As businesses increasingly focus on big data and more complex systems, the pressure is mounting on the auditing industry to produce the necessary skills and rethink its standards, writes Bilal Vallee, IT audit manager at Mazars.
The capability of businesses to capture and communicate data digitally on an unprecedented scale has resulted in an increasing focus on data in both day-to-day transactions and financial statements. As a result, many companies are changing their business models in innovative ways in response to these developments.
With data analytics becoming more and more important in order to accurately audit businesses, the audit landscape is also rapidly changing. The auditor is increasingly expected to gather evidence from the analysis of much larger populations, requiring increased use of data analytics and the specialist skills of IT auditors. But while the demand for IT auditors is growing, the industry seems to be slow to respond.
With the audit profession having remained largely unchanged for so many years, it is justifiably challenging to get firms to shift from the traditional model to something that requires a whole new skillset. But now is the time for auditing firms to make a change, or risk being left behind.
The slow growth of IT auditing skills in the industry can partly be attributed to the fact that the International Standards of Auditing (ISA) at present do not reference the use of data analytics in the auditing process, beyond mention of traditional CAATs. While advanced IT auditing techniques are not prohibited by the ISAs, this lack of reference may be viewed as a barrier to their adoption more broadly.
However, a draft exposure for changes in the ISAs to incorporate an IT audit approach has recently been published for comment. For us, this signals a significant change in the industry likely on the way within the next two to three years.
This leaves us with the second major barrier, which is the training of financial auditors. The investment in re-training and re-skilling auditors, which over time have acquired knowledge, skills and experience in traditional ways of auditing, is an expensive and time consuming process.
New recruits are equally challenging. The typical auditor that enters the market as a new graduate right now has some knowledge of IT audit techniques, but is still far from adequate. Dedicated IT auditing skills are also not actively taught at universities, which leaves the responsibility to auditing firms like ours to grow those expertise.
It is an expensive process and getting IT auditors to pass the international exam accreditation is a challenge on its own. There is also a time component, as the auditor is required to gain a further three years’ worth of experience before he is certified as a registered IT auditor.
After that, skills retention remains an ongoing issue, as IT auditors get snatched up by other firms as soon as they qualify. But the notion that companies can rely on these skills to be available for the right price, is not sustainable.
The fact of the matter is that the auditing industry is likely to be a vastly different landscape within a few short years, and more audit firms and educational institutions will need to put IT audit training programs in place to fill the massive skills gap that is forming.
