Is Automated Internal Auditing Possible?

[Mark Meer]

Automation seems to be in the news a lot these days, and so I've been musing for some time about the possibility of developing an (electronic) system that could automate certain internal audit activities.

Assuming that:

1. All documents and records are created & maintained digitally, with all record field data in a database, and document contents tagged with meta-data.
2. A system to specify "requirements" for documents/records of a given category with well-defined pass/fail criteria.

couldn't one develop a script that, according to a specified schedule, samples documents/records (according to some established sampling rules) and checks if the applicable requirements are met, and then generates a report?

I realize that this is only a subset of what internal auditing entails, but it seems like a viable way to streamline the process...

Wouldn't surprise me if such software already exists...
(Robots taking our jobs!! :mg:)

 

[randomname]

Re: Automated internal auditing - is it possible?

The simple answer is Yes. Financial auditors have been using automated/continual audits for a long time. However, it does require either embedding the logic into business process application software, and/or using special software designed for extracting data and analyzing it (I think ACL and IDEA are a couple of the more widely used).

An example might be comparing a matrix of who is qualified to perform a particular task to who is signed into an application that is performing that task. Is it a qualified person or not?

 

[yodon]

I don't know... I consider (quality system) auditing as much an art as anything. Doing the examinations / witnessing activities personally often leads to follow-on questions that wouldn't be asked if the software (automation) was just checking off boxes. And it's usually those follow-on questions that reveal the issues (not the presence of required materials).

 

[Duke Okes]

It's not that automated/computerized audits will replace physical/in-person audits, but that the computerized audits can help detect whether or not it is likely worthwhile to do the physical audit. Doing a risk assessment to decide where to do an audit.

 

[randomname]

Computerized/automated audits can shift our time from the more mundane audit activities to the higher risk/value ones. Better use of our audit time.

Here's an article I recently published in a similar vein:

https://www.theauditoronline.com/analytics-for-auditors/

We have to continually improve both the effectiveness and efficiency of audits, and computerizing some portion of them is a no brainer when it can be done.

Doesn't mean that face-to-face audits, and/or random sampling of processes will go away, but that when F2F and/or process sampling is done it is more likely to be done based on some data that indicates it's worthwhile.

 

[Mark Meer]

I don't know... I consider (quality system) auditing as much an art as anything. Doing the examinations / witnessing activities personally often leads to follow-on questions that wouldn't be asked if the software (automation) was just checking off boxes. And it's usually those follow-on questions that reveal the issues (not the presence of required materials).

Yes, things like personnel interviews, equipment/facility inspection, etc. are obviously a long way from automation and I, like you, am dubious if these could EVER be automated.

But the point remains that there are a lot of tasks (e.g. certain documentation inspections) that can have pretty clear-cut requirements, and hence conceivably make the auditing process automated if all pertinent data is digital.

Computerized/automated audits can shift our time from the more mundane audit activities to the higher risk/value ones. Better use of our audit time.

I must say that I'm pleasantly surprised by the responses here that support the concept of automating auditing processes.
I would have thought that there'd be a lot of resistance to the idea of automation...

 

[randomname]

Just be aware that there is likely to be some heavy up-front investment of time to build the scripts/queries, but once it's been done they can be run over and over at very minimal cost.

 

[RoxaneB]

Never say never. Once upon a time, the idea of flying machines was impossible...as was finding a way beat some harmful diseases...as was speaking with someone in real time over wires or signals...as was walking on the moon.

Yes, there are "human" components to an audit that go beyond a mere checklist, yet artificial intelligence is expanding to the point of learning how to read us and learn.

 

[bigqman]

Technologically possible someday no doubt, but in 2017 A.D. the 9001 Standard, for instance, says the organization shall do the audit.

Organization = person or group of people in 9000:2015.

No doubt technological changes and contact with extra-terrestrials will cause another revision to include audit automation and use of tachyon crystals.

 

[Mark Meer]

Never say never.
...
Yes, there are "human" components to an audit that go beyond a mere checklist, yet artificial intelligence is expanding to the point of learning how to read us and learn.

Point taken. I withdraw my incredulity at the possibility of fully automated internal auditors.

That being said, I think we're a LONG way off from machines interviewing people or inspecting facilities. So far off, in fact, that when/if the day comes, I suspect that the entire framework of industry, production, and auditing will have changed so much speculating based on our current frame of reference is meaningless.

I appreciate your optimism for human ingenuity though! We can agree on that!
...even if it might mean engineering our own obsolescence!