CorporateGovernor newsletter [download PDF]
To become a critical tool for the internal audit function, data analytics must align with organizational goals. This means an internal audit executive needs a grasp of an organization’s long-term business strategy, and to be open to reviewing past internal audit practices and how well they work (or don’t) within a highly regulated external environment. Ideally, internal audit can use data analytics to help an organization improve its procedures and controls. This requires a well-thought-out plan that incorporates the right people, processes and technology. It also means shifting the mentality of the audit team from routine compliance testing to developing automated ways to increase coverage, as well as drive efficiency and business insights.
A bank that could
KeyBank, a retail and commercial bank with more than 13,500 employees, embraced the concept of change in how it handles internal audit as it moved to implement a centralized data analytics function in 2013. As a first step, the bank tapped Elvis Kanlic, senior vice president and senior audit manager, to form and lead a data analytics team to oversee the internal audit function's implementation.
“I could see where data analytics could be applied to help all facets of audit, annual planning, risk intelligence and board-level reporting processes,” Kanlic said. He recognized that hiring the right talent was vital to success and to support growth and sustainability.
Although there is no specific formula for what makes a good data analyst, he said, such a role generally incorporates sound technical skills, business and accounting acumen (such as understanding processes and how they are affected by risk), and communication skills.
The KeyBank internal audit data analytics team represents a mix of people with audit backgrounds and technical skills. It has grown to four dedicated resources, with the probable addition of more dedicated personnel in the near term.
Training and sharing
“To find the right talent, we have a candidate description we use for various levels,” Kanlic said. “KeyBank has also designed a training curriculum and user group forum to develop analytics skills across the enterprise, as well as internal audit departmental training for members on its core and extended teams to promote synergy and adoption of data analytics throughout the department.
Ongoing training in technical components is urged. “We encourage people to go to seminars and be involved in user groups that use similar tools and technologies,” Kanlic said. The data analytics team is part of a roundtable group within a larger group of other corporate regional bankers that meets regularly to share ideas, strategies and approaches. “We have engagement with group members to understand the strategies and techniques they’ve used in data analytics; it’s a knowledge exchange within their industry peer group.”
Communication is key among team members and throughout the organization, from senior leadership and managers to the full line of business owners. “Communication is really important for us,” Kanlic said. “To build a perfect analyst, you have to have a technology or technical background, but also an expansive set of communication skills, to meet with various teams and engage with them to understand, consult and advise, to know what we can do, what’s feasible and where we can provide our greatest potential.” This helps to identify issues and find a root cause.
Integration into the organization is a main factor. Kanlic said: “We have a robust process that we do as part of annual internal audit planning to align our analytic resources to specific areas. As we look to expand, our organization model will branch out to have a dedicated analyst within each division, whether compliance or credit or operations and technology — they’re developing integrated analytics throughout the year to support that division. They [internal audit data analytics team members] are really shelved in a specific area to help build an analytics program for that area.”
The team outlined significant factors to ensure the successful integration of data analytics:
- A strategy to work within the organization’s capabilities to define realistic and attainable milestones that provide enough time for development
- A sound data analytics plan set up as a multiyear program that is iterative, while also broad enough to identify or enhance prior deployments
- Clear expectations and accountability for achievements communicated to stakeholders, including senior leadership
- Metrics to track progress, resulting in understanding areas of strength and areas that need improvement
The bank found the move to use data analytics in internal audit provided greater audit coverage and drove efficiencies throughout its service line. It has learned that mined data is invaluable in elevating internal audit performance and creating value for the entire organization.
Data analytics has helped tremendously in setting priorities in different review areas. Kanlic said: “We have a good measure to say this area is doing well or not doing well. We need analytics to help quantify not just controls, but trends in an area. Are we seeing factors outside that line of business? Is there a lot of turnover, or are there losses or consumer complaints? All that can be quantified through data. It supports us and provides substantiation so that we feel comfortable saying it’s going in a positive direction, and we can reduce testing frequency. Conversely, we can see where major concerns are and where we need increased coverage on a more proactive basis.”
The data analytics initiative established a solid foundation on which to build as the team progresses in developing and enhancing automated systems, with the goal of using continuous analytics to assess the performance of key controls within internal audit.
“When you look at what we touch on with analytics overall, from all three delivery streams (ad hoc, integrated and continuous) we are getting closer to integrating analytics with all our main risk categories,” Kanlic said. “While it’s unrealistic to cover every area, the aim is to eventually get to a point that we have defined, reusable automated solutions for areas that pose the highest levels of risk.”
Kanlic believes data analytics in internal audit represents the future. “I think based on the data captured from peer banks and how much is churned through internal audit departments, and based on looking at survey results [of other banks], data analytics has definitely increased substantially.”
Internal audit generally will continue to undergo a significant evolution as technology advances, Kanlic believes. “Data analytics is already embraced throughout our departments — the whole concept of enterprise data,” Kanlic said. “In this organization, we’re striving to achieve by building a sound, governed enterprise, something that supports all lines of businesses and lines of defense.” By making data analytics investments now, internal audit departments can stand ready for the challenges ahead.