GERMANY: Data analysis - challenges, tools and future trends in auditing ERP systems
Analysing data has become more and more important to support audit work. With an increasing number of authorities using IT systems in a wide range of applications, these systems have to be audited.
Against this background, the German SAI has adopted a risk-based approach using different data analysis tools and strategies to tackle a variety of challenges in auditing ERP systems. While the audited entities differ from each other, specific fields of data analysis can be identified which arise frequently. These will be of high importance in future audit work.
The German SAI is facing an increasing need for data analysis, which allows the auditor to gain a very specific knowledge of the entity and the processes under audit. In our experience, data analysis also enhances opportunities to derive our audit opinion and support the audit findings. One of our strategies is to fully analyse the data of ERP systems used by the authorities to administer public funds. We perform sophisticated and comprehensive data analysis to estimate the potential risks contained in these systems.
When it comes to data analysis tools, we developed a solution that allows us to be flexible and to automate audit procedures. We make use of a bunch of data analysis tools - from generally usable tools like Microsoft Excel to highly specialized applications like Tableau for analysing and visualizing big amounts of data.
Right from the start we identified the requirement to preprocess relevant data. In this stage, we also categorize, cluster, filter and visualize the data. This can be done, for example, with descriptive statistics, graphs, dashboards, or (pivot) tables. In a further step, we use more advanced analytical methods. One challenge we frequently face is analysing data in which each data point reflects a certain step in a process under audit by using process mining techniques. Imagine a simple procurement system in which one step could be checking a bill, another step could be making the payment. Figure 1 illustrates a simple example of a procurement process.
Figure 1 Example process (only stylized)
Although the structure of the exported data differs from system to system, the challenge is always the same: What use can be made of these data? The answer to this is quite simple: The analysis steps and technologies used for process mining depend on the auditor and the audit scope. A first step could be to simply visualize the workflow by drawing it manually, and to count the occurrences of this specific process in the data in a second step. Subsequently, the data could be analysed to identify and examine cases, which do not comply with the specified workflow. Another approach could be to extract all potential workflows out of the data without knowing them in advance and count the occurrences of each type. For these more advanced tasks, we have begun to use Python and are now enlarging our skills to cope with future challenges. We expect that open source technologies like Python will become ever more important.
