The growing amount and accessibility of data can be a significant contributor guiding internal audit toward its True North—or, as sometimes happens, too much data can result in taking internal audit off course when it is not effectively used. Today there are 2.7 zettabytes of data in the digital universe, and by 2020, big data is predicted to be 50 times what it is today.¹ As business operations become more proficient in their use of both structured and unstructured data, analytics are informing decisions across the business in ways never before considered.

For many years, internal audit has focused on using data in limited ways to conduct analytics for fieldwork purposes—commonly known as computer-assisted audit techniques. With advancements in technology, ease of use, and affordability of tools, now more than ever internal audit can focus on building a keen sense of direction to leverage data in a way that provides greater business insights, increases efficiency, enhances monitoring activities, and allows the company to respond better to risks. Leveraging data is not a destination of its own, but rather a mindset shift to integrate data into the audit life cycle—from risk assessment to planning, fieldwork, execution, monitoring, and reporting.

Our survey and interviews revealed that most, if not all, internal audit functions are thinking about how they can better leverage data to be not only more efficient but also far more effective. Most are experimenting with expanding its use, particularly in such areas as fraud management, compliance monitoring, and risk analytics (Figure 1). However, a critical difference between where internal audit functions are today and their True North lies in how data is being used. While 82% of chief audit executives (CAEs) report they leverage data analytics in some specific audits, just 48% use analytics for scoping decisions, and only 43% leverage data to inform their risk assessment. Thus, many still report they have a substantial journey ahead.

Internal audit functions that are evolving in pace with the business are more advanced in their use of data, including wider application across the audit life cycle. For example, risk identification has traditionally been done through a combination of executive meetings and the use of limited financial data. Internal audit functions that are headed toward True North are using data to identify where risks reside in the organization in order to determine where they should focus their efforts. They are also leveraging data not only to focus on where and what could be audited but also to decide whether auditing is needed at all. Ultimately, success with data is predicated on connecting data to insights about the business and the risks it is facing.

CAEs report that obtaining data skills is a top challenge. While 65% of CAEs report they have some data skills on their team, either in-house or through third parties, our interviews revealed a lack of the combined business acumen and data skills. Internal audit functions with sufficient size and scale are reporting the ability to invest in a combination of in-house and third-party resources, while many are turning completely to third parties to gain more immediate access to business-minded data skill sets.

Enhancements in tools have made it easier and more intuitive for business users to access data and gain comfort with how data can be leveraged. By providing a better view of risks, data visualization tools are enabling internal audit functions to absorb information in new and more constructive ways so they can identify and respond to emerging trends faster.

For those functions that are not far along the maturity curve of embedding data analytics into their audit life cycle, we have found that there is a need to work through various roadblocks, create quick wins, and gain momentum. In order to do this, many internal audit functions are still starting with pilot data programs.² These pilots serve as proof of concepts for both stakeholders and those in the internal audit function. Pilots give practitioners the opportunity to work with data, get comfortable with it, and increase their creativity in thinking about how to use it. Sharing early wins with stakeholders will jump-start the momentum needed to drive more creative use of data.