Connect Support Advance

White Paper

Data Analytics
Resourcing within
Internal Audit
2024

This resource was prepared after the ‘Global Internal Audit Standards’ were published in 2024

Level 5, 580 George Street, Sydney NSW 2000 | PO Box A2311, Sydney South NSW 1235
T +61 2 9267 9155 F +61 2 9264 9240 E enquiry@iia.org.au www.iia.org.au

© 2022 - The Institute of Internal Auditors - Australia

 Data Analytics Resourcing
within Internal Audit
Contents 4. Access to appropriate data analysis tools.

Introduction 2 5. Availability of trusted data sources across the

organisation.
- Purpose 2
- Background 2 6. Breadth of data analytic techniques at the disposal of
Discussion 2 internal audit.

- Issue 2 This White Paper will focus on factors 2, 3 and 4 outlined

- History 2 above.

- Resourcing Options 3
Discussion
- Advantages and disadvantages of resourcing 3 Issue
options
- Appropriate Tools 4 Key barriers to resourcing data analytics work within
internal audit include:
Conclusion 5
- Summary 5 › Available internal auditors do not have the required
- Conclusion 5 data analytic skills.

Bibliography and References 5 › Internal auditors with the required data analytic skills
Purpose of White Papers 6 do not have capacity to deploy data analytics on all
audits identified as being suitable candidates for data
Author’s Biography 6
analytics.
About the Institute of Internal Auditors–Australia 6
Copyright 7 › External services providers with data analytic skills
are either not available or not cost-effective.
Disclaimer 7
› Internal auditors do not have appropriate data
Introduction
analysis tools.
Purpose

Resourcing data analytics work within internal audit is History

often a barrier when intending to utilise data analytics as
Data analysis has been an emerging approach to internal
a technique to enhance internal audit effectiveness and
audit for more than 30 years. Initially it involved specialist
efficiency. This White Paper outlines different resourcing
internal auditors using data extraction and reporting tools
options that can be used by internal audit functions,
on mainframe systems. With the emergence of personal
including the advantages and disadvantages of these
computers and networking of systems, tools like Microsoft
options.
Excel were used for basic data analysis. Excel remains a
Background useful tool and there are many internal audit functions that
continue to use it for data analysis.
Data analytics should be utilised by all internal audit
functions irrespective of the size of the organisation and Today, data analysis technology is more generally
size of the internal audit function. The extent to which data available, but at the same time, data structures have
analytics is used depends on several factors including: become more complex. Analysis of ‘big data’ require deep
understanding of the data itself. The skills requirement
1. Buy-in for data analytics from the audit committee,
has moved from access and analysis technology to
chief audit executive and senior internal audit staff.
understanding of data.
2. Number of internal audit staff with data analytic skills.

3. Capacity of internal audit staff with data analytic

skills.

© 2024 - The Institute of Internal Auditors - Australia 2

 Data Analytics Resourcing
within Internal Audit
Resourcing Options › For internal audit functions with less than 10 staff, less
than 1 full-time equivalent (FTE) could be dedicated
The ideal data analytics resourcing approach is to use
to data analytics work (for example 0.5 FTE for an
in-house internal auditors as this reduces reliance on
internal audit function with 5 staff).
external service providers and empowers your internal
audit function with leading-edge skills. This approach External service providers
includes:
› There are two key options for using service providers:
Internal auditors up-skilled in data analytics
› A consulting firm can supply dedicated data
› Internal Audit staff can also execute business-as-usual analytics specialists.
(BAU) internal audit work or other specialist audit work
› Independent contractors who are dedicated data
such as technology and cyber audits where proficient.
analytics specialists. External service providers
› Using this approach, it is important to ensure internal can also be used to deliver data analytics work.
auditors have regular opportunities to apply data
› This approach is especially useful in the first one or
analytics to their work, otherwise their data analytics
two years of establishing data analytics capability
skills will quickly diminish.
within an internal audit function.
› It is also important to ensure there is a genuine
› Time and effort should be built in for the service
interest in data analytics as internal auditors who are
provider to mature the data analytics capability of
forced into up-skilling have a higher risk of not utilising
the internal audit function. If sufficient time is not built
data analytics on their assigned audits. This wastes
into the engagement, your function will be slower to
time and effort up-skilling which does not produce the
mature its data analytics capability and will be overly
desired results.
reliant on the service provider.
Internal auditors who are dedicated data analytics
› For internal audit teams with more established data
specialists
analytics capability, service providers can increase
› This is more feasible in larger internal audit functions the volume of audits where data analytics is used
which have more opportunities for data analytics due and they can deploy more advanced data analytics
to ‘critical mass’ and larger internal audit plans. techniques.

› A general rule of thumb is to strive for 10% of internal

audit staff being dedicated data analytics specialists,
for example one dedicated data analytics specialist
for an internal audit function comprising 10 staff.

Advantages and Disadvantages of Resourcing Options

Resourcing Option Advantages Disadvantages
Internal auditors up-skilled in data › Cost-effective › Not all internal auditors are suited to
analytics › Greater value gained from deploying analytics
internal auditors › Training expense
› More satisfying work for internal › Need to deploy analytics regularly to
auditors remain competent and deepen capability
› More likely analytics will be
routinely used
› More likely data analytics
capability to be available when
required

© 2024 - The Institute of Internal Auditors - Australia 3

 Data Analytics Resourcing
within Internal Audit
Internal auditors who are
dedicated data analytics
specialists
External service providers -
consulting firm
External service providers -
independent contractors
› Needs ‘critical mass’ size internal
audit function
› Cost-effective
› Builds strong capability with
dedicated ‘go to’ professionals
› Advanced analytics skills can be
developed and deployed
› More likely to be available when
required
› Can dedicate time to continuous
auditing and other pilot projects
› Works well when there is an
established co-sourced or
outsourced relationship
› Can leverage techniques and
approaches from same industry /
similar clients
› Likely to be more cost-effective › May not be available when required
› More likely to have deeper
data analytics experience and
industry experience
› More likely to build-in knowledge
transfer to in-house internal
auditors over time
› Training expense
› Need enough analytics work to keep
specialists utilised
› Strong competition for analytics talent
who may prefer to work in business
areas rather than internal audit
› Analytics talent may be poached by
other organisations.
› Can be expensive
› May not be available when required
› May utilise more junior staff for delivery
› More care required with data
confidentiality and privacy if not using
the procuring organisation laptop or
virtual desktop infrastructure
› More care required with data
confidentiality and privacy if not using
the procuring organisation laptop or
virtual desktop infrastructure

Appropriate Tools Commonly used data analysis tools include:

Specialised internal audit tools such as ACL and IDEA
became popular in the late 1980s. Around 10 years
ago due to the proliferation of databases and data
warehouses, tools like Microsoft SQL Server, Teradata SQL
and SAS started to be adopted. Instead of a single tool,
internal audit functions typically adopt multiple tools or
toolkits depending on:
› Data analytics skills within the internal audit function.
› Variety of data sources available.
› Complexity of data analytics techniques being
deployed.
Accessibility of the following data analytics tools does not
eliminate the need for internal auditors to be trained in
their use and in the controls essential to producing reliable
results.
› Microsoft Excel is a generally available tool that can
be used for analysis of large volumes of data. Volume
limitations from earlier versions have been addressed,
but the processing load can tax installations on local
desktop and laptop computers. Excel has capability
to manipulate data using sorting, filtering and
summarising capability within the application. There
are business intelligence extensions available. The
primary complexity for Excel use is preparation and
loading of the data of interest and joining multiple
datasets.
› Audit Command Language (ACL) and Interactive Data
Extraction and Analysis (IDEA) are well established
tools initially designed for use by auditors, but now
more generally accepted as analytical tools for
general business use. These tools are intuitive in

© 2024 - The Institute of Internal Auditors - Australia 4

 Data Analytics Resourcing
within Internal Audit
their use and have significant functional capability.
They enable matching and merging of different data
sources and provide the ability to import data from
a range of sources. Importantly for auditors, these
packages do not change their data sources and they
maintain logs of all activity. Complex scripts may be
stored for regular use.
› Structured Query Language (SQL) is a general-
purpose approach for access to relational databases.
SQL programming is an efficient way to perform
analysis on large amounts of information (millions of
rows). It allows selective extraction, matching, joining
and grouping. It can produce easy to understand
output in a fraction of the time other tools may take.
› Statistical Analysis Software (SAS) can mine, alter,
manage and retrieve data from a variety of sources
and perform statistical analysis on the data. As with
other packages, scripts (SAS Macros) can be stored
and used for repetitive tasks. There are a number of
add-on packages that provide advanced capability.
› Data Warehousing is used where an organisation has
adopted data warehouse technology and has a range
of analytical and reporting capabilities, allowing
auditors to use tools like Teradata SQL to query and
extract data. The advantage of data warehouses is
they centrally store data from multiple business units
across the organisation.
› Low code and no-code tools. Over the past few years,
tools such as Alteryx and Knime have become more
popular as they allow powerful data analysis to be
performed without needing to develop code like SQL
or SAS. These tools typically use a workflow-based
approach and can connect to a wide variety of data
sources.
Conclusion
Summary
The ability to properly resource data analytics work within
an internal audit function is a key enabler in being able
to develop a robust data analytics capability. There are
several resourcing options to consider, including cross-
skilling staff so they have data analytics skills and hiring
dedicated data analytics specialists. When considering
external service providers, options are to use a consulting
© 2024 - The Institute of Internal Auditors - Australia
firm or an independent contractor.
Conclusion
There is no ‘one-size fits all’ approach to resourcing data
analytics work for an internal audit function. A combination
of the resourcing approaches outlined in this White Paper
may be an option which would naturally evolve over time
as data analytics capability matures.
The overarching ambition should be to resource data
analytics work so that it helps achieve the technology
aspect of the internal audit strategy or separate internal
audit data analytics strategy if this has already been
established.
Bibliography and References
Bibliography
Elson, H., 2023. White paper: Data Mining Using Excel.
[Online]
Available at: https://iia.org.au/technical-resources/white-
paper/iia-australia-white-paper-data-mining-using-excel
Islam, T., 2023. White paper: Data Analysis Techniques for
Internal Audit. [Online]
Available at: https://iia.org.au/technical-resources/white-
paper/iia-australia-white-paper-data-analytics-techniques-
for-internal-audit
The Institute of Internal Auditors - Australia, 2020.
Factsheet: Data Analytics and Continuous Control
Monitoring. [Online]
Available at: https://iia.org.au/technical-resources/
fact-sheet/iia-australia-factsheet-data-analytics-and-
continuous-control-monitoring
The Institute of Internal Auditors, Inc, 2011. Global
Technology Audit Guide: Data Analysis Technologies.
[Online]
Available at: https://www.theiia.org/en/content/guidance/
recommended/supplemental/gtags/gtag-data-analysis-
technologies/
Webster, M., 2023. White paper: Data Analytics using SQL.
[Online]
Available at: https://iia.org.au/technical-resources/white-
paper/iia-australia-white-paper-data-analytics-using-sql
5
 Data Analytics Resourcing
within Internal Audit
Purpose of White Papers
A White Paper is a report authored and peer reviewed
by experienced practitioners to provide guidance on a
particular subject related to governance, risk management
or control. It seeks to inform readers about an issue and
present ideas and options on how it might be managed. It
does not necessarily represent the position or philosophy
of the Institute of Internal Auditors–Global and the Institute
of Internal Auditors–Australia.
Author’s Biography
About the Institute of Internal Auditors–
Australia
The Institute of Internal Auditors (IIA) is the global
professional association for Internal Auditors, with global
headquarters in the USA and affiliated Institutes and
Chapters throughout the world including Australia.
As the chief advocate of the Internal Audit profession,
the IIA serves as the profession’s international standard
setter, sole provider of globally accepted internal auditing
certifications, and principal researcher and educator.

This White Paper written by: The IIA sets the bar for Internal Audit integrity and
professionalism around the world with its ’Global Internal
Tariq Islam PMIIA, BEng (First Class Honours), BMaths & Audit Standards’ and associated professional guidance.
Computer Science
The IIA-Australia ensures its members and the profession
Tariq has 18 years of experience across financial services, as a whole are well-represented with decision-makers and
professional services and defence, including 11 years of influencers, and is extensively represented on a number
internal audit experience at CBA, Westpac and PwC. In of global committees and prominent working groups in
2023, Tariq founded RapidLynx Consulting to provide Australia and internationally.
cost-effective and tailored data, analytics and artificial
intelligence services to organisations across the Asia The IIA was established in 1941 and now has more than
Pacific. 230,000 members from 190 countries with hundreds of
local area Chapters. Generally, members work in internal
Prior to starting RapidLynx Consulting, Tariq held Executive auditing, risk management, governance, internal control,
Manager Analytics roles in internal audit at CBA and information technology audit, education, and security.
Westpac where he led teams delivering complex data
analytics work across multiple audit teams. Across CBA
and Westpac, Tariq led data analytics work on over
100 internal audits using traditional and emerging data
analytics techniques to consistently identify material
issues across all major business units and risk classes.
Before moving to banking, Tariq spend more than a
decade working in risk and fraud analytics at PwC and
defence engineering projects at BAE Systems.
This White Paper edited by:
Michael Parkinson BSc(Hons), GradDipComp, PFIIA, CIA,
CISA, CRMA, CRISC
Andrew Cox MBA, MEC, GradDipSc, GradCertPA,
DipBusAdmin, DipPubAdmin, AssDipAcctg, CertSQM,
PFIIA, CIA, CISA, CFE, CGAP, CSQA, MACS Snr, MRMIA

© 2024 - The Institute of Internal Auditors - Australia 6

 Data Analytics Resourcing
within Internal Audit
Copyright
This White Paper contains a variety of copyright material. Some of this is the intellectual property of the author, some is
owned by the Institute of Internal Auditors–Global or the Institute of Internal Auditors–Australia. Some material is owned
by others which is shown through attribution and referencing. Some material is in the public domain. Except for material
which is unambiguously and unarguably in the public domain, only material owned by the Institute of Internal Auditors–
Global and the Institute of Internal Auditors–Australia, and so indicated, may be copied, provided that textual and
graphical content are not altered and the source is acknowledged. The Institute of Internal Auditors–Australia reserves
the right to revoke that permission at any time. Permission is not given for any commercial use or sale of the material.

Disclaimer
Whilst the Institute of Internal Auditors–Australia has attempted to ensure the information in this White Paper is as
accurate as possible, the information is for personal and educational use only, and is provided in good faith without
any express or implied warranty. There is no guarantee given to the accuracy or currency of information contained
in this White Paper. The Institute of Internal Auditors–Australia does not accept responsibility for any loss or damage
occasioned by use of the information contained in this White Paper.

© 2024 - The Institute of Internal Auditors - Australia 7