“Successfully implementing a digital transformation programme is a bit like mountain climbing. It doesn’t matter if you go straight up or a little bit to the right or left. The important thing is that you keep advancing and moving.”
Key steps to success
Based on our experience, there are four key areas that provide early and ongoing positive returns for both internal auditors and management. They essentially involve taking a critical look at internal audit processes and controls.
1. Automate high-volume, standardised manual tasks
This may appear obvious. Nevertheless, many organisations continue to undertake relatively simple, standard tasks manually. Based on “reverse logic”, these tasks have avoided automation because they are easy to do. They include, for example, manually matching fields across databases when reviewing financial and operational data. As the economic climate becomes tougher, automation of such tasks is one of the early wins that internal auditors can achieve with limited investments, such as robotic process automation. The key added benefit is that it frees up highly qualified professionals to undertake more fulfilling tasks that will provide a better return on investment.
2. Leverage and integrate transaction data and data analytics
“Data analytics is nothing new, but it is not fully embraced by the internal audit profession. We need to do more, including leveraging transactional data, taking a more risk-based approach and using data analytics in our planning and execution.”
Let data analytics help drive your internal audit focus towards the higher-risk areas where internal audit has the greatest positive impact. This applies to both the annual audit planning process as well as individual projects. Best practice companies use data analytics to prioritise the areas on which internal audit should focus over the next six to twelve months, as well as the level of review required. For example, based on the transactional analysis undertaken with a number of clients, we have identified some entities where an on-site visit is not warranted. Instead, we’ll undertake a virtual internal audit with more of a focus on design effectiveness of key controls. Information is securely delivered to a central team and any follow-up questions are addressed in telephone or video conference calls. Likewise, in those entities with an especially low risk level, the frequency of internal audits is reduced in comparison with riskier entities.
3. Continuously align internal audit with other lines of defence
Digital transformation impacts the three lines of defence in different ways and makes some tasks potentially redundant. For example, the use of artificial intelligence and blockchain potentially reduces the required level of compliance and internal audit procedures in procurement and supply chain management processes. It is therefore important to ensure that the lines of defence are continuously aligned and your risk coverage is optimised. In addition, duplication and unanticipated “white spots”, where there is no risk coverage, are minimised. This holds true for organisations regardless of their digital maturity. For companies in the early stages of their digital transformation, close coordination between the lines of defence is not only necessary but often yields early opportunities for success transfer. For example, if the business is developing robust data analytics on its operational processes, internal audit can leverage this information in its internal audit processes and procedures.
4. Build relationships to become a trusted advisor
Internal audit is a people business, so building the right relationships is the first step in becoming a trusted business partner. Being a trusted partner calls for investing in relationships with the board, management and auditees. Decision-makers need to know where to get information from, as well as who are their trusted advisors and resources inside and outside the organisation. If your current processes don’t promote relationship building, then first start with interviewing key stakeholders to understand their personal expectations of a “trusted advisor”, where they see internal audit being most valuable for them as well as the organisation, and what their expectations are for interactions with internal audit. Illustrative examples can help in these conversations to make things more tangible. Internal audit can then develop a targeted plan towards becoming a trusted advisor.
Overcoming barriers
In PwC’s annual risk assurance studies, participants repeatedly cite poor data quality and the lack of relevant skills as the two key challenges they face when implementing their digital transformation programmes. While difficult, companies can overcome these challenges by beginning with some incremental changes. These include:
1. Focus on standardising processes, controls and data flow as well as on automation
Good data quality underpins informed management decisions. Some companies have moved key support functions into shared service centres, which has provided significant benefits, enabling companies to increase their data quality by streamlining and standardising processes and strengthening controls. With the threat of economic slowdown, it is especially important to take a critical look at business processes and controls to identify opportunities for high volume standardisation and automation. The use of pilots is particularly helpful in achieving wins and gaining management buy-in for rolling out successful data quality improvement and other digital transformation initiatives.
2. Focus on people, culture and management buy-in
“A company doesn’t have to have internal experts in every nook and cranny of the organisation. There may be some skills that they would rather outsource to experts, such as cybersecurity. Companies need to focus on what’s important to achieve their business objectives and bring in the right experts when and where they are needed.”
While a lack of skills is an important challenge to overcome, successfully addressing the issue requires a structured approach to ensure you are not over or under-investing in raising the internal level of skills required for digital transformation. It’s easy enough to tell people that you want to be digital, but if you have an organisational culture that inhibits creativity and the introduction of innovative ideas, then digitalisation probably isn’t going to work. A shift in mindset is required. Specifically, organisations need to address their current status in terms of culture, skills and digital aspirations. They then need to bring it all together within a digital roadmap that outlines how they will achieve their goals. At the end of the day, the digital strategy and roadmap have to come from top management with buy-in from the board, and then cascaded throughout the organisation.
