The term data analytics can mean many things. In its most basic form, it can be as simple as writing a macro in Excel, so you have a spreadsheet that does some calculations with automatic formatting to calculate your holiday or recalculate your holiday allowance for a set of employees. It can be as simple as a good Excel spreadsheet or to the point of using artificial intelligence (AI).

Data analytics is about using company data to gain insights and increase the efficiency and quality of work. Within Internal Audit in particular, quality is a big piece, so we shouldn’t be limited to doing the same testing we might have done before on a sample basis - now we can test 100% of the population and continuously monitor 100% of the population. It’s all based on the data.

There are different strands of elements of data analytics:

1. Visualisation

The element that most people will be familiar with is a visualisation like a management information (MI) dashboard. It can be challenging to understand what is happening just by looking at the numbers on a big spreadsheet. A dashboard provides a succinct, clear picture of your data and can be accompanied by charts or graphs to help people better understand what is going on, but also make decisions based on the data they have. You can make the features simple in terms of interpretation, but also complex in the background. You can add sliders that allow users to assume different scenarios to see how the numbers change, and you can connect the dashboard to live data so that they can identify exceptions daily and see the trends.

2. Robotic process automation (RPA)

RPA is where, rather than doing routine tasks yourself, you can set up a process that runs in the background and does those tasks automatically. For example, you can have a process that takes a set of data you receive every day and combines it with the previous sets of data into a single data set, does some calculations in the background and then sends you an update regularly – tasks you might previously have done yourself manually.

3. Process mining

Process mining has been popular for some years now. If you have a process with several steps (such as your purchase-to-pay process) that is repeated hundreds or thousands of times a month, process mining can visualise the process on a page so that you can see whether the controls you have in place have worked. If you have all your purchases throughout the year on the same page and everything has worked correctly, you might see a straight-line path. However, if something doesn’t go through this path, you will see spaghetti diagrams on your screen identifying that a control has failed. This allows internal auditors to identify inefficiencies and bottlenecks and have assurance that the controls are working efficiently and effectively. Process mining allows you to do all of this and see it in real time.

4. Machine learning/AI

The most topical element is machine learning/AI. The definition of AI has transformed significantly since the launch of ChatGPT and similar models towards the end of 2022. Machine learning/AI is much more than Large Language Models (LLMs) and ChatGPT. Take the example of simple forecasting – if you have enough historical data on your suppliers and unpaid invoices and want to project that into the future, this projection can be a simple form of machine learning. There are many other ways machine learning can be helpful for internal auditors that have nothing to do with ChatGPT.

ChatGPT is a new model of what we can call AI or even AGI (Artificial General Intelligence which is still theoretical) which is a big leap forward when it comes to working with text data. Essentially, the models allow us to get the outputs we were getting before, but with logical reasoning over text. Think about an audit report – if you have all the inputs then an LLM can write an audit report. You would talk to it like it was an intern working for your company – assume that it doesn’t have a lot of background knowledge, so explain what you are looking for it to do - and it can make fairly good judgements. This may have quite a big impact on the Internal Audit profession because a lot of information, such as accounts, is with text.

The models can analyse complex pieces of legislation, identify the key points and summarise them. They can compare and contrast – so if you want to compare your company’s policy to an external policy, external legislation or a regulation piece, ChatGPT can do it. It can also do complex analysis – you can ask it what part of your audit work for the past period of months was related to a particular piece of legislation. If you can explain it clearly enough to ChatGPT, then the likelihood is that ChatGPT can do a fairly good job for you. It’s not about replacing humans – it’s not at the level where you can replace the judgement of a person who has been working in the industry for years. I see it as a helpful consultant – what Microsoft calls a co-pilot – so always check what you’re getting from those models.

Bear in mind that models like ChatGPT are not fact-checking – they are not good at fact-checking unless you connect them to the Internet. They do not memorise the information – they’ve been trained on billions of text pages, but they do not memorise them. Instead, use them for their reasoning capability to help you better understand the text data and help you produce drafts of text outputs that might otherwise take you days, and you’ll have a good first draft.

Conclusion

Much of data analytics is driven by the appetite not just of the business but also the department that you’re working in. Even within the same company and the same culture, there can be completely different mindsets and attitudes towards technology. I’m lucky to work with people who like technology, enjoy being challenged, like to learn something new, and are willing to change. If you are an internal auditor then I encourage you to embrace data – data is a friend and equally, technology is a friend. You may not get the answers you need when you are first experimenting with it but don’t be discouraged. Once you get the hang of it, you will see the benefits. So, my recommendation is that if you haven’t checked out ChatGPT yet, try it out and see what you can do with it.

The entry barriers for data analytics are getting lower and at the same time, the usefulness of the software is increasing. If you have the right data and it isn’t a huge volume, it can take as little as 30 minutes to do a basic visualisation – don’t assume that it is a complex task.

Data analytics doesn’t make any difference in terms of making judgements – you still need to have some knowledge of - and experience working with - data, because there can be many caveats about the data not being the right quality. Added to that, it’s not just about the quality of the data in the system – the people sending you the data need to understand your requirements and what you’re trying to do.

The technology will continue to grow, progress, and become smarter and as it does, there will be many different ways that it will be useful for the profession. Even people who work in the field do not know what will happen in the next 12 months, but I expect to see increased capabilities that will have a transformational impact on many professions, including Internal Audit.

Kiryl Katushkin FCCA - Internal Audit Data and Systems Specialist at Baillie Gifford & ACCA UK Internal Audit Sector Panel member