For Extracting Data from a Source

• Monarch – Desktop software used to extract data from printed report files produced by legacy systems (i.e. print-image format) and convert it into tabular data for use by ACL, Excel, or some other database.
• SQL Bulk Copy Class – This is a Microsoft-provided .NET class that is used to import large recordsets into Microsoft SQL Server.  It is especially useful if the auditor needs to perform intensive data quality validations or apply business logic to the import process (doing so during import can cut down the processing time for large datasets).  The latest version is included with regular releases of the Microsoft .NET framework.  You can download a free desktop edition of Microsoft SQL Server Express and the bulk copy class which is robust enough for most small/medium ACL projects.
• Cron+scripts — Cron is the Unix scheduler service (similar to Windows Scheduler) that executes jobs on a regular basis.  Scripts are small computer programs written in a scripting language.  Basically, you write a script using the scripting language of your choice and execute it on a recurring basis using Cron.  ACL (Audit-Command LANGUAGE) is one such scripting language but others more frequently used in IT include PHP, Perl, Ruby, AppleScript, etc.  The Cron+scripts approach is a good one if you plan to be performing recurring extracts of data and applying your testing to them in an automated fashion.  Scripts are very extensible, so if you have to do complex sorts, queries, or combine data from multiple sources into one consolidated dataset, the Cron+script approach might be best for you.  Cron, like most Unix implementations is open-source as are most scripting languages.

For Analyzing Data

• Microsoft Access/Excel – Although Microsoft applications sometimes get a bad rap from ACL folk, they can be very useful in data analysis.  Access is the Microsoft desktop database and can perform joins between tables, sort, filter, and print reports.  Access 2007 makes some of these tasks fun with the new ribbon toolbar.  Excel is the spreadsheet of choice among business users and it does have some handy statistical tools as well.  Both solutions are better geared for smaller datasets (i.e. those less than 65k records), though the Office 2007 set does provide some capacity for larger datasets — though you might suffer a performance penalty if you use these tools for big data.
• SAS/SPSS/MiniTab — These three statistics packages are designed for hardcore statisticians, though SPSS is a little more geared for the liberal arts / social sciences mindset as it has tools for these professions built into the GUI.  SAS is a scripting engine that can be used in a Cron+scripting solution and it is geared for massive datasets, though the language can be a little esoteric — as any research graduate student can attest.  MiniTab is the favorite desktop statistics application among the Six Sigma elite and is commonly found among engineers.
• Caseware IDEA — This is a competitor to ACL in the desktop audit analytics space.  Like ACL, IDEA has a desktop client that auditors can use to sort/filter/join data and apply test results.  The server edition competes with ACL AuditExchange and provides workgroup access controls and shared data/test repositories.

For Printing Data Reports

• Crystal Reports — This is popular desktop reporting application that takes datasets large and small and renders them to paper or PDF printed reports.  Crystal Reports has features to sort, filter, and group data, and calculate subtotals.  Crystal Reports also has a powerful cross-tab reporting feature.  In the past ACL has used Crystal Reports to print ACL datasets, but the software can be connected to most commercial datasources from basic Excel spreadsheets to complex SAS data cubes.
• Adobe In-Design/In-Copy — Adobe In-Design and Adobe In-Copy are “sister applications” used in the publishing industry to render high-quality, graphical reports and layouts.  Variable Data Publishing (VDP) is a practice in marketing to tie professionally-produced report templates (i.e. company financial statements, glossy audit reports, direct mail advertisements) to data in databases and render print-ready materials.  Auditors can create In-Design templates for their reports and put XML placeholders in the pages for their audit test results.  Then they can match the template to the data file and produce a printed report.  It’s sort of like mail-merge on steroids.  Adobe In-Copy is used to change the text of In-Design pages without modifying the structure and could be used to reduce the amount of time it takes to prepare a printed report.

Of course, these are just a few applications that come to mind.  You can add your own in the comments box below.

Should Internal Audit teams create specialty data analytics groups to do all analytics work or should they cross-train their audit “generalists” to use analytics tools?

In favor of the specialty data analytics group -

• Highly-skilled data analytics professionals can be leveraged to perform all analytics tasks
• Less-skilled audit “generalists” can focus on executing audits and relying on analytics professionals  work product
• Lower expenses to implement audit analytics (i.e. software licensing fees, hardware) as fewer staff need to have the costly software or computer hardware to perform the tasks

In favor of cross-training all auditors to use analytics tools -

• High turnover in audit departments leads to shortage of skills and raises the risk that the ACL “gurus” may leave the group.
• Develops new skills among audit generalist to take on complex analytics tasks which will help them when they rotate into the business
• Greater acceptance of the value of analytics to the organization as more people become experienced in performing data analysis and using the result

Again, feel free to comment on this topic.

• Send new users to training courses sponsored by ACL or other vendors.
• Holding in-house ACL workshops
• Rotating individuals into an ACL job function for 3-months or more.

Feel free to comment on this posting if you have some suggestions on how to tackle ACL training effectively.

• How do we articulate the value of spending resources gathering data to perform audit analytics?
• Which individuals in our organizations do we need to get “buy-in”?
• How do we manage the change in our audit culture to adapt to audit analytics and make it a part of our daily processes?

Feel free to comment on this posting if you have some suggestions on how best to articulate the audit analytics value proposition.