What boards should know about data-driven audits

Boards need to reframe their organizations’ risk management approach for long-term resilience amid an uncertain risk landscape.

In brief

• Data-driven audits allow auditors to gain greater insights from a company’s financial and nonfinancial information.
• Data-driven audits can increase stakeholders’ trust in the audit process.
• The board should work with the management and external auditor to accelerate the move toward data-driven audits. 

Companies worldwide had started leveraging technology in response to disruption before the COVID-19 pandemic. The crisis has now shifted those digital transformation plans into high gear, highlighting deep-seated implications for how audit professionals do their work. Auditors are directly impacted by the evolving business models, digitalization of companies’ operations and the ability to gather and analyze vast quantities of detailed digital information.  

Data-driven audits can help improve connectivity and insights and allow auditors to focus more on areas that require professional judgment. The board and management can therefore expect such audits to be more effective as well as benefit from deeper risk insights and fresh perspectives. 

Transformation of audits

Companies are adopting data-enabled technologies based on machine-learning algorithms and supported by cloud computing as they pursue digital transformation. The proliferation of corporate data creates new data flows and sources of information that are fed into the audit process, changing how audits are conducted. Instead of restricted samples, full data sets can now be audited, providing more comprehensive audit evidence. Auditors can also understand a company’s financial and nonfinancial information more deeply, allowing them to better identify material misstatement risks, including fraud risks.

Large-scale data analysis allows audit teams to check the accuracy of financial statements much more quickly and in far greater detail. The ability to use data analytics and interpret the results is therefore fast becoming a core requisite skill for all auditors, rather than the domain of specialists. 

As businesses digitalize, they are transforming to resemble increasingly fluid ecosystems in which value chains are interconnected, with key elements derived from multiple sources. Corporate distribution channels are also extending and diversifying across B2B, B2C and B2B2C. Embedding trust across these ecosystems will be key. 

Increasing trust in audits

Data-driven processes can potentially increase trust further in the audit process. For example, they can provide assurance over the security and privacy of Internet of Things data captured and processed by an audited entity. Using data-driven audits, auditors can demonstrate how they reached their conclusions, providing far greater transparency for stakeholders. Importantly, auditors need to clearly document which data they accessed, checks they made, processes they followed and technology they used. 

While technology can improve the speed and accuracy of the audit, overreliance on it would be a dangerous mistake. The professional judgment of an experienced auditor cannot be replaced. Auditors will still need to confirm internal control systems, assess reasonableness of independent valuations and apply professional skepticism. Processes that are robust enough to mitigate the risk of technology failure must be put in place. 

The scope of data-driven audits — whether external or internal — represents a significant progression in providing boards with enhanced assurance in discharging their responsibilities. This, in turn, presents a real opportunity for boards to communicate the added assurance to stakeholders and strengthen trust. 

Will data-driven audits become the mainstay?

While data-driven audits can help businesses become more resilient, companies vary widely in their preparedness to conduct such audits. A key factor is whether they have an integrated technology stack that allows them to extract data and analyze it in a consistent and rapid manner. Some organizations may also restrict data access and usage beyond their own control environment, while in some jurisdictions, local data privacy laws impose their own set of restrictions.

As technology continues to transform business processes, data-driven audits will eventually become the mainstay. Boards have an important role of encouraging companies to explore the adoption of more technologies to augment business processes, including financial reporting. Ideally, the board’s endorsement of the management’s willingness to share entire data sets of financial information with the auditors will help accelerate the move toward data-driven audits. Boards should also challenge their external auditors to fully adopt data-driven audits. The objective of doing so is to increase stakeholders’ confidence in audits and provide trustworthy financial information for the board and management to address current issues and prepare for the future. 

Boards should consider the following questions:

• What is the current extent of a data-driven audit in the organization and is there scope for more?
• How can the management facilitate the adoption of a data-driven audit?
• Has the board fully exploited the insights that can be gained from a data-driven audit?
• What risk areas cannot be covered by data-driven audits?
• What longer-term strategic objective would the board like to achieve with the use of data-driven audits?