For internal auditors, developing trends in data analysis and data science can feel less like a wealth of information and more like an avalanche. Still, better use of data provides an opportunity to advance your career by adopting new invaluable skills. 

The missing link, the jargon-free guidance that cuts through the hype. The Data-Confident Internal Auditor demystifies the use of data in internal audits through practical step-by-step guidance. With concepts and tools that are easy to understand and apply, this comprehensive guide shows you how to approach data yourself without having to wait on a data scientist or a technical expert.

Developed over the course of hundreds of actual audits, these real-world approaches and practices are distilled into a simple sequence of steps that will leave you feeling confident and even eager to apply them for yourself.

You’re listening to The Author Hour Podcast, I’m your host Benji Block and today, we’re joined by Yusuf Moolla and Conor McGarrity. They have just come out with a new book and the book is titled, The Data-Confident Internal Auditor: A Practical Step-by-Step Guide. Guys, we’re glad to have you here on Author Hour today.

Yusuf Moolla: Thanks Benji, thanks for having us.

Conor McGarrity: Good to be here, Benjamin.

Benji Block: Absolutely. For listeners that are going to be brand-new to your work, guys. Can you provide a little bit of background and tell us what led you to write this book?

Conor McGarrity: Yeah, we’ve been working on the internal audit and performance audit space for quite a number of years now and we’ve observed the ongoing use of data within internal auditing. As we worked over the years, we couldn’t really find any sort of contemporary resources that would actually assist internal auditors to better use data within their work. That was really the driver for us sitting down and deciding to put this book together.

Yusuf Moolla: Yeah, part of the— I guess, the way in which we approach the work ourselves largely hasn’t been codified so we wanted to have a resource for our own team to use and anybody coming in and new people coming into the team that can get up to speed reasonably quickly. That was one of the driving factors and it just turned into, well, this could be useful for a whole bunch of people.

Benji Block: Why was this the right time to actually write the book because I’m assuming you guys are busy, writing a book is a long process, it takes time and effort but why right now?

Yusuf Moolla: Because we see a lot of our clients and potential clients coming to us asking specifically about this and asking specifically about helping their team improve their data skills. Just to be clear, internal audit teams have both technical folk and non-technical auditors if you like, so those that don’t really have a technology background or data background, this book is written for mainly, for those non-technical folks.

That’s the large majority of auditors that are out there and there was— we’ve been noticing over the last couple of years significant demand for the ability to be able to use data directly themselves as auditors.

Conor McGarrity: The other thing was that internal auditors were starting to feel slightly overwhelmed with this movement towards data and they’re feeling as if there’s an avalanche of information around data, and expectations were growing on auditors to use data, but they didn’t really have a source to go to. That’s some of the feedback and input that we were hearing from our clients and across the broader industry.

Benji Block: When someone picks this book up, your ideal reader, how do they work through this book? Is it more of a resource and a reference tool to go back to or is it something they’re supposed to read cover to cover?

Yusuf Moolla: The idea is really to read it cover to cover. The first couple of chapters and then the closing chapters are stand-alone, read it once, you may come back to it at intervals. The chapters in between are largely instructional if you like. Some of them will be reasonably technical and so the thinking with that is to read it all the way through and then come back to it as you make your way through specific examples, and we’ll have resources on the website that will help back some of that as well. You read a chapter, there might be a resource that summarizes that chapter that you can go to later.

Benji Block: Well, I’m always fascinated with what landed people, where they are and so, before we dive into the content, I’d love to hear from you guys, what created an interest originally to work in this industry and what do you feel is the most satisfying part of the work that you do? And maybe Conor, we’ll just have you go first on this one.

Conor McGarrity: Yeah, sure. Over the years I’ve seen in my own professional life, growing interest both among colleagues, contemporaries, clients and wanting to understand how this data could help them in their work more broadly, even beyond internal audit. Around about 10 years ago, that piqued a real interest in my own work at the time and so I started on this little journey to try and understand some of the work we do for clients, how can we actually get a grasp of that data, and make something meaningful for them.

That was around about 10 years ago that my interest was piqued in that, and then over the years and subsequently, Yusuf and I have— when we came together to start the business, we’ve had gradually year on year, more of a focus on using data within our own work and that’s really reaped massive benefits both for our clients and for us.

The initial interest was piqued early on in the piece whenever the whole talk about the value of data and what that meant, we wanted to actually have a focus on that and say tangibly, “How can that be used in our work?”

Yusuf Moolla: Reasonably similar from you except that it might be a little bit different in terms of execution but about 20 years ago, and I started working, I just— in the very first job that I had, I actually gravitated towards certain aspects of that work that required heavy use and analysis of data.

Then I jumped out to that after a few years of working in that data field, more specific data area, I jumped out into audit, did auditing for a few years, and then realized, “Hey, there’s a potential for these two things to come together.” So, this is probably going back about 15 years now and just haven’t looked back since. 

The use of data within audit has been something that we sort of landed in through I guess the— what I’ve seen over the years in terms of the ability to use it but also, just personal interest, I just enjoy doing it.

The Learning Curve

Benji Block: Let’s dive into the content here and let’s talk about some misconceptions. You guys say that there are many misconceptions when it comes to data, especially about using it for audits. Please, expand on that. What are some of those common misconceptions that you’ve encountered in your time working in this field?

Yusuf Moolla: Okay, in no particular order— and hopefully the book has it ordered really nicely— but one of them that springs to mind straight away is that you need a data scientist, that you need some sort of specialist to help you get through this and what we’ve been seeing and saying, over the last few years particularly, is that technology has evolved so significantly that you don’t necessarily have to wait for some sort of data specialist.

Most people nowadays can do this with themselves. I’m seeing my kids at school are using data tools themselves, and so anybody that’s sort of had a— most auditors would have some sort of university background or a college background, or at least professional background if not, and the first myth is you don’t have to wait for a specialist data person, you can do a lot of data work directly yourself.

Benji Block: With that, is it just the rapid speed of technology that you feel like that’s what’s— maybe people aren’t aware of, is that there is this commonly held belief that this misconception that you need some specialist but we’re seeing tech evolve so quickly that that’s no longer true and no longer needed?

Yusuf Moolla: It’s not the only factor, so another is that there’s the proliferation of data and the ease of access to data has grown and people are more aware. I think in terms of the general auditor using data themselves, like we said, the technology makes a big difference or the way in which technology has progressed does make a big difference, it is just so easy. A couple of years ago, you couldn’t put more than a million rows, million lines of data into excel and now it’s unlimited. 

Excel is something that a lot of auditors would be familiar with using. The way in which computers work, means that you can run a million record Excel file without your computer slowing down to processing it over two days. All of these things add up to really easy pathways for auditors to directly set up.

Benji Block: Are there any other common misconceptions you guys would want to highlight before we kind of move on here?

Conor McGarrity: Yeah, one of the other commonly held myths is that the use of data and internal audits only increases the value in a handful of audits so that it’s sort of very niche, sort of part of your internal audit program and it’s maybe going to be an over-investment if you focus on it too much. Now, that’s an absolute myth although it’s sort of still exists in that pretty much these days, there is some sort of focus or use of data in every single internal audit.

It’s becoming less common to hear that data can only be used in a few audits, but it still exists. Some of the way as we’ve tried to explain that and bust that myth in the book as to its usefulness, pervasiveness across all of your audits that it can do things like help— data can help identify opportunities that management can’t see. It often can, the use of it in your work, can often make it really much easier for management to read your audit outputs. 

If you’ve got some data that you’ve taken and you’ve put it into readable charts, that often can convey a lot more messages than whole heaps of reams of text. There all are multiple benefits, the use of data in every audit, as supposed to this misconception that it’s only useful in a handful of audits.

Benji Block: When it comes to using data for an audit, are there principles, some essentials that are really important to keep in mind?

Yusuf Moolla: Yeah, there’s a few and we go through several of them in the book, but the one that we’ve been focusing quite heavily on over the last few years is ensuring quality. The reason for that is auditors always and, you know, people are always looking for quality in their work but the definition of quality has potentially be misunderstood by audit teams because a lot of traditional audit work is around financial segment audits, which means that you need to have all of your—The report is fairly straightforward. 

You either say the financials are good or they aren’t good, and so a lot of the focus on quality is in the actual execution of the work. Whereas, with internal audits and a lot of different types of audits nowadays, the quality focus needs to be on the audience and what they’re going to be receiving because really, quality is about who— can we maximize what we’ve done to the recipient. Because those reports look different and they’re not just providing one sort of risk-based outcome, that focus on quality and the principle around how you find the quality focus is quite important.

Conor McGarrity: One of the other important principles that we talk about a little bit in the book is that of flexibility and the fact that both you as an auditor need flexibility in your approach to using data, but you also need to realize that analyzing data is inherently iterative, so don’t expect to get the first, the right answer the first time around. 

There will be a learning curve, but that’s a good thing. But having the right approach and making sure that you’re flexible and knowing that you will have to sort of revisit your analysis as you work through your audit is really important. We shouldn’t sort of set our expectations too high early on, either our sales as practitioners or among our stakeholders that, you know, just because we’ve got some data, we’re going to get the right analysis the first time. 

You need to make sure you’re building in that flexibility early on and then as you get more experienced, obviously, you’ll be able to get to the right answer quicker, but it’s just making sure that you have that flexibility in your approach. 

Benji Block: When I think of data and auditing, I do not think of flexibility, so reading that was really interesting because I think flexibility does— obviously, it’s something that is needed in many lines of work but the fact that flexibility came up here as a topic, I mean that’s good that you guys are re-centering that as a key principle to come back to. 

Conor McGarrity: I was just about to say maybe that’s another myth that we’ve busted hopefully overall with the book that auditors are boring and don’t have a life outside of their work and their computer and that’s obviously absolutely not right. 

Benji Block: I love that. You say that the most common mistake that you’ve made is using standardized sets of rules without properly thinking about the audit objective. Give me an example of how you guys have seen that play out? 

Yusuf Moolla: Okay, so and hopefully we’ve explained all of the different types of mistakes that people have made over the years, or at least in quite a few of them, because of course, we only really learned properly from making those mistakes. But the standardized sets of rules, we see that— and we’ve seen that even more recently on a few audits when we’ve had to ask people to change it, but probably going back about 10 years, where that preconception around what it is that we were looking for meant that we were very, very focused on just those specific tests that we needed to execute and you miss out, then, on everything else. 

Examples of that is, I can think about 10 years ago when I did a barrel audit and this was, you know, barrel audits back in the day where the bread and butter of data work. But you know, this was very, very straightforward. Just come in, run a few tests based on something that we have seen before and what that meant was in that case, we missed something that really, we should have been picking up at the time. 

Now fortunately we picked it up before it hit the media, but what the standardized sets of rules don’t give you, is that they don’t give you the ability and the headspace to really think about what the objective is and how the business operates and how you need to actually look for potential improvements in payroll. So really, what you’re using, is you’re using history based on other companies, other industries that may have nothing to do with the situation that you find yourself in. 

Conor McGarrity: Maybe one thing to add to that is we’re not saying that there’s no place for rules-based approaches, absolutely, and there will be for some time to come, but as Yusuf just said, you shouldn’t turn your mind off or it shouldn’t be the greatest focus of how you approach your analysis to data. Of course, rules-based approaches may work better in certain circumstances in a compliance audit, for example, or if you are looking for fraud in a very specific domain, that approach is, rules-based approaches are only one part of a broader tool kit, is what we’re trying to explain in the book. 

The Hypothesis-Based Approach vs. Process-Focused Approach

Benji Block: There’s four approaches that you detail, landing eventually on saying that there is this hypothesis-based approach and that seems to be the sweet spot. What advantages would you have found in that approach? 

Yusuf Moolla: Multifold benefits, I guess. The primary benefit we have to hypothesis-based approach is that if you’re positing something or you’re positing a risk or you’re putting forward a scenario early on, it really helps you to focus the analysis that you’re going to be doing throughout that audit, so you’re not going down little rabbit holes and spending lots of time going off course. You know broadly what you’re going to be looking for. 

Either something has happened because of this, or it hasn’t happened because of this, and then you can go and analyze your data. From that perspective, the hypothesis-based approach really enables you to focus your audit. With that being said, as you go through and try to prove or disapprove your hypothesis, you may see some other interesting observations that you can set aside for the time being. 

They may, for example, go beyond the objective of this particular audit, but it may mean that you can follow them up with their own at a different time. So again, it is just about trying to use the hypothesis to focus your work. 

Conor McGarrity: The other thing with that is the primary alternative to the hypothesis-based approach is a process-focused approach. We talk about data for reporting only in the book and that’s a very specific thing. We talk about the exploratory approach, which is very specific but the traditional way in which we as auditors have focused our data work has been process-based. This is where we try to basically replicate the process that the organization is set up. 

Why we’re saying hypothesis is better, is that nobody really cares about— well, the audit committee don’t care about exactly how the process works, but they care about what customers are getting, what the outcomes a particular function or domain or process is. Really aligning with what it is that people are expecting, as opposed to trying to recreate what the organization’s already doing. 

Benji Block: Okay, so you’ve collected the data, and then I loved reading about visualization because visualization becomes crucially important. I think it’s interesting, I am not a data guy, right? I was trying to think, how do you translate this to a team? How can the data become easily understood? What are ways that you have found to make this content and this data easily digestible? 

Yusuf Moolla: Yes, so we started our data visualization journey fairly recently, probably over the last seven or eight years really, so before that, I guess that part of it is, again, the technology has evolved since then, but those technologies are so easily available now. You can get Power BI or Tableau or QlikView, any of these quite easily, and there’s open-source free options where you don’t have to do any coding. 

You just sort of chuck your data in, and you can get a few graphs. Now that is not the ideal, that’s just if you want to explore at a high level. So, it goes all the way from there to, there is a few individuals that we know that do data visualization for a living, really, and so they produce some really fancy graphs and charts and things that work quite well at the other end of that level. 

But somewhere in between where you’re using data visualization tools regularly and can translate data into a couple of charts with tables and explanations, that’s really where we see sort of data in ordered visualization going. So, in your reports, if you’re able to show a summary with a little bit of detail and then an explanation, that is probably a sort of an ideal situation. 

Conor McGarrity: The beauty of visualization, so even if you are taking quite complex data analysis and putting that into something that is understandable for senior management, for example, or for your audit committee, it can often answer the questions they have intuitively, which is really helpful because their time is precious. But the other thing is that for management, it might provoke other questions or ideas or generate new opportunities in their mind.

That is another benefit that comes through the use of data where we’re taking— we’ve done all this great analysis and it may take quite a while to do it, and we put it into something that is digestible, understandable, and can be used then for many purposes in the end. 

Benji Block: We’ve covered some broad brushstrokes, but as we start to wrap up today, I wonder if there are just some pieces of this book, some of the content that you want to hit on and kind of what to expect for those that are going to pick up and read this book. 

Yusuf Moolla: The key thing is there’s nothing earth-shattering in the book. We’re not making massive claims, but what we are doing is trying to or what the book does do is try to direct effort towards those areas that are going to be meaningful in using data. What you can expect to find is a basic explanation of why you should do this, what are the sort of myths, et cetera and then diving really into how do you do it. 

All the way from when you need to determine what data to get, determine how to prepare that data, cleanse the data and then there’s all sorts of, which gets a little bit scary, but you know, after a few iterations, it is not so bad, joining data and blending and a few technical areas like that, and then it wraps up with a bit of summary that again, like I said before, you don’t really need to go back to. 

Anybody picking up the book should be able to exit that reading or finish their reading with a really good understanding of what it is that they need to do and can do. There is probably a bit of a jump from there with some resources on the website that can help actually execute, and practical examples, but that’s the idea, it’s to take you from not sure whether you can do this yourself to being confident that you can. 

Conor McGarrity: Two things leap out, sort of at a macro level for me in the book, and the first one is it’s a tool for all the auditors out there to go to your senior management or your audit leader to say, “This is why we need to be focusing on data so that we don’t get left behind.” So, that’s the first thing because, as Yusuf said, it expresses in some quite simple terms all the value that can be derived from a data-focused approach to your work. 

The second thing is, as we said up front in the episode, it’s to dispel a few myths so that auditors themselves who hear all this noise about, “Why aren’t we using more data?” or maybe feeling overwhelmed, having this book in their hand will give them the confidence to go forward and to understand, “Look, I can actually do this myself in my own work, and take me forward in the profession.” 

Benji Block: It’s been really an honor to talk to you guys about this book. You have come out with a lot of resources that can help on the website and you actually have a podcast as well, is that correct? 

Conor McGarrity: Yeah, we do have a podcast. We put up fortnightly, usually, covering mostly issues relating to the use of data within internal audit and also for those performance auditors around the place on performance audit, but it is squarely data-focused and it’s called The Assurance Show.

Benji Block: That’s great. For those wanting to connect with you guys further, obviously take a listen to the podcast, what are other ways where people could connect with you guys? 

Yusuf Moolla: Okay, so in terms of the easiest way to get to us would be our website, riskinsights.com.au. Connor and I are both on LinkedIn as well and you know, we regularly monitor that. 

Benji Block: Awesome. Well, it’s been an honor to discuss the book. The book is called, The Data-Confident Internal Auditor: A Practical Step-by-Step Guide. This is going to be a great resource to so many and we really appreciate your time here on Author Hour and thank you so much for writing this book. 

Yusuf Moolla: Thanks, Benji. We appreciate your time. 

Conor McGarrity: Been a pleasure, thanks, Benji.