Introduction
During the past decade, the tech world has been unceasingly introducing new technologies at a pace faster than any of us has experienced before. It is undeniable that these new and improved technologies have also led to the introduction of more complex systems and processes which are usually described using simple buzzwords for convenience of communication.
Despite the fact that such complex systems and processes might seem overwhelming to many, a wide range of professions are embracing and striving to tap into such technologies either to improve the efficiency and effectiveness of their services, or in response to pressure to remain relevant in this rapidly changing environment. The COVID-19 pandemic has also triggered an increased demand for these technologies.
Among the plethora of new technological advancements introduced, buzzwords like big data, data analytics and artificial intelligence have captivated the interest of the accounting profession. This interest arises mainly due to the expected opportunity for this technology to open doors to new opportunities never encountered before and the potential for it to revolutionise the way things are done within the accounting profession.
What is "Big Data"?
Big Data is a term used to refer to extremely large data sets that may be analysed using technology to reveal patterns, trends and associations. It may also be argued that the term Big Data refers to data sets so large and complex that traditional data-processing software applications are not sufficient to deal with them. The key fact to keep in mind is that the concept is still continually evolving as digital transformation and reliance marches onward.
Evolution aside, a constant definition of Big Data comes in the form of the 3Vs, namely Volume, Velocity and Variety. These may be briefly defined as laid out below.
a) Volume
Volume is the V most easily associated with Big Data. When it comes to Big Data, we are talking about quantities of data that reach proportions so immense as to be incomprehensible. A good example of this is Facebook as at the end of 2016, Facebook stored approximately 250 billion images and contained 2.5 trillion posts. Now factor in the Internet of Things ("IoT") — imagine a connected temperature sensor; at a measurement rate of once a minute, that is 525,600 records per year. Now consider how many heat sensors there may be at an oil refinery or a palm oil mill. That's volume.
b) Velocity
Velocity is, quite simply, speed. In the Big Data context, this is a reference to the speed at which data is created, and therefore the speed at which it must be processed and stored in a manner in which it can be easily retrieved and viewed when needed. The developments in connectivity bandwidth, smartphones, cloud computing and the IoT have driven growth at this speed. Go back to our example of temperature sensors at a refinery and imagine now that each sensor is taking a reading every 30 seconds, or every 15 seconds. The speed of receiving, categorising, storing, retrieving and analysing the data must be on par with the speed of creation of the data.
c) Variety
The massive volume and sources of data to which we have referred to above would also mean that such data is likely to be created in a wide variety of types and formats. The data would now be a combination of structured data and unstructured data.
Structured data is information that is stored within defined fields or formats and is organised, processed and accessed in an orderly manner based on a predefined data model. Traditional databases, excel sheets, etc., all fall into this category.
Unstructured data is not necessarily stored in fields or defined formats based on a pre-defined data-model. Photographs, video, Twitter feeds, online chats, voice recordings, etc., are examples of commonly encountered unstructured data.
Challenges of Big Data
a) Cost
Significant investments are required to be committed to acquiring, upgrading and customising the hardware and software capable of handling Big Data. Additional costs would also be required in recruiting and training human resources to bridge the talent gap in Big Data handling and analysis.
b) Regulation
Organisations will require enhanced policies and controls over the collection, categorisation, storage and usage of data. These processes will not only need to be in compliance with the relevant regulations passed by the regulatory authorities, but may necessarily need to be ahead of the learning curve of the various regulatory bodies' own knowledge. Non-compliance such regulations could have serious reputational and punitive consequences to an organisation.
c) Data security
The immense amount of data stored within an organisation could represent a digital treasure chest of confidential, personal and proprietary knowledge. This will attract potential security breaches driven by a range of motivations. In addition to the potential loss of business that could come from the loss or exposure of this data, civil legal action and regulatory sanctions may also be suffered as the result of data breach.
Data Analytics
Data analytics refers to the process of analysing and examining data to identify trends and new insights as well as drawing conclusions that can help organisations make informed business decisions. Analytics as a concept is not at all new — analytic tools have been in regular use in business since the mid-1950s.
The main characteristics that set big data analytics apart from traditional basic analytics are speed, efficiency and integration of multiple data types. Major leaps in technological advancement in the past decade have enabled organisations to process data much more efficiently and faster by leveraging specialised analytics systems and software to perform the data processing. Organisations can now gather information, run analytics and draw observations and conclusions in a real-time or near real-time manner, and from combinations of data sources, enabling them to make informed decisions and take a competitive edge they never had before.
Data analytics usually involves several types of technology being applied together in order to harness the most value from the data provided, which includes the following examples:
a) Data management
Process of acquiring, organising, validating, securing, and processing data to ensure that such required data are accessible, reliable (meeting the required standards for data quality), and timely.
b) Data mining
Examining data to discover patterns and establish relationships such as connections, sequences, and correlations between several events.
c) Predictive analytics
Analytics which aims to predict the future outcomes of a set of data input. Such analytics usually involve statistical algorithms techniques and machine learning technologies that predict the likelihood of future outcomes based on historical trends and outcomes.
d) Text analytics
Analysing text data by combing through text from websites, emails, books, documents, social media and other text based sources to gain useful insights for the user with the aid of machine learning and natural language processing technology.
Data Analytics in Auditing
Auditing has often been referred to as a "grey profession", a profession steeped in standards, tradition and methodology. With all the development going on around us, the primary role of the auditor remains unchanged - to act as an independent party where robust audits are to be performed to serve the public interest by enhancing the credibility of the financial information presented to stakeholders.
Auditors have been performing early versions of analytics all along, through the concepts of high level analytical review, detailed analytical review and corroborative review. The advent of new technologies, systems and processes has, in effect, given auditors access to information, analytical power and processing power at a level never before experienced and therefore, quite possibly never before considered or imagined in relation to its impact on the practice of auditing. So, although the primary role of auditors has not changed, the way audits are done will continue to transform to ensure that the highest quality of audit evidence amid the rapidly changing and increasingly demanding business environment.
While the profession has long recognised the impact of data analytics on enhancing the quality and relevance of the audit, widespread use of this technique has been hampered due to a lack of efficient and economically feasible technology solutions as well as talent gaps in data analytics. However, recent technology advancements in data analytics and machine learning are providing a promising opportunity to relook the way in which an audit is executed.
The key aspects of integrating data analytics into an audit is to facilitate auditors to better understand the business, identify key audit risk areas and deliver enhanced quality and coverage while providing more business value.
Data analytics are commonly used in an audit to identify key audit risk areas and even identify potential red flags through analysing patterns and relationships between multiple sets of data in a client's business. The multiple sets of data used for the analysis are not only restricted to data from the financial reporting system (i.e. general ledger, sales ledger, accounts receivables and payables ledger), but can also span data from other sources such as sales statistical data, customer/vendor master data, employee master data, and financial/non-financial budgets. By better understanding the factors and drivers affecting the specific areas of the client's business, auditors are now able to identify key audit risk areas in a more effective and precise manner. Simultaneously, the findings which auditors can provide by interpreting data using data analytics will help improve their dialogue with clients at all stages of the audit.
The use of data analytics expands the audit beyond traditional sample based testing, to include analysis of entire populations of audit-relevant data, hence enhancing the quality and coverage of audit evidence. There are already existing analytic tools like IDEA and ACL that can perform a variety of analyses, based on the parameters designed by the auditors, and then provide lists of exceptions for the auditor to evaluate. Yet, it is machine-learning technology that will bring data analytics to a whole new level. Data analytics augmented with machine learning technology is able to learn based on the auditor's previous conclusions pertaining to the results of the analysis; such as whether the exceptions identified are genuine or false positives. Hence, for this instance, the more conclusions the machine learns from the auditor, the better it is in identifying the exceptions.
Nevertheless, the risk in this manner of application, often referred to as data bias risk, is that the machine learns from the previous conclusions made by the auditor, irrespective of whether the conclusions made by the auditor are correct or incorrect. In this case, the machine would start to clear certain items that should be exceptions or vice versa. Therefore, it is imperative to put in place a robust review process to ensure that conclusions being fed into the machine learning are correct and accurate.
In more advanced applications, a set of transactions are input into a data analytic tool with machine learning technology to identify the patterns in the transactions and be able to identify a specific norm of the transactions. Subsequently, the tool can then be used on other sets of transactions with similar nature to identify transactions that don't match the specific norm as exceptions. This application of machine learning is also subject to data bias since the specific norm is determined based on the set of data provided. For instance, if the data set that was used to determine the specific norm consists of a high quantity of incorrect transactions, then such incorrect transactions would be deemed as within the specific norm and hence would not be identified as exceptions.
Currently, many audit firms are already delivering audit analytics by extracting large amounts of client data and subsequently analysing the data on separate machines with dedicated audit analytics software. While these analytics are often performed in the audit firm's environment, the next major leap for data analytics in future audits, with the help of artificial intelligence and machine learning technology, is for audit firms to be able to install intelligent audit analytic software that resides within their clients' data centres and stream the analytical results to the audit teams real-time, facilitating continuous auditing.
Businesses are already beginning to expect auditors to deliver more insights and value to the business as part of the audit, through the use of technology and innovation. The use of data analytics and machine learning will definitely be the key solution for the audit profession to provide more value to clients. As mentioned above, through the use of data analytics and machine learning, auditors are able to highlight not only financial reporting matters but also other value-adding findings as part of the overall audit findings, which clients were not previously aware of; such as the relationship between certain factors and the business performance, significant drivers affecting the business performance, key business risks and red flags to fraudulent activities.
The auditor's role will switch from performance of administrative procedures to the design of procedures, interpretation of the results generated through analytics, and exercising professional judgement on conclusions based on these interpretations.
The transition to this future would not be achieved overnight, as after all, it would be a massive leap for the profession to transform from traditional audit approaches to one that fully integrates data analytics and artificial intelligence in a seamless manner.
What are the challenges?
The transition to an integrated audit with data analytics and artificial intelligence will not be without challenges. There are a number of barriers that must be addressed beforehand.
a) Data extraction
In order for auditors to perform analytics in an audit, auditors must first be able to extract their clients' data efficiently and cost-effectively.
However, it has been increasingly essential for organisations to invest significantly in data security amid the various data breach scandals occurring lately. Organisations are required to protect their data, usually with multi-layered approval processes and technology safeguards. As a result, the process of obtaining client approval for the provision of data to the auditors can be difficult and time-consuming. In the 3V world, auditors (and their clients) are also going to need to transition from extracting and taking away data to simply being given extensive access to data warehouses on-site.
b) Wide array of accounting systems
The wide array of accounting systems often encountered by auditors within their portfolio of clients and, in many cases, multiple accounting systems within the same company can be overwhelming in terms of extraction of data.
Extracting data from unfamiliar accounting systems could prove to be a painstaking process. This results in multiple attempts and a lot of back and forth between the company and the auditor on data capture.
Currently, the extraction of data is often limited to accounting ledger data. However, exploiting Big Data to support the audit will mean obtaining both structured and unstructured data, financial and non-financial. This increases the complexity of data extraction and data mapping.
c) Skills gap
Integrating data analytics and artificial intelligence into an audit will only be meaningful when it influences the nature, scope, and extent of the audit. This will require auditors to develop new skills focused on knowing what questions to ask of the data, and the ability to use the outputs from analytics to produce audit evidence, draw audit conclusions and derive meaningful business insights.
A ground-up initiative to better understand and influence the education programs in universities and colleges, enhancing learning and development programs within the audit firm, and establishing the appropriate implementation programs to support audit teams will be required to effectively integrate data analytics and artificial intelligence into the audit.
d) Aligning with auditing standards and regulations
The auditing profession is currently governed by standards and regulations that were formulated well before the advent of Big Data. Although there are continuous efforts made to maintain the relevance of the standards and regulations through amendments and introduction of new standards, standard setters, like all of us, are effectively playing catch-up in understanding and considering the relevant factors and feedback from various stakeholders before the auditing standards and regulations can be truly be aligned with the use of data analytics and artificial intelligence. Major areas that need to be addressed are as follows:
i) Validation of data
As part of the audit procedures in an audit, auditors are required to determine the clerical accuracy and completeness of information or system-generated reports provided by the client and whether it is appropriate to be relied on, before performing further audit procedures on such information and reports.
But Big Data related audit analytics rely on the raw transaction data being extracted directly from the underlying databases, as well as unstructured data from other sources. Procedures are then required to be performed to validate the accuracy and completeness of the data, and then reconciled to the system generated reports given to auditors to ensure that the audit analysis is based on the same data the company uses to produce its financial information. Having said that, there are limitations in the extent to which auditors can perform these procedures on such data due to the complexity and volume of data involved, especially in a Big Data environment.
ii) Hierarchy of audit evidence
The standards provide a hierarchy of evidence, with third-party evidence at the top and management inquiries at the bottom. However, the standards do not indicate what type of evidence analytics provides. It is possible to relate some of these types of tests to the current framework in the standards, but not all. Without a proper description of the type of evidence that analytics provides, auditors are reluctant to claim it as evidence, thus potentially negating the benefits.
iii) Audit Regulators
The use of data analytics in audits could raise concerns among standard setters on the approach for audit regulators to assess the integrity of the data analytic tools used by auditors and whether they are functioning as intended. Auditors often use data analytic tools endorsed by their audit firm to ensure the tools' reliability and effectiveness. However, the programming scripts driving the functioning of the more advanced and complex data analytic tools are usually not maintained in the audit file and hence are not available for regulators to review. Although details of the underlying programming scripts and the parameters can be documented in the audit file to a certain extent, such data analytic tools are often operated globally and might be maintained outside the geographic jurisdiction of the local audit regulators. In short, auditors will need to adopt a standard approach to ensuring and demonstrating the integrity of the data analytic tools used.
Conclusion
We delved earlier into the 3Vs of Big Data, but there is arguably a 4th and 5th "V" that needs to be considered.
The first of these is Value, which is increasingly referred to as the most important aspect of Big Data. The ability to turn the investment in technology to collect and process Big Data into valuable knowledge and insight in return is key to businesses. It follows from this that the application of traditional audit skills to the new technologies should and would generate the types of insights that achieve just this objective.
The final V is Veracity — the correctness and reliability of the data. Again, the knowledge of and skills of the auditor can and must be brought to bear in this area not only for the auditor to be able to rely on the data, but also to provide the assurance to their clients that they have a level of filtering, checking and accuracy in the data introduced into their systems.
Ultimately, although the primary role of auditors will not change, the way audit is performed in the future will be significantly different from the audit of today, and the subject matter on which those audits are performed will evolve. Auditors will be able to use larger data sets and analytics to better understand the business, identify key risk areas and deliver enhanced quality and coverage while providing more business value. But to achieve this transformation, the profession will need to work closely with key stakeholders, from the businesses they are auditing to the regulators and standard-setters.
The first of these is Value, which is increasingly referred to as the most important aspect of Big Data. The ability to turn the investment in technology to collect and process Big Data into valuable knowledge and insight in return is key to businesses. It follows from this that the application of traditional audit skills to the new technologies should and would generate the types of insights that achieve just this objective.
The final V is Veracity — the correctness and reliability of the data. Again, the knowledge of and skills of the auditor can and must be brought to bear in this area not only for the auditor to be able to rely on the data, but also to provide the assurance to their clients that they have a level of filtering, checking and accuracy in the data introduced into their systems.
Ultimately, although the primary role of auditors will not change, the way audit is performed in the future will be significantly different from the audit of today, and the subject matter on which those audits are performed will evolve. Auditors will be able to use larger data sets and analytics to better understand the business, identify key risk areas and deliver enhanced quality and coverage while providing more business value. But to achieve this transformation, the profession will need to work closely with key stakeholders, from the businesses they are auditing to the regulators and standard-setters.
Subscribe to receive the latest BDO News and Insights
Please fill out the following form to access the download.