprise-wide initiatives. Areas for special consideration include:
1. Articulating an organisational risk tolerance level and what internal or external forces cause it to change. These factors are fundamental to a continuous monitoring solution.
2. Understanding the organisation’s risk profile so that appropriate monitoring can be put in place. What should be monitored? Which metrics should be collected? What is normal and what is an exception?
3. What rate of monitoring should be employed given organisational capability to respond? Is continuous realistic?
4. How often to revisit continuous monitoring capabilities to deal with changed business circumstances, new business capabilities, and emerging threats?
5. Capacity to scale continuous monitoring to cover your entire organisation. Organisations must be realistic about how much coverage can be achieved with a given budget and stated goals for organisational risk tolerance.
A successful continuous control monitoring regime will include proper risk assessment to identify the risks that need to be monitored.
It will consider existing controls and evaluate residual risk after those existing controls.
Analytics will be focused on both specific transactional and process risks as well as information technology general controls that protect the overall integrity of organizational systems.
Summary
Data analytics and continuous control monitoring are not new concepts and the appeal of automating analytics to continuous control monitoring is clear.
Once organizations have established a foundation of significant analytics that are repeatable the natural next step is to implement a more frequent process. This can take the form of repeatable data analytics, continuous audit, or a wider reaching continuous control monitoring.
Ownership of continuous control monitoring generally is assigned to those who benefit the most from the outputs/outcomes. If the owner is internal audit, then the process may simply be limited to continuous audit.
Both data analytics and continuous control monitoring provide significant benefit for internal auditors and business unit leaders.
Simple data analytics has the benefit of being able to quickly identify and assess a particular business or control issue while automating analytics processes in the form of continuous control monitoring brings additional organisational benefits through repeatable and comparable coverage over time.
The journey to continuous control monitoring is not easy and despite the clear benefits of having a comprehensive repeatable set of analytics many organisations still struggle with implementing effective enterprise-wide initiatives.
A successful continuous control monitoring regime will include proper risk assessment, will take into account existing controls, and analytics will be focused on risks with a goal of protecting the overall integrity of transactions and processes.
[1] Big data refers to data sets so large traditional analytics approaches need to be rethought.
Next Steps
To move forward with TeamMate, Envizi or our Fraud Box schedule a briefing from Enterprise Governance Platform – Vietnam at here
Stephen Coates CIA CISA CGAP CRMA PFIIA FGIA is known globally for his work with the internal audit profession, and lives with his family in Vietnam and Australia. In 2022 Stephen was awarded the Bob McDonald Award from the Institute of Internal Auditors - Australia for his outstanding service to the internal audit profession. He provides real clear insight on matters affecting governance, risk, and compliance; and internal audit. Stephen is available to speak live at your event from small boardroom events to jam-packed conference arenas. He is available to travel anywhere in the world in person or to participate virtually.
