Running in parallel: the challenges of implementing real-time auditing

26 Oct 21

Cultural resistance and poor-quality financial data present hurdles to achieving real-time auditing of public spending.

Last year, Nigel Clarke, Jamaica’s minister of finance, made a crucial decision. Keen to avoid wasting Covid-19 financial assistance for businesses and employees, he asked government auditors to scrutinise payments at the same time as applications were processed.

The move has already saved the country’s treasury $245m in payments to ineligible applicants, according to Pamela Monroe Ellis, Jamaica’s auditor-general.

Speaking in June, she said: “Real-time audit plays that critical role of a preventer. It is far less costly to prevent than to correct.”

While the public purse remains under extreme pressure from the pandemic, expectations of quicker access to mission-critical financial information are on the rise.

Recent technological innovation makes producing accounts and financial data much easier and quicker.

This combination of motive and means raises the prospect of a significant shift in the role of auditors, and a new era of real-time auditing.

Franki Hackett, head of audit and ethics at artificial intelligence and data analytics company Engine B, explains: “Instead of taking backward-looking data from the organisation you are auditing, real-time auditing takes a live feed of information from organisations and applies algorithms and monitoring on top of it to identify risks, problems and issues as they arise.”

Driven by disenchantment

The move towards real-time is being driven by growing disenchantment with the use of annual accounts to provide retrospective assurance, according to Khalid Hamid, CIPFA’s international director.

“The public sector external audit profession is basically in crisis,” Hamid warns.

“All it is doing is attesting to the accounting policies in the financial statements and not looking at the underlying internal controls where fraud is happening. Currently, we are given historical assurance nine months later, and that does not work in the way that it used to.

“Most processes today are systematic and recurring, so the idea of producing assurance on them is just for the sake of it,” Hamid says.

The ability to review data in real time paves the way for audit to play a more strategic role in policymaking and to transform the cumbersome way that information is brought to the attention of stakeholders, he says:

“Real-time audit offers the possibility of looking at whether the intentions of policies are clearly understood and defined and can be monitored and evaluated.”

Certainly, the arguments in favour of bringing audit closer to real-time data are compelling.

It offers the potential to resolve problems as they arise; incorporate findings into the continual improvement of finance processes; get assurance early on; and avoid risk – all of which help to ensure that public money is spent appropriately.

It could also help reduce workloads by shifting the emphasis to risk-focused audits and away from the intrusive and inefficient process of sending in an army of auditors for random sampling and a ‘spray and pray’ approach to unearthing anomalies.

“You tend to get higher audit quality, because you can focus your efforts on applying judgment where there is real complexity and risk,” Hackett says.

Bitter pill

In June, the UK parliament’s Public Accounts Committee found that fraud and errors surrounding government loans and grants to help businesses cope with Covid-19 – many of which were administered by local authorities – could cost the British taxpayer tens of billions of pounds.

The scale of losses is a bitter pill to swallow. However, the committee also said it had heard worrying evidence of increasing issues over the timeliness and quality of council audits.

In particular, a combination of constrained budgets and services under pressure meant they had a “variable capacity” to handle fraud.

Technical barriers are gradually being overcome, thanks to increased digitisation of financial information and greater system interoperability.

The Standard Audit File for Tax (SAF-T) is an international XML-based reporting standard defined by the OECD for the electronic exchange of tax, VAT and accounting information between businesses and national tax authorities or external auditors.

The standard is now increasingly being adopted within European countries, allowing tax returns to be filed electronically.

Poland replaced its VAT return with SAF-T filing in October 2020, while a Romanian SAF-T mandate comes into effect for large taxpayers from 1 January 2022.

Phase two of the UK government’s drive to push tax reporting online will direct electronic submission of VAT data to HMRC via an API link.

The European Court of Auditors is leading the charge on public sector digitisation of audit.

Its 2021-25 strategy, published in January, committed to new digital audit tools and techniques, including automated data collection and analysis to obtain secure and easy access to auditees’ data.

While very much a work in progress, that utopia will eventually include live data flows.

Despite having the incentives and ability to implement real-time financial audits, however, progress remains slow.

This, Hackett warns, is partly because many public sector organisations lack an adequate handle on their data in the first place.

“Data preparation is going to require significant work, and it may be too much to ask of very small government departments to spend the money and the time to get themselves ready.

It might be overkill, particularly for those at low risk,” Hackett says.

The skills that real-time audits would demand of auditors cannot be underestimated – not least the ability to avoid ‘paralysis by analysis’ and being overwhelmed by the huge amounts of information.

“That can actually cause problems with transparency and can make it difficult to see the wood for the trees,” Hackett says.


Five steps to help your organisation move towards a real-time auditing regime

Sort out your data

Data quality is still a significant issue. Make sure you do not have bad data coming in. Increasingly, the auditor is there to assess the outcomes of machine learning and investigate data quality by going into the system and checking whether the people putting the data into the system are doing that honestly and accurately. To automate the process in real time you need good data coming in and you need to be able to rely on the signals that are coming out.

Think about your IT

Managing data requires well designed processes and significant investment in technology, training and risk management. Without this, the ability to extract data, and then standardise it so it can be examined and organised using advanced analytics, is seriously impaired. Investment needs to be proportionate to the scale and nature of the organisation concerned.

Develop new skills

Brush up on your data literacy. Finance professionals do not need to become data analysts or statisticians, but they do need to understand some of the core concepts in a way that allows them to take action on the information they are being presented with.

Get political buy-in

Get senior stakeholders involved. You need buy-in, because getting people to invest in training and incorporating it into your wider governance processes requires effort and inclination.

Do a proof of concept

Pick the right project as a trial – ideally, something relevant to your organisation that can provide valuable insights. Setting up projects well, delivering value and conveying it is crucial to success. You cannot communicate enough about what the project is, what it does and why it is important.


Watch and wait

Striking a balance between being reactive and watching and waiting while trends emerge is another skill that auditors need to develop, Hackett says.

“With real-time data, there is a risk that whenever a number moves, people may fail to see the longer-term trends and attempt to get involved when they should leave things as they are. That requires confident management.”

Despite a general move towards more responsive information access, Hamid believes the political will to embrace real-time auditing is lacking and that cultural reticence continues to stall progress.

“If processes are still manual, quite often I think it is because people do not want to change rather than because they lack the capability,” he says.

“Civil servants are not lazy, they are just masters at avoiding accountability – and real-time auditing is ‘in your face’. But it should not be about what is convenient to produce, it should be about what benefits the taxpayer.”

“As auditors, we are in danger of being accepted for doing what we do, rather than really adding any value. The question is: how do we stay relevant?” – Khalid Hamid, CIPFA

The experience of the pandemic, however, has helped to overcome a lot of scepticism about accessing data remotely. It has also been a game changer for expectations about accessing insights into real-time performance data.

It is only a matter of time before those expectations spread to financial data too, experts believe.

At the same time, the circumstances imposed by Covid-19 are forcing finance operations and audit firms to step up, says Katie Canell, managing director, regulatory and audit product strategy, at consultancy firm Deloitte.

“Enforced remote working has accelerated the need for strong and secure collaboration platforms. The circumstances have shone a light on where controls need to be strengthened and where risks need to be reassessed.”

If the prospect of reducing financial loss through fraud and error is not enough of a driver, the promise of streamlined finance operations and the ability to free up finance team members to focus their efforts on more interesting aspects of their jobs is an important consideration.

“Learning to use analytics to make decisions is something people should find quite interesting, allowing them to break free of spreadsheet tyranny,” says Rachel Kirkham, director of audit at risk analytics firm MindBridge.

“I love Excel, but using newer, more useful analytic tools will improve the experience as much as it improves the business.”

A more fundamental and existential driver is also at play, Hamid believes.

“As auditors, we are in danger of being accepted for doing what we do, rather than really adding any value. We have built these very deliberate processes, but they are not agile enough. The question is, how do we stay relevant?”

Despite this, there is no sign yet that regulators are inclined to push public sector organisations towards financial audits in anything even close to real time.

“Innovative auditors are starting to provide real-time services for insight, but it will be 10 years before we see real-time financial audits,” Hackett predicts.

Peter Smithson, director of IT and digital audit at the UK’s National Audit Office, agrees that real-time data analytics will play an increasingly pivotal role in the delivery of audits: “In the long term, we have an ambition for efficiency, effectiveness and insight. Delivering greater quality and technology will have a huge role to play in that.”

In the meantime, security issues, a lack of standardised formats and technical challenges in processing and analysing data remain very real challenges.

Even when those issues are overcome, the belief that real-time data analytics is the answer to all of audit’s problems may be misplaced, warns Smithson.

“It will help us analyse populations of data,” he says, “but the problem of audits and why companies fail may still be there – because of fraud, because things are misvalued or misunderstood. Complex organisations are difficult to understand, and if you do not understand them, you cannot effectively audit them.”

Did you enjoy this article?

Related articles

Have your say

Newsletter

CIPFA latest

Most popular

Most commented

Events & webinars