How a Data-Driven Auditing Approach Can Increase Trust in Business

By EY

The ability to analyze vast amounts of data will transform the audit. Could it also increase trust and transparency?

In brief

The digital transformation of the corporate world is creating a new value chain based on harnessing the value of data.
This will facilitate a move to a data-driven approach, with the potential to increase trust in the process and provide greater transparency for stakeholders.
A limiting factor is the extent to which existing audit standards allow for the use of advanced data analysis techniques.

As their activities become increasingly dependent on digital technologies, companies in every sector are generating and gathering ever-increasing quantities of data. A new vocabulary has emerged to encompass these vast volumes, featuring words such as exabyte (10¹⁸bytes), zettabyte (10²¹bytes) and yottabyte (10²⁴bytes). The potential to create new forms of value from these data assets, as well as to transform or protect current business models, was widely acknowledged even before COVID-19 accelerated digitalization.

Digital transformation can create entirely new business models, such as the online data-driven platforms that transformed the markets for short-term accommodation and taxi services. But to date, these global successes are the exceptions. The majority of companies are struggling with a common challenge: to transform their business model by turning data from a cost – to acquire, store, protect, manage and distribute it – into an engine of value.

The next-generation value chain

In their pursuit of digital transformation, companies are, to differing degrees, adopting data-enabled technologies. These technologies, including natural language processing, voice recognition, virtual or augmented reality and computer visioning, are based on machine-learning algorithms and supported by the limitless computing capacity offered by cloud computing.

However, this drive to become an “intelligent enterprise” requires more than technology. It is a fundamental transformation that sweeps across an enterprise’s value chain, its people and its culture. Harnessing the power of data to create value is a balancing act, one that can be captured in what we call an intelligent value chain. This framework starts by identifying the value the company aims to create, then defines the business model needed to achieve this value, along with the intelligence, data and technologies required to power the business and create value. All these elements need consideration and investment to create a data-driven enterprise.

These five elements – value proposition, business model, intelligence, data and technology platform – are linked and validated by a sixth essential element: trust. Companies that aim to digitalize in this way must design every part of their intelligent value chain in a way that creates and promotes trust among their stakeholders, so that everything created along the value chain can be trusted.

This digital transformation of the corporate world has profound implications for audit professionals. Evolving business models, the digitalization of companies’ operations and the ability for auditors to gather and analyze huge quantities and depth of digital information will further change the way audits are carried out.

As they digitalize, the businesses of audited companies are transforming to resemble increasingly fluid ecosystems in which value chains are broken up, with key elements sourced in real time from external service providers and sub-service providers. Corporate distribution channels are also extending and diversifying across B2B, B2C and B2B2C. Being able to embed trust across these ecosystems will be key. Arguably the biggest question will be where the boundaries of the scope of the audit will lie in the future.

New data flows

How auditors conduct the audit will also change as corporate data proliferates. The roll-out of 5G telecoms networks will bring to life the Internet of Things (IoT) – billions of connected devices that capture data through remote sensors. For example, a growing number of companies are using blockchain-based logistics systems to automate the processing of goods in transit and improve efficiency and transparency. Innovations such as these are resulting in new data flows that provide new sources of information that will feed into the audit process.

The possibilities created by these new data flows include auditing full data sets rather than restricted samples, which provides more comprehensive audit evidence. It also gives auditors the opportunity to deepen their understanding of a company’s financial and nonfinancial information, leading to better identification of risks of material misstatement, including fraud risks.

Applying large-scale data analysis allows audit teams to check the accuracy of the financial statements much more quickly and in far greater detail. It also means that the ability to use data analytics and interpret the results produced is becoming a core skill for all auditors, rather than the domain of specialists. Data analytics is applied front to back from upstream feeder systems to the general ledger. Training in data analytics for audit teams has therefore become a major priority for audit firms.

Increasing trust in audit

There is also clear potential for data-driven processes to increase trust in the audit process and to expand trust by, for example, providing assurance over the security and privacy of IoT data captured and processed by an audited entity. Becoming more data-driven will also allow auditors to demonstrate how they have reached their conclusions, providing far greater transparency for stakeholders. However, this increase in trust is only possible when auditors document clearly which data they have accessed, checks they have made, processes they have followed and technology they have used, so that an independent third party can clearly understand how the audit was carried out.

Similarly, over-reliance on technology to carry out the audit would be a dangerous mistake. Technology can undoubtedly improve the speed and accuracy of the audit, but they cannot be expected to replace the professional judgment of an experienced auditor. Processes put in place by the audit teams must be robust enough to allow for the risk of technology failing.

Auditors will still need to confirm internal control systems, carry out independent valuations and apply professional skepticism. However, applying data analytics where appropriate should enable them to focus on areas where their professional skills are most valuable.

The regulatory environment needs to evolve so that auditors can make more effective use of data and data analysis techniques. A limiting factor today, from the auditor’s perspective, is not the capability of their technology, but how far existing audit standards will allow them to apply this in place of traditional methods.

How technology adoption is a breakthrough

Although the idea that large-scale data analysis could enable real-time auditing is appealing, it is not aligned with auditors’ current mandate to confirm the financial statements on a quarterly, half-yearly or annual basis, as applicable. Even if the technology makes near real-time auditing a possibility, is the market looking for this level of trust in companies’ finances?

COVID-19 has accelerated the process of digitalization in many companies and sectors and has made many of them more willing and better prepared to share data electronically, using secure channels. This goes far beyond documents: in recent months, EY auditors have undertaken a walkthrough of a company’s data center via a video link to a laptop, for example.

The realization that companies and auditors can change the way they operate so rapidly, provided all the key stakeholders and decision-makers are agreed and support greater technology adoption, is an important breakthrough for both audit firms and the companies they audit. It should add momentum to the accelerated progress of using advanced data analytics to conduct audits, and facilitate the shift from a data-enabled digital audit today, to a fully data-driven audit in the future.

But other vital elements must also fall into place. On a practical level, there is wide variation in how prepared companies are to conduct data-driven approaches. The limiting factor is typically whether companies have an integrated technology stack that will allow them to extract data and analyze it in a consistent and rapid manner. Some organizations may also restrict the access and usage of data outside their own control environment; indeed, in some jurisdictions, local data privacy laws are even more restrictive.

Similarly, the regulatory environment needs to evolve so that auditors can make more effective use of data and the data analysis techniques that have become available. A limiting factor today, from the auditor’s perspective, is not the capability of their technology, but how far existing audit standards will allow them to apply this in place of traditional methods. Regulatory questions are likely to become especially urgent in areas where auditors’ use of data analysis starts to reveal new insights into the business that go beyond the strict scope of the audit mandate itself. Sharing those insights with the audited company will raise vital issues of independence that demand careful consideration by both auditors and regulators.

The move to a much more data-driven audit process is underway and will continue to progress at high speed. The question is not if, but when and to what extent the data-driven approach will transform traditional audit processes.

Summary

The digital transformation of the corporate world means auditors now have access to vast quantities of data. The move to a data-driven approach has the potential to increase trust in the audit process, but the auditor’s professional judgment still has a key role to play.

The article was first published here.

Photo by Pietro Jeng on Unsplash.