Internal Audit: Top Software and Tools for Harnessing Data
The following is adapted from The Data-Confident Internal Auditor by Yusuf Moolla and Conor McGarrity.
Transitioning to more data-enabled audits means we will need to think about software packages. It is by no means the most important aspect of our transition, but they are necessary. Without the right software packages, you can waste time and miss opportunities.
The technology landscape shifts quickly. You don’t need to stay on the bleeding edge, but you don’t want dinosaur tools either. A happy medium includes technology that is well established and kept up-to-date (at least annual updates).
There is a general trend today away from scripting towards the use of low-code software that does some of the heavy lifting for you. Embrace the newer software; it makes sense to use. Software that has a graphic user interface, workflow style (i.e., drag-and-drop graphic editors) is easier to use. It is also easier to read, debug and review than going through thousands of lines of code.
Don’t avoid coding. A general understanding of raw code (and a bit of experience with coding) is useful. But you don’t have to be a fully-fledged coder. You can learn a bit of Python, R, SQL, JavaScript, etc. But if you’re writing from scratch each time, you could better use that time on more meaningful, higher-order work.
What Software Should You Use?
One of the most comprehensive, well-laid-out listings of software that we have come across is the “Data and AI Landscape” compiled by Matt Turck.
There is no shortage of packages, and most were not created purely for audit purposes. They are used so widely nowadays that learning how to use them becomes a transferable skill.
We won’t outline all of them but will instead focus on the specific software packages we use. These are easy to find and to access. They are either open source or commonly used.
Other software that you are familiar with (or already have access to) can also work. But we recommend staying away from traditional audit “analytics” software. Let’s explain what this is and why you should avoid it if possible.
Why Avoid Audit-specific “Analytics” Packages?
We won’t name them, but you probably know what they are. You’ve heard their names thrown around or even pushed in your face at conferences, by large professional services firms, etc. They typically have three-letter or four-letter acronyms. You will notice that they are not included in that Data and AI Landscape referenced earlier.
Are They Useful?
They have a purpose, especially for external auditors, particularly financial statement auditors. They were useful for internal audit a decade or so ago. They still have some functionality (e.g., sampling, quick duplicate check) that is useful today.
So, What’s the Problem?
They have not quite kept up with the changing needs of internal auditors. Their marketing effort appears to outweigh the strategy and product-development efforts. They work for external audits, and perhaps continuous-controls monitoring.
They don’t address our internal audit needs. If you move out of audit, you won’t find many others using these packages, so the technical skills are not transferable. Some of these packages talk about AI, but this capability is limited, if it even exists at all.
Importantly, fundamental flaws have arisen in some core functionality. For example, one of them couldn’t do joins properly; this appears to have been fixed, but it took a long time (years) to identify that there was a problem. Joining data sets is one of the most important concepts in using data for audit. In fact, joining is something that is extremely important for most data projects, even those outside of the audit world.
There are many options available that are better suited to progressive internal auditors.
Our Recommendations
Microsoft Excel
- About: Spreadsheet software that has grown out of the traditional size limitations that used to prevent it from being viable to use for large data sets.
- Use for: Basic data work in a spreadsheet
- Where to find it: Microsoft, if you don’t already have a copy
- Alternatives: Sheets (Google), Numbers (Apple), OpenOffice (Apache), LibreOffice (The Document Foundation)
KNIME
- About: An open-source solution for data-driven innovation, designed for discovering the potential hidden in data, mining for fresh insights, or predicting new futures.
- Use for: More than just a spreadsheet style tool, with machine learning options and other functionality
- Where to find it: The desktop version — the “KNIME Analytics Platform” — is open-source and free. There is a paid “KNIME Server” edition for collaboration, etc.
- Alternatives (note that these may not be open source and may be expensive): Rapid Miner, SAS, TIBCO, Alteryx, Dataiku
Microsoft Power BI
- About: An interactive data visualization application
- Use for: visualization/dashboards
- Where to find it: Microsoft Desktop version is free today. There are other paid versions for collaboration, etc.
- Alternatives: Tableau, Qlik, Plotly, Datawrapper.de, Flourish.studio
These options are sufficient for most of your needs. They are equivalent to, or better than, other flawed and heavily marketed packages.
Once thought to be strictly the realm of data specialists, as software develops, it gets easier for us auditors to harness and analyze data ourselves.
For more advice on analyzing data for audits, you can find The Data-Confident Internal Auditor on Amazon.
Yusuf Moolla has over twenty years of experience in data, assurance, and plaguing his colleagues with his dry sense of “humor.” A Certified Internal Auditor, Yusuf has worked for both Deloitte and KPMG, leading audits and data projects around the world.
Conor McGarrity’s background includes KPMG as well as the public sector. Passionate about leveraging data for better audit outcomes and redefining the limits of what’s possible, he also enjoys displaying a unique blend of “skill” and “finesse” on the soccer field.
Together, they founded Risk Insights, a specialist advisory firm that focuses on using data for internal audit and performance audit. Connect with them online at data-confident.com.
