The impact of technological advancement in the audit

Introduction

Organizations are changing. Information technology is increasingly being used to digitize existing business processes or create entirely new business models. What most of these organizations have in common is that they either are required to, or voluntarily, publish their financial statements. Auditors are required to verify the reliability of these statements, by performing procedures as prescribed by laws and regulations. While there have been great innovations in the way these audit procedures are performed, these were mostly focused on efficiency or convenience. Audit procedures are automated or outsourced to minimize the effort required to comply with these laws and regulations. Technology is still underutilized in increasing the insights provided by an audit or enriching the client experience. Recently, this began to change. Businesses are expecting more from their auditors, which is leading to changes in the way audits are performed, and the way the results of the audit are presented. In this article, we will look at the digitalization of business process using (ERP) technology, the state of auditing this technology, and future developments for further digitizing the audit.

Digitizing business processes and the audit

Why is technology becoming more relevant in the audit?

The information technology used in business processes is always evolving but changes significantly with new breakthroughs. The most recent development with a major impact related to the way processes are defined is the increasing availability of cloud services, including cloud-based ERP systems. Cloud ERP systems are standardizing business process and are becoming easier to use. Furthermore, the costs of using technology for business processes are declining, because the high costs of IT infrastructure and maintenance are shared through using cloud services.

This has made the use of technology available for smaller organizations, that might otherwise not have the resources to do so. It also allows small organizations to digitize their operations and shift from manual operations and controls to digital/automated operations and controls. With more organizations undergoing this digital transformation, it is becoming increasingly relevant to include the technology used as part of the audit procedures. The use of the cloud and cloud services might also introduce new IT risks which organizations need to address and should get attention during the audit, examples are the security of the cloud and data privacy.

Figure 1. Innovation trends ([KPMG20]). [Click on the image for a larger image]

Additionally, KPMG surveys on innovation trends indicate that 37% of organizations had innovation as a top priority during 2020, and 55% indicate that innovation is a top priority going forward. Therefore, we can expect more clients to start implementing emerging technologies such as continuous integration/deployment, Datalakes, Artificial Intelligence and Machine Learning, and integrating these technologies into core business processes. This will further increase the relevance of technology within the audit.

How is technology applied in audits today?

In modern audits, technology is becoming more incorporated into the way of working. Early innovations were mostly focused on convenience, such as automating complex sampling methods or tracking progress using bots. This line of innovation continued with more standard audit procedures being automated or being increasingly supported using tooling.

These innovations are mainly focused on increasing the efficiency of the work performed by the auditor. They add little value to the audit client, who might be completely unaware that these innovative solutions are being used during their audit. With increasing competition between audit firms, a shift is happening from applying technology to internal processes, to including the audit client in the technological journey of innovating on the audit. This shift in approach means that audit firms need to rethink the types of innovations being developed, and the way they are used in collaboration with the client.

The audit of the future

What automation is available today?

The shift in focus from innovating audit procedures, to including the audit client in new audit innovations has led to several new innovations becoming available where audit clients can directly interact with the technology used in the audit or are presented with the results from our audit automation. An example of this are collaboration portals. Collaboration portals create an environment where both auditors and the audit clients can work together during the audit process. By using these tools both the auditor and audit client can see what information has been requested, and of what employees. This ensures that both parties are aware and aligned of the progress made.

To gain a better understanding of processes, and how information flows through the organization data, analytics can be used to follow accounting records through the organization’s business processes. This can be performed as an audit procedure to verify that all information is part of the financial statements. Another approach is to use process mining which uses the data to model how the processes of the client actually work. By comparing the model to the flowchart created during the audit walkthrough it is possible to verify that client processes are working as designed.

Dashboarding is used more frequently to present the insights gained from other innovations. By presenting information on audit results or progress in a concise, and visually appealing dashboard, the audit client can be better motivated to take action. This can be done either by supporting the audit progress to prevent delays, or improving certain aspects of their business based on audit results.

What new audit innovations are on the horizon?

The increase in use of (Cloud based) ERP systems is increasing the volume of data available at clients, as well as improving the data quality as it is contained in a single system. This will enable the development and use of more audit tooling that use this data as input.

One of the terms frequently used when talking about the future of auditing is Continuous Monitoring and Continuous Auditing (CM/CA). This is an initiative that would move away from the auditor just reporting their findings on internal controls once a year during their interim procedures. The ideal situation: report findings or non-compliance with existing procedures as they are happening. To realize this, a large degree of automation needs to be implemented at the audit client so that (the auditor’s) monitoring tools can detect non-compliance as it is happening. This, combined with the complexity of connecting several audit client systems with the auditor’s tooling, makes it difficult to implement.

However, the first steps towards CM/CA have been made by creating technology for the automation of audit procedures. KPMG is currently rolling out several initiatives for automated testing of the audit clients internal controls. The first of these initiatives is a solution for automated testing of General IT Controls (GITC) within a SAP (ECC/S4) environment. The solution Sapphire allows for automated testing of controls based on standard reports generated from the audit client’s system. By combining this with automated data extracting tools, it becomes possible to frequently export the required data from the audit client’s systems and have a solution like Sapphire provide the results for GITC testing.

The second solution takes a different approach to automation, focusing on providing incremental innovations on a large scale. KPMG’s Intelligent Platform for Automation (IPA) is a platform that can be used to host bots that are designed using a variety of coding languages or low-code tools. The bots from the platform are available globally so that auditors from all over the world can collaborate in designing new automated bots. After quality review, these bots can then be used on audits all over the world in local audits. The main benefit of the platform is that it also encourages the development and sharing of smaller scale innovations such as automating individual audit procedures or providing new insights to the client, such as cash proofing, three-way matching or dashboarding audit results.

Lastly, more insight can be provided to the client by comparing the results of the audit with external information, such as benchmarking. By standardizing reporting based on the above solutions it becomes possible to create an (industry) benchmark. This benchmark can reach beyond simple financial information to internal control, or process efficiency. By comparing the results of an audit with this benchmark, the client can gain new insights into their competitive position compared to other organizations within the same industry.

What are the challenges when realizing the audit of the future?

To realize the audit of the future, we need to overcome a number of challenges. The first is to bridge the gap between the new way of auditing and existing auditing standards. There is one aspect of the audit that cannot be automated, and that is the judgement of the auditor. The reality of business processes is that deviations will occur, either because a certain transaction doesn’t fit within the defined processes or because disruptions in the technology led to disruptions to the business processes. When these deviations occur, or when they do not, it remains by audit standards the responsibility of a human auditor to provide judgement. To realize more automated audits, this gap between audit tools and standards needs to be bridged. As audit automation takes flight, this will likely to be an often-discussed topic between auditors and accounting oversight boards.

The second challenge is of a very practical nature. Creating tools to automate auditing requires a significant upfront investment and will likely not yield profit until several years of operation. This is less of an issue when auditing organizations use widely used off-the-shelf systems, as the cost of development can be shared across several audit engagements that involve the same system. This issue can be partially solved using low-code development, which typically requires less time and investment to create a piece of automation. Combined with code/bot sharing platforms such as IPA, this allows for more efficient smaller pieces of automation for organizations that have more unique systems.

Finally, there are many technical challenges to overcome related to data integrity and ensuring that the results of the automated procedures produce consistent quality results. The audit of the future therefore requires an auditor of the future. The current skill set of accounting knowledge needs to be supplemented with some form of data analytics or coding skills for the auditor to automate their more routine work and ensure its reliability. This can be accomplished by teaching auditors a coding language such as SQL or Python or implementing low-code tools such as Alteryx or Disco that are more beginner friendly.

Conclusion

New innovations and emerging technologies are increasing the relevance of auditing technology within financial statement audits. On the other side, client expectations are driving auditors to become more innovative within the audit, requiring the use of these same innovations and technologies. This still has its challenges due to external regulations, upfront costs, and changing skillset requirements. However, we are already seeing the impact with positive feedback from clients where we are using (or proposing to use) new technology within the audit.