|
PATTERN CHASER
Audit Analytics for Internal Audit in Financial Services
|
|
|
|
Your audit scorecard is rewarding the wrong thing.
Not because auditors are cutting corners. Because the system makes corners the rational choice.
|
|
Hey Reader 👋
Almost a year outside corporate.
And I'm finally seeing patterns I couldn't spot from the inside.
Here's the uncomfortable one.
For nearly a decade in audit analytics, I watched us optimise for the wrong outcome. I was doing it too.
In today's issue:
| ↳ |
Why audit teams reward speed when boards want depth |
|
| ↳ |
Three patterns I kept missing |
|
| ↳ |
Plus: a diagnostic to flag where time pressure is degrading your audit quality |
|
Examples in this newsletter are composites drawn from industry experience, peer conversations and published research. Not attributable to any single organisation.
|
|
|
DEEP DIVE
The Agent's Dilemma
Real estate agents sell their own homes for 3.7% more than their clients'.
They also wait 10 days longer on the market.
When their money is on the line, thoroughness stops being optional.
Audit functions run the same split incentive. Different money. Same psychology.
We're measured on plan completion. On time. On budget.
The board is buying thoroughness, insight and risk prevention. Those don't always agree. When they conflict, the metric wins.
Why this happens everywhere
After stepping back from execution, I started talking to audit leaders across sectors. The same stories kept surfacing.
|
"Procurement audits that flagged anomalies but didn't dig deeper. We need to wrap this up."
"Access reviews that defaulted to sampling instead of full population. We don't have capacity."
"Findings softened. The business needs time to respond and we're already over budget."
|
Different organisations. Different industries. Same trade-offs. Same metric driving them.
A 2021 study in Contemporary Accounting Research confirmed it. Workload compression is associated with lower audit quality. The pattern is not unique to external audit. It's the default in any function measured on delivery.
The three patterns I finally saw
|
|
Pattern 1
Routine work is consuming your best people.
In every function I've seen, senior auditors spend significant time rebuilding work programmes for recurring audits. Maybe 30% need bespoke design. The other 70% are repeatable risks we keep treating like snowflakes.
The fix
| ↳ |
Build standardised, tech-enabled programmes for the top 8-10 recurring audit types |
|
| ↳ |
Not rigid checklists. Frameworks with built-in flexibility |
|
| ↳ |
Free your seniors for the work that actually needs their judgement |
|
|
|
|
Pattern 2
Quality gates are in the wrong place.
The default model: a thorough review at the end of fieldwork. By then, change is expensive. If scoping was wrong, you're choosing between extending the audit or accepting the gap. Timeline usually wins.
The fix
| ↳ |
Move challenger sessions to before detailed testing begins |
|
| ↳ |
A small group of independent seniors stress-tests the risk assessment and testing strategy |
|
| ↳ |
Catch flawed assumptions while changes are still cheap |
|
Quality gates at the end are damage control. Quality gates at the start are prevention.
|
|
|
Pattern 3
Analytics is a bottleneck, not a baseline.
Most functions hire analytics specialists. The unintended consequence: everyone else treats analytics as "something the analytics team does." Audits without analytics support simply skip it.
One example. An auditor with no data science background filtered access logs by weekend activity. Spotted a finance user logging in at 6am every Sunday for three months. An automated report. Live credentials. Edit rights it didn't need. No model found it. A simple time filter did.
The fix
| ↳ |
Build analytics as a baseline competency, not a specialist function |
|
| ↳ |
Every auditor should run a frequency distribution and spot outliers in a pivot table |
|
| ↳ |
Know when to escalate to specialists. When analytics is routine, quality gets faster. |
|
|
|
|
We didn't get into audit to tick boxes on time.
We got in because we wanted to protect value. Spot risk. Make organisations better.
The system broke that promise. It turned thoroughness into a luxury and speed into a virtue.
The system isn't permanent.
|
Where are you in this? Hit reply. Or if you'd rather see it in data first, the Audit Quality Diagnostic surfaces exactly which of these three patterns is costing your function most. Nine questions. Five minutes.
|
|
|
WHAT'S POSSIBLE
Audit Opinion Validation
Every year your function issues dozens of clean opinions. Satisfactory. No significant findings. Board-level assurance.
How many were right?
You don't know. Nobody does. The opinion gets filed, the area moves on. Whether a control failure or regulatory finding lands six months later, that data lives in a completely separate system. It has never been connected back to the audit that declared everything fine.
NLP changes that. Match audit findings text against subsequent incident reports, risk events and regulatory observations, across business area, process and time window. A classification model then scores every historic clean opinion against what actually happened in the 18 months that followed.
A model trained on the organisation's own data (audit reports, incidents, risk events) over three to five years generates enough domain-specific signal to be diagnostic. Not perfect. Directionally accurate.
The output: a ranked table by team and audit type, sorted by false negative rate. Which areas you consistently called clean that later failed. Which teams' opinions hold up. Most revealing: whether your fastest audits produce materially worse outcomes than your slower ones at the same risk rating.
That scatter plot is the conversation your audit committee has never been able to have.
Because until now, you had no way to measure the thing that actually matters.
|
|
THAT'S A WRAP
3 Ways I Can Help
|
1
|
The Analytics Reality Check
|
15 minutes. No preparation needed. No commitment after. Find out exactly where your function stands.
Book the call
|
|
2
|
The Audit Analytics Programme
|
For Heads of Internal Audit ready to build what their board expects. 6 weeks. Structured. Built from 9 years at FTSE 100 level.
Join the Waitlist
|
|
A senior peer in your corner. Two sessions a month, async access for decisions that can't wait. Maximum 3 clients.
Join the Waitlist
|
|
|
|
BEST LINKS
Worth your time.
|
🔍 THE PATTERN
The Four Flavours of Goodhart's Law. "When a measure becomes a target, it ceases to be a good measure." Written in 1975, it describes your audit scorecard problem exactly, and explains why the fix is harder than changing the metric.
|
|
📊 THE PROOF
The More You Measure, the More They Will Game You. Empirical research across sectors showing that expanding what you measure doesn't improve performance. It improves the appearance of performance. The measurement becomes the problem.
|
|
🗞️ WHERE IT'S HEADING
The Anthropic Institute Research Agenda. "Whether a 3-person team can now do what required 300 before." Anthropic just published what they're studying: how AI changes work, who benefits, what breaks. Internal audit functions should be asking the same questions about their own transformation. Before someone else does.
|
|
|
|
SHARE
Know a colleague who'd find this useful? Send it on.
|
|
See you next week,
Tony Abraham
Data Science & AI for Internal Audit
|
|
How did you like today's issue?
|
|
|