Smart Audit: the digital transformation of audit
To what extend are audit methodologies, audit standards and audit practices keeping up with the technical possibilities offered in this digital age? Do audit rules facilitate or complicate innovative developments to enable more added-value to be delivered by internal and external auditors? Professor Miklos A. Vasarhelyi, Assistant Professor Soohyun Cho, Arion Cheong and Chanyan (Abigail) Zhang, are all working at the Department of Accounting and Information Systems at Rutgers University and have done a lot of research in this area, particularly in the framework of the Continuous Audit and Reporting Laboratory they have created at Rutgers University’s business school. Below some key insights in their analysis of some major developments that, in their view, should herald considerable changes for the audit profession.
By Professor Miklos A. Vasarhelyi, Assistant Professor Soohyun Cho and Arion Cheong, Chanyuan (Abigail) Zhang, Rutgers University
Change in audit
The world is changing at digital speed, but the accounting profession does not seem to notice it with arcane measures and old-fashioned assurance. The forthcoming data ecosystem (Cho, Vasarhelyi, and Zhang, 2019) will consist of a large chain of interlinked data sources and many constantly acting intelligent agents (1) (Vasarhelyi and Hoitash, 2005) performing assurance tasks and drawing exceptions in some form of continuous audit (Vasarhelyi and Halper, 1991). It is reasonable to assume that business measurement (reporting) will evolve to a much wider set of information including partially what is called today’s non-GAAP (GAAP standing for Generally Accepted Accounting Principles) measures. Many of these measures will have to be assured on a close to a continuous basis. Meanwhile, a set of evolutionary steps is needed which are described below.
Smart audit and big data
For more than 500 years, the crux of accounting had been represented as the double-entry bookkeeping system, formalized by Fra Luca Pacioli in 1492. How about for auditors who were born after the introduction of an Enterprise Resource Planning (ERP) system or the Internet? The reasonable answer will be data analytics. The age of the smart audit is arriving where auditors utilize big data and are assisted by advanced audit analytics tools. In fact, clients’ data are getting larger, much larger than the auditor to handle. The auditor should know how to examine the data to find the answer to meet the audit objectives. In accordance, more tools, namely audit analytics, are introduced to the auditors to deal with big data. Further, automation tools such as Robotic Process Automation (RPA) are making the audit hands free. The tools are not only making the auditors smarter but also making them focus on more productive tasks.
Notably, the big data and the data ecosystem had brought up an expansion of assurance products. As more information is available, more information needs to be validated for decision-making. In the past practitioners, had agreed-upon metrics (e.g., GAAP measures) or suitable criteria that have been used to examine the subject matter. In the modern era, auditors have to derive appropriate measures to support their opinion while that is not provided by GAAP (i.e., non-GAAP measure).
Obstacles for transition
Although the digital transformation in audit is promising, obstacles exist that can slow down this process. First, public accounting firms serve multiple clients, and most likely, each client has data of different formats. The heterogeneity in clients’ data makes it challenging to use audit automation or analytics tools. Therefore, to achieve audit automation, standardization is needed to homogenize clients’ data (Moffitt, Rozario, and Vasarhelyi, 2018; Cohen, Rozario, and Zhang, 2019).
Furthermore, many auditors have not yet gained the skills needed in a more automated audit workflow and are not ready for the digital transformation. Examples of such new skills are data analytics, programming, and acquaintances with emerging technologies (Zhang, Dai, and Vasarhelyi, 2018).
Finally, many are concerned about the ‘black box’ issue of some machine learning methods, which can make predictions of future events based on historical data and can identify patterns and extract features from big data. The difficulty of explaining how an algorithm reaches its decision makes the machine-generated conclusion less appropriate to be accepted as an audit evidenced by today’s audit regulation.
Future steps: audit data standards
To leverage smart audit practices to improve audit assurance and audit quality, it is critical for policymakers to develop appropriate audit standards and relevant analytic technologies for big data by integrating and clarifying considerations of practical needs and business trends (Coffey, 2018). For quality audits, new auditing data standards must be developed in terms of data management and relevant technologies (Tang and Karim, 2017). The standards should encourage companies to manage internal data in effective and consistent ways and to validate exogenous data continuously for sufficient evidential matter and assurance (EY, 2015a).
In addition to data management, new standards should be developed to examine and regulate the adoption of new technologies for analytic purposes (such as blockchain and artificial intelligence) in audit procedures. More innovative auditing standards for big data and analytics can be a driving force for progress in smart audit practices and enhanced audit procedures.
Future steps: awareness of the audit firms
Audit firms and auditors currently have a wealth of assignments that can move them toward adopting smart audit practices. However, despite their professed awareness of the importance of smart audit practices, 70% of audit firms are only in the initial or elementary stages of applying big data and analytics to their auditing procedures (Deloitte, 2018).
Moving forward, audit firms must develop strategic plans for data management and analytics and exert greater efforts to implement such methodologies in their organizations. By providing appropriate training and incentives, audit firms can encourage auditors to incorporate big data and analytics into their fieldwork in order to generate better insights. In addition to organizational efforts, audit professionals should seek to nurture positive attitudes toward the ways that big data and analytics can enhance the auditing process and should strive to acquire the appropriate skillsets and competencies (EY, 2015b).
New Roles for auditors
Changes with automation
Digital transformation or the automation of audit is changing the roles of auditors. Although auditors today are equipped with computerized tools (e.g. Microsoft Excel, CaseWare IDEA, Galvanize, etc.) to document audit working papers and conduct audit procedures, manual work is still prevalent in the form of repetitive keystrokes, client data cleansing, data migration, and rule-based data analysis (Moffitt, Rozario, and Vasarhelyi, 2018; Cohen, Rozario, and Zhang, 2019). With audit automation tools built, based on audit data standards (ADS ), such manual-intensive work can be significantly reduced. This not only can save a notable amount of time but also can ensure fewer errors generated in the process.
Indeed, machines are intrinsically better than humans at performing tedious and rule-based tasks. When auditors do not need to spend most of their time performing repetitive and basic tasks, they can focus their effort on more challenging and critical tasks, especially those related to the assessment of the risk of material misstatement. This ‘man-machine cooperation’ is the future form of audit (Zhang, 2019).
Changes with data analytics
The usage of data analytics has been present for many decades but the evolution of digitization, the increasing capabilities of computation, and the emergence of exogenous data (Brown-Liburd and Vasarhelyi, 2015) are totally changing the framework for assurance from a passive after-the-fact review to an active when-it-happens process that can not only benefit audit processes but also increase substantially the accuracy of transactions. Rigid controls will convert to instance-aware intelligence agents, transactions with faults will either be autocorrected or blocked from flowing downstream. The instant measurement will give aggregated rating system status. Most of all automation agents will perform boring tasks automatically but dimensionally more often than current capabilities.
Research in Smart Audit
Continuous audit
Over 35 years ago AT&T internal audit through its Bell Laboratories research center endeavored into the monitoring and assurance of its larger biller that was core to its ‘take back’ (direct contact with customers) strategy (Vasarhelyi & Halper, 1991). This effort, that monitored in the pulse of the process — many stages in a very large and cumbersome customer management system, allowed for exponentially improved assurance and process improvement. However, concepts such as materiality and the separation between control and data analytics became blurred.
Likely, just like evolving digital services, new conceptualizations and experimentation (2) are necessary by the standard setters. Considering the current lag in accounting and assurance functionalities, this must be done urgently as the description of the ensuing section will show the dramatic ensuing changes in technology.
Robotic/Intelligent Process Automation
Broadly speaking, Robotic Process Automation (RPA) refers to software that can operate on other software instances to automate tasks that are deterministic and have structured data (Moffitt et al., 2018; Zhang, 2019). Some research has shown the potential of RPA in audit tasks with the premise of ADS (Cohen et al., 2019; Huang and Vasarhelyi, 2019; Rozario, 2019). However, open questions still remain, such as evaluating the RPA tools and RPA implementation stages.
Different from RPA, Intelligent Process Automation (IPA) combines artificial intelligence modules with RPA to deal with inference-based processes (Zhang, 2019). Though IPA has been used in some businesses like banking and insurance, it is yet to be explored in accounting and auditing. It is of interest to examine how RPA/IPA can facilitate continuous audits since audit automation is both the necessary and sufficient condition of continuous audit. Moreover, the cost and benefit analysis of RPA/IPA adoption and the impact of RPA/IPA on auditors’ allocation of time can be discussed as well (Zhang, 2019).
Machine learning and AI
Machine learning algorithms can make an inference or perform the task ‘without being explicitly programmed.’ (3) Recently, machine learning algorithms became more cost-efficient and effective due to advanced computing capability. The strength of machine learning is the ability to learn the factors (or patterns) that are not easily observable to humans. For auditors, the major concern is whether these disruptive technologies will replace ‘humans.’ The technology cannot yet fully replace human auditors, however, it can perform specific and narrowed tasks more effective than humans.
The major challenge for machine learning algorithms is their limited capability to make professional judgments. Auditors make a number of professional judgments during engagements. Every major judgment should be documented and cannot be a ‘black box.’ Nevertheless, such technology can provide exploratory insights to the auditors even it yet cannot be recognized as confirmatory evidence. Thus, machine learning and AI can become a supportive tool for the auditors to make a professional judgment.
Predictive audit analytics
In the past, most of the audit analytics were descriptive while limited to several primitive predictive methodologies (e.g., linear regression) (Appelbaum et al., 2017). Due to the development of machine learning algorithms and AI, auditors now have access to better predictive audit analytics. Instead of focusing on ‘what happened,’ the auditor can now infer ‘what could and will happen.’ Further, based on the analysis given by descriptive and predictive audit analytics, the auditor can be suggested: ‘what should happen’ (IBM, 2013).
Smart Audit: the digital transformation of audit
Change in the data ecosystem is making analytics even smarter. Exogenous data such as customer reviews in the social network can be captured on a real-time basis. Such exogenous data can be analyzed as they happen which would provide more timely and relevant information to the auditor (Appelbaum et al., 2017). Therefore, these analytic tools can reduce uncertainty caused by audit risk (Cao et al., 2015).
Blockchain, Smart Contract, and Cryptocurrencies
Blockchain, or Distributed Ledger Technology (DLT) in general, is transforming businesses like banking, stock trading, and insurance (Dai and Vasarhelyi, 2017). Blockchain’s functions of data integrity protection, instant information sharing, and programmable and automatic controls of processes via smart contracts could facilitate the development of a new accounting ecosystem and enable a certain level of automatic assurance (Dai and Vasarhelyi, 2017; Rozario and Thomas, 2019; Rozario and Vasarhelyi, 2018). As businesses are participating increasingly in transactions involving cryptocurrencies, ‘it is becoming common for financial statements to show material cryptocurrency balances and to reflect the results of cryptocurrency transactions’ (CPA Canada, 2018).
Exogenous variables
Exogenous data play a critical role in smart audit practices by providing complimentary audit evidence that helps internal and external auditors fulfill their investigatory requirements. Exogenous data are usually defined as data from third-party sources rather than internal accounting records of corporate entities (i.e., traditional audit evidence) (Brown-Liburd et al. 2019).
In the current era of big data, auditors can collect exogenous data from various sources such as social media and the Internet of Things. In addition, sophisticated data analysis techniques using automation and computerization enable auditors to process data in increasingly effective and efficient ways (Yoon et al. 2015). Hence, auditors with well-analyzed exogenous data have access to more suitable and appropriate audit evidence and can potentially reduce the likelihood of material misstatements and auditing lapses (Bell et al. 2005).
Overall a widening gap between technology and accountancy and assurance
As technology evolves, the accounting profession has been lagging, with a set of anachronistic rules of disclosure and assurance. Both in the government and the private sector, the lag between technological practice and accounting and assurance have further and further widened. More discussion — and action on the nature of this gap, and the characteristics of technologies that are being used and also can be used in the measurement and assurance of business, needs to be encouraged.
Box 1— References
Appelbaum, D., Kogan, A., Vasarhelyi, M., & Yan, Z. (2017). Impact of business analytics and enterprise systems on managerial accounting. International Journal of Accounting Information Systems, 25, 29–44.
Bell, T. B., M. E. Peecher, and I. Solomon. 2005. The 21st Century Public Company Audit: Conceptual Elements of KPMG’s Global Audit Methodology. New York, NY: KPMG International.
Brown-Liburd, H., & Vasarhelyi, M. A. (2015). Big Data and Audit Evidence. Journal of Emerging Technologies in Accounting, 12(1), 1–16.
Brown-Liburd, H., Cheong, A., Vasarhelyi, M. A., & Wang, X. (2019). Measuring with exogenous data (MED), and government economic monitoring (GEM), 16(1), 1–19.
Cao, M., Chychyla, R., & Stewart, T. (2015). Big Data analytics in financial statement audits. Accounting Horizons, 29(2), 423–429.
Coffey, S. (2018). The future of audit: Looking ahead in a time of rapid change. Avaiable at: https://www.accountingtoday.com/opinion/the-future-of-audit-looking-ahead-in-a-time-of-rapid-change
Cohen, M., Rozario, A., and Zhang, C. (A.) (2019). Exploring the Use of Robotic Process Automation (RPA) in Substantive Audit Procedures. The CPA Journal, 89(7), 49–53.
CPA Canada. (2018). Audit Considerations Related to Cryptocurrency Assets and Transactions. Available at:https://www.cpacanada.ca/en/business-and-accounting-resources/audit-and-assurance/canadian-auditing-standards-cas/publications/cryptocurrency-audit-considerations
Cho, S., Vasarhelyi, M. A., and Zhang, C. (2019). The Forthcoming Data Ecosystem for Business Measurement and Assurance. Journal of Emerging Technologies in Accounting. Forthcoming.
Dai, J., & Vasarhelyi, M. A. (2017). Toward blockchain-based accounting and assurance. Journal of Information Systems, 31(3), 5–21.
Deloitte. (2018). For internal audit, big data represents a big opportunity. Available at: https://deloitte.wsj.com/cio/2018/02/06/for-internal-audit-big-data-represents-a-big-opportunity/
EY. (2015). How big data and analytics are transforming the audit. Available at: https://www.ey.com/en_gl/assurance/how-big-data-and-analytics-are-transforming-the-audit
EY. (2015). Big data and analytics in the audit process: mitigating risk and unlocking value. Available at: https://www.ey.com/Publication/%20vwLUAssets/ey-big-data-and-analytics-in-the-audit-process/$FILE/ey-big-data-and-analytics-in-the-audit-process.pdf
Huang, F., & Vasarhelyi, M. A. (2019). Applying robotic process automation (RPA) in auditing: A framework. International Journal of Accounting Information Systems, 100433.
IBM, 2013. Descriptive, predictive, prescriptive: transforming asset and facilities management with analytics. In: Thought Leadership White Paper, (October 2013).
Martinov-Bennie and Vasarhelyi (2018), An experimentation program for auditing standards, supported proposal presented to CPA Australia, 2018.
Moffitt, K. C., Rozario, A. M., & Vasarhelyi, M. A. (2018). Robotic process automation for auditing. Journal of Emerging Technologies in Accounting, 15(1), 1–10.
Rozario, A. M., & Thomas, C. (2019). Reengineering the audit with blockchain and smart contracts. Journal of Emerging Technologies in Accounting, 16(1), 21–35.
Rozario, A. M., & Vasarhelyi, M. A. (2018). Auditing with Smart Contracts. International Journal of Digital Accounting Research, 18.
Rozario, A. M. (2019). Three essays on audit innovation: using social media information and disruptive technologies to enhance audit quality (Doctoral dissertation, Rutgers University-Graduate School-Newark).
Tang, J., Karim, K. (2017). Big data in business analytics: Implications for the audit profession. Available at: https://www.cpajournal.com/2017/06/26/big-data-business-analytics-implications-audit-profession/
Vasarhelyi, M. A., & Halper, F. B. (1991). The continuous audit of online systems. Auditing: A Journal of Practice & Theory, 10(1), 110–125.
Vasarhelyi, M., & Hoitash, R. (2005). Intelligent software agents in accounting: An evolving scenario. The Evolving Paradigms of Artificial Intelligence and Expert Systems: An International View, 6.
Yoon, K., Hoogduin, L., Zhang, L. (2015). Big data as complementary audit evidence. Accounting Horizaons. 29(2). 431–438.
Zhang, C. A., Dai, J., & Vasarhelyi, M. A. (2018). The Impact of DisruptiveTechnologies on Accounting and Auditing Education: How Should the Profession Adapt?. The CPA Journal, 88(9), 20–26.
Zhang, C. (2019). Intelligent Process Automation in Audit. Journal of Emerging Technologies in Accounting. Forthcoming.
(1) Software apps that perform some type of function activated either by conditions (i.e. Daemons) or by time clocks (i.e. Krons).
(2) Martinov-Bennie and Vasarhelyi (2018) project proposal to CPA Australia.
(3) The definition of machine learning is given by Andrew Ng. For more details, see at https://www.coursera.org/learn/machine-learning
This article was first published on the 1/2020 issue of the ECA Journal. The contents of the interviews and the articles are the sole responsibility of the interviewees and authors and do not necessarily reflect the opinion of the European Court of Auditors.
