As organizations seek to evolve their risk management strategies to drive stronger compliance programs, they increasingly seek to automate their compliance documentation. In cybersecurity, however, traditional data collection methods fail since cybercriminals continuously evolve their threat methodologies. Since point-in-time documentation and audits no longer provide assurance over information security controls, organizations seeking to scale now use internal audit data analytics to mature their programs.

Big Data in Auditing

What is Big Data?

Big data relies on volume, velocity, and variety. To integrate big data and analytics into an audit program, you need to have a large amount of data filtering in from a wide variety of locations in real-time. When aggregating information, it be structured data, as in a table, or unstructured data, such as text, images, or binary programming.

How Data Analysis Uses Big Data

The data sets provide large amounts of information. However, without data analytics, the information remains meaningless. Data analysis can be either predictive or prescriptive.

Predictive analytics use modeling, machine learning, and data mining to take a “best guess” about what will happen next. For example, organizations can use predictive analytics to strengthen their operational business risks analysis.

Prescriptive analytics enable the organization to prioritize actions and make decisions. For example, a company can use prescriptive analytics to identify financial reporting controls that need to be strengthened first.

Using these analytical procedures, organizations can better assess risk and prioritize mitigation strategies.

What Are Audit Data Analytics?

The internal audit process requires documentation to support the American Institute of Certified Public Accountants (AICPA) auditing standards.

For example, an organization that needs to maintain compliance with the Sarbanes-Oxley Act of 2002 (SOX) needs to provide their external auditors with audit evidence supporting its ability to maintain effective financial reporting controls. However, since organizations use a variety of integrated Software-as-a-Service (SaaS) platforms, SOX compliance also requires cybersecurity continuous monitoring over the environment and continuous documentation to prove governance.

All of these tools are ways that companies strengthen the quality of their audit evidence.

How Big Data For Audit Evidence Changes Professional Skepticism

Professional skepticism is the foundation of audit quality. The traditional audit approach relied on auditors bringing personal experience to review a company’s policies, processes, and procedures. However, as companies adopt automation, the traditional approach which focused on manual operations and relationships to input and output change.

To maintain their professional skepticism, auditors need to create new audit procedures. For example, automated systems using artificial intelligence and machine learning produce different documentation. They provide continuous monitoring to detect fraud which can ease a financial statements review.

Although this new documentation enables better audit quality, it also means that audit firms need to understand how and from where the automated system collects data.

Why Audit Firms Need Data Scientists

To maintain audit quality, audit firms need to focus on retaining teams who can analyze the way that a company uses automated systems.

A primary problem with automation lies in its cybersecurity risk. Internal or external actors can compromise audit documentation integrity, availability, and confidentiality. Unauthorized access to audit data can lead to malicious actors deleting or changing the information necessary for a relevant audit.

For example, a malicious internal actor may use privileged access to change financial statements to hide embezzlement. If external auditors simply review the financial statements against the general ledgers, the fraud may go unnoticed because both are automated and the malicious actor will have compromised both.

Therefore, audit firms need to focus not just on the documentation presented by the client but also on the controls maintained over access and use.

How Companies Can Protect Themselves in the Big Data Era

In an era of Big Data and automation, companies need to understand the technology they use that enables their audit outcomes.

Maintaining a strong cybersecurity program enables the company to protect itself from fraud while also reinforcing its continuous monitoring and continuous assurance programs.

To promote quality audit documentation, the organization needs to ensure effective controls over:

• Change Configurations: immediately change vendor provided configurations so that no users outside the organization can obtain access
• Network security: ensure that no malicious actors can infiltrate systems and software to change the documentation.
• User Access: reviewing user access to data and ensuring “least privilege necessary” with attribute-based access control monitors who has the ability to compromise the audit by changing data
• Privileged Access Management: monitoring privileged users, especially escalated privileges, provides visibility over data access

While these are only a few ways that a company can control its audit data integrity, they highlight some of the primary risks involved with Big Data analytics in an audit.

Why Cybersecurity Enables Audit Quality

Although most organizations view cybersecurity as a way to protect themselves from costly data breaches, they need to also focus on the business processes that their technologies enable.

While organizations need to incorporate automation as part of their audit processes, they also need to understand how the technology works and protect their data integrity. Audit firms recognize the need to review automated system inputs and outputs. Therefore, they will increasingly be including these reviews as part of their audits.

A strong cybersecurity posture becomes the only way that companies can maintain audit quality while also easing the audit process.

How ZenGRC Enables Big Data in Auditing