Technology x Audit - And they lived happily ever after?

1.1 The dawn of digital

If one were to do a survey across corporate boardrooms for the most commonly discussed agendas in the current era – the two words “digital transformation” are most likely to spring out with no surprise.

The digital age has fully dawned upon us and there’s a wild rush everywhere for organizations of all sizes and shapes to put on it’s digital Avatar. Why so? The answer is simple – new emerging technologies like Artificial Intelligence, Robotics Process Automation, Big data Analytics, In-memory computing, Blockchain and several others have led to the creation of a smart new ecosystem which promises faster, intuitive and automated operations at a reduced cost and added competitive advantage. A recent research report by Grant Thornton reveals that in 2019, CFOs have significantly increased their technology investments. 87% of all respondents agreed that technology is impacting the way their finance function operates and they believe that 40% of all finance activities can be fully automated[1]

Audit as a function by its very nature needs to be malleable and adaptive enough to accommodate the underlying changes in the way Finance operates within organizations. To draw a simple analogy, if a car mechanic had to diagnose an electric car, he would need to not only use different tools than what he usually uses to work with traditional fuel-based cars; but he will also need different skill-sets and an understanding of how the e-car works. The transformation which is happening in the audit function is very similar, and it’s a transformation at two levels:

1.    Auditors need to know how to audit in the new digital environment. Take for instance a scenario where the majority of the bookkeeping may be done by bots, with an enterprise blockchain architecture being the tool used for bookkeeping, etc. Auditors will soon find them in a scenario where organizations are working with a combination of digital technologies.

2.    Auditors and audit firms need to see how they can transform their audit procedures and methodologies by incorporating tools and technologies like advanced analytics, , RPA, AI, etc.

The purpose of this article is to explore this changing landscape and elaborate on what skills do auditors need to cope up and make the most of this Digital Era.

1.2 The changing demands from the auditors

With the advent of the digital era and the new technologies, also comes the onset of higher expectations from auditors by various stakeholders. The following tries to capture the top themes across this changing landscape and what does that translate into in terms of greater expectations from auditors:

1.    The volume and quality of available data has increased significantly demanding new audit methods: It is estimated that the total amount of data being generated today almost doubles every year. Because of greater efficiency in big data technologies, it has become easier to store and retrieve vast amounts of information associated with every single financial transaction. With the increase in the volume of data, auditors are now expected to use big data analytics tools to come out with deeper insights. When the amount of data is huge, it becomes easier to also mask frauds and hide fraudulent / malicious transactions in a sea of data. Resultantly, the traditional sampling methods might not be sufficient to pick out the needle from the haystack. Auditors, in such a scenario, will need to work with advanced analytics tools to work with the entire data-set of all transactions to build fraud identification models.

In a recent survey conducted with CEOs and CFOs by Forbes, “nearly 80% of respondents believe that in their day to day work auditors should use bigger samples, and 78% believe auditors should use more sophisticated technologies for data gathering and analysis. Almost half (47%) say auditors should perform a deeper analysis in areas they already cover.”[2] Sampling based audit procedures may soon be history or at best be relevant for only small exposure / low risk items.

2.    Changing business models and adoption of “The Digital Enterprise” requires the auditors to change their approach towards evidence management, retention and analysis: In an environment where bots and humans work together in day to day transaction processing, the inquiry and data collection for audit cannot be limited to questioning humans anymore. Auditors need to emphasize on the need to generate and retain sufficient audit trail in the functioning of the advanced technologies. Most organizations are still in the early adoption phase of technologies like RPA, Blockchain and AI – and as goes with any new technology implementation, it takes time to build in the relevant controls and maintain detailed logs for audit trail.

Auditors not only need to be able to provide organizations with the right guidance and requirements to maintain sufficient logs and audit trails, but also need to be able to devise mechanisms to be able to work with large pools of bot logs and extract relevant information from them so as to be able to formulate an opinion on the same. It is entirely possible that we may soon see a pool of audit firms who specialize in creating audit procedures to work with audit of systems using specific forms of RPA tools or AI engines.

3.    Audit needs to be much more agile, adaptive and concurrent to business processes: Imagine a rapidly transforming business unit which is making significant changes in its underlying technology, the geographies of operation, the types of good and services they’re dealing in, continuously added digital products and services almost on a biweekly / monthly basis. Would a year long planning cycle for such an audit hold good? The Digital Enterprise is very agile and audit needs to turnaround its findings and observations much quicker to keep pace with the digital enterprise. Most internal audit engagements for large organizations undergoing digital transformation are going to move into a continuous audit mechanism. The audit of the future will be concurrent to business processes with very limited lag time between conducting the audit, reporting findings and taking actions on findings. This demands increased integration between business and audit teams and also requires a significant mindset shift where audit needs to maintain its independence and absoluteness while working very closely with business on a real-time basis.

2.1 Which technologies are going to impact audit and how

Industry 4.0 and the influx of the digital age has resulted in the onset of so many new digital technologies. However, there always is an adoption curve for each of these and not all technologies are completely adopted yet. Here’s a quick 101 on the key digital technologies and how can they impact the audit process:

1.    RPA or Robotics Process Automation: RPA is the process of automating mundane, repeatable and rule-based tasks which are usually performed by humans on a computer. It does away with human limitations on aspects of speed, accuracy and multi-tasking. This automation is achieved by way of software bots which can be programmed rather easily to take care of such repeated transactions. Currently, RPA is one of the most aggressively pursued technologies out of all digital technologies since it’s relatively easier to implement and shows faster results than most other technologies. In order to imaging how RPA works, you can try and think of a virtual employee who is trying to work on 5-6 different applications simultaneously continuously switching among them with blinding speed and 100% accuracy. Many organizations have started adopting RPA for bookkeeping, reconciliations, invoice processing, expense filing, compliance, etc.

Auditors, as part of their audit process, in order to verify the robustness of the bots and the accuracy of the transactions processed by them – might need to investigate the “Process Design Documents (PDDs)” which are the process blueprint which goes into creating these bots. Additionally, they might need to work with bot log files to analyze any variances and detect internal control leaks. On the flip-side, audit firms can also look at implementing RPA to automate parts of their audit process which are highly manual, rule based and repetitive – for example checking and reconciling account balances in multiple sets of books, compiling reports from multiple documents, etc.

2.    Artificial intelligence and machine learning: The one thing which has always separated a bot from a human was a human’s ability to learn from experience. This is changing now with the advent of machine learning – which in layman’s language teaches a machine to learn from experience. Artificial intelligence is the capability of a computer-based system to take intelligent decisions on its own and to interact with its environment almost in a sensory manner.

Some simple examples of AI based systems are virtual assistants like Siri and Alexa which use Natural language processing and deep learning to interact with users to solve simple queries and self-driving cars which use computer vision and machine learning.

Machine Learning is the core technology which fuels Artificial Intelligence and enables an AI based system to continuously learn and take better actions and decisions. It is estimated that AI based systems will be able to work integrated with core accounting systems and business workflows to identify patterns and flag variances which can be in turn investigated by auditors.

Large banks have been using machine learning for a long time now to monitor payments to detect potential fraudulent transactions and act as an early warning system. As the adoption of AI strengthens across businesses, AI will act as assistants to auditors in flagging those transactions and cases which require the expert judgment of an auditor.

It is also important to note that machine learning needs a lot of data to work with in order to mature and build reliable models for prediction and pattern identification. The investment, learning curve and time to results are higher in case of Machine Learning and AI based systems as compared to RPA.

3.    Distributed Ledger Technology or Blockchain : Imagine a form of bookkeeping where a transaction is recorded not only in the books of accounts of the entity carrying out the transactions, but in a shared distributed ledger a copy of which is maintained by every entity which is impacted by the said transaction. This would be a form of bookkeeping which by its very definition will create close to immutable records which are very difficult to falsify. Add to this best in class encryption technologies which makes your data really secure - and the resultant technology is known as Distributed Ledger Technology or DLT. Blockchain introduces the revolutionary “triple entry accounting”. Triple entry accounting is an extension of the most widely used double-entry accounting system in which all transactions are validated and cryptographically sealed by an external third party, adding an additional layer of authenticity to the transactions. Triple entry can be simply explained as double entry + cryptography.[3]

Blockchain – one of the most popular types of DLT has wide implications in almost every industry because it creates a trust-less, immutable proof of record where fraud is very difficult to carry out and transactions can be stored in a tamper proof format.

From an auditor’s perspective, a DLT / Blockchain based bookkeeping system removes the need to reconcile multiple databases of records and provides a perfect audit trail. There is no other technology which comes even close to the quality of audit trail which a Blockchain based system provides. Because of the principal of immutability, historical entries cannot be change but only corrected with a balancing entry.

This enables the auditor to test audit assertions such as occurrence and cut-off while not removing the need for judgment-based opinions. While auditing in a Blockchain based environment, the auditor also needs to investigate the overall design of the system to identify and control leaks or flaws in design. While the presence of Blockchain simplifies and organizes the available information for audit much better, the auditor still needs to couple this with judgments based on applicable accounting standards. Blockchain based systems can also be coupled with AI to identify incoherent patterns and flags which can be investigated as exceptions by auditors.

Another very interesting feature of DLT based systems is a functionality called “smart contracts”. A smart contract is a self-executing contract which triggers a set of transactions when certain conditions are reached. This has wide applicability in automating financial transactions while maintaining perfect audit trail. There are significant investments which are being made by various organizations in their attempts to adopt blockchain and this has the potential to truly disrupt the financial services value chain. Auditors need to prepare themselves and be ready to audit in a blockchain based environment. When auditing in a blockchain based environment, some key audit areas and issues include areas such as auditing the cryptographic key generation and management, auditing cross border privacy regulations, auditing the access and permissions management, etc.

4.    Big data Analytics and Cloud based systems: Out of all the technologies which are a part of the digital mix – data analytics is by far the most mature and stable capability which by now is almost very highly adopted by all organizations as part of their systems. Based on a survey done by Protiviti, 76% of all organizations based in the Asia Pacific and Europe already utilizes data analytics as a part of the audit process[4]

Because of the big data revolution, auditors are also expected to use data analytics tools as part of their audit procedures to come out with detailed findings backed by data.  Many audit firms are already using data analytics for their transactions testing with the aim of moving away from sampling-based techniques to approaches where 100% of the data can be modeled into robust systems and analyzed. Today, cloud-based solutions also come with a built-in analytics layer. This gives potential for software manufacturers and service providers to come out with a SAAS (Software as a service) model for analytics tools specifically for auditors. Cloud based solutions add a lot of simplicity and standardization to organizations and helps an auditor’s cause specially when he is operating in a multi-geo setup with several entities and inter-company transactions.

One of the pre-requisites of using any cloud-based solution is to standardize data across entities. Cloud also helps auditors by creating a single shared source of truth. However, with more data on the cloud there is a need to add cybersecurity capability in audits in order to provide assurance services around cloud-based systems. Today there are several tools available at the aid of an auditor which can help the auditor build data models and run data analytics as a prominent part of audit procedures. ICAI’s publication on “Data Analysis for Auditors – Practical Case Studies Using CAATs” is a definitive read to explore some case studies on how Computer aided audit tools can be used in performing audit procedures.[5]

2.2 Skills needed and approaches towards auditing in a digital environment

To fully contribute to the new roles auditors will be put into, there are three broad categories of skills which auditors need to reflect upon with the intention to identify the gaps and create a roadmap to fully adopting them:

1.    Technical / Digital skills: First and foremost, audit professionals need to increase their awareness of the new digital technologies and build deeper understanding of how are these technologies impacting businesses. Once this is done, they need to reflect upon how can this impact their audit procedures and do a mapping of standard traditional way of doing things, viz-a-viz the new Digital way. Furthermore, auditors also need to get their hands into at least 1 or a recommended 2-3 technologies and see how can they leverage them as part of their audit procedures.

The important technologies and themes around which research needs to be done are CAATs, advanced analytics, big data, cloud technologies, automation and RPA, distributed ledger technology and blockchain, Internet of Things (IoT), Artificial Intelligence and Machine Learning, Cybersecurity, Digital Transformation, Industry 4.0, etc.

Audit staff needs to be comfortable with all the audit technologies if they are to realize their true potential. This being said, the pace of change in the current era is so significant that skilling cannot be a one-time investment of time, but has to become a continuous process of remaining updated.

2.    Transforming the audit methodology: As has been established earlier in this article, the audit methodology itself might need to go through significant transformation. Large auditing and advisory firms are already making large investments into developing their own home-grown tools and methodologies surrounding audit data analytics in order to create a differentiated market positioning, service the new types of client demands, and to manage stakeholder expectations. Some of the larger firms are also creating their own AI based audit platforms which they plan to use as part of their standard audit procedures.

Internal audit has seen this change the earliest. Some of the areas where they’ve aggressively employed data analytics and machine learning are areas such as fraud detection and risk management. To cater to the demand for real time information, on-demand reporting and more precise and detailed audit findings, the audit methodologies themselves need to go through a significant upgrade. Most business processes today stand re-imagined in their digital Avatar. Audit executives need to understand these re imagined processes in order to investigate them and formulate opinions. There is a need for a much more agile, flexible, technology enabled and responsive audit methodology to maintain competitive advantage in the audit marketplace. The audit planning phase needs to factor in all these areas.

3.    Mindset shift and people skills: The biggest shift that the Chartered Accountancy profession needs today is a significant mindset change. There has been a lot of “digital fatigue” which has set into the minds of individuals where some are scared of bots coming in to take away their jobs, while some others feel it’s too new a technology for them to be able to adopt it.

The Digital Transformation revolution which is taking place today is not optional – it is a natural evolution of global economic and industrial processes where the need for efficiency, speed and reliability has given birth to the all-encompassing Digital Ecosystem.

Auditors need to know how to use existing knowledge in a new situation, to make connections, explore potential outcomes, and generate new ideas. Audit firms also need to create a strong change management framework which should be able to implement the mindset shift which will enable the adoption of this whole journey.

3 Conclusion

The auditing profession is going through a very interesting time right now. Usage of CAAT Tools and other forms of technologies while auditing has always been considered as a value add. However, very soon this is going to convert into a necessity and within the next 5 years almost every auditor will have to perform technology audits and work with bots to perform their audit procedures. It is only a matter of time before AI engines will start performing fundamental advisory as well and act as smart assistants to auditors.

This era of digital transformation presents more opportunities than challenges for audit and assurance professionals. There’s a vast scope to create competitive advantage in the industry by adopting technology driven audit procedures and by also building comfort and expertise in auditing complex, modern and highly dynamic systems and business processes. The auditing profession is all set to transform and all audit firms will have to take part in this journey sooner or later.

[1] Grant Thornton 2019 CFO Survey Report entitled “All Systems Go: CFOs lead the way to ta digital world” - https://www.grantthornton.ae/globalassets/2019-cfo-survey-report.pdf

[2] Forbes Insights in association with KPMG : Audit 2025 – The Future is Now (https://assets.kpmg/content/dam/kpmg/us/pdf/2017/03/us-audit-2025-final-report.pdf)

[3] For additional reading on triple entry accounting please refer to the article in Bitcoin Magazine : https://bitcoinmagazine.com/articles/triple-entry-bookkeeping-bitcoin-1392069656

[4] Protiviti report entitled : Analytics in Auditing is a Game Changer : https://www.protiviti.com/sites/default/files/2018-internal-audit-capabilities-and-needs-survey-protiviti.pdf

[5] To obtain an e-copy of the publication please visit : https://pqc.icai.org/assets/announcement_files/1550139967.pdf