Get the most out of audit tools: several practitioners share their approaches to maximizing the potential of automated tools. Plus, respondents to Internal Auditor's 10th annual product and usage survey reveal their top software picks

Internal Auditor, August, 2004 by Russell A. Jackson

AS SOFTWARE BECOMES MORE AND MORE INTEGRAL TO AUDIT departments, managers are responding to the evolution of available products and the services they can perform by maximizing what they buy and what the software does when it's installed. Today's departments face an abundance of options, with products ranging from data analysis and fraud detection software to tools that facilitate network security analysis and compliance with the U.S. Sarbanes-Oxley Act of 2002. Finding the best way to equip the audit staff, however, and accomplishing this within budget parameters, can be a difficult task. * The growing sophistication of technology, and the way it's being used, requires experts to teach and students to learn. And that's another area where audit departments face increased challenges. There are more and more training options for auditors to choose from--along with more products and services, a wider array of software available from less-traditional sources, and an expanding range of costs involved. And auditors are finding new ways to mix and match software functions to create customized audit applications that can do exactly what an individual department needs.

[ILLUSTRATION OMITTED]

Many of these issues reflect the state of affairs illustrated by Internal Auditor's 10th annual software survey. Consistent with its predecessors, this year's survey reveals three key issues that make finding and implementing audit software particularly difficult. For example, respondents always list cost as a chief concern. Too often, they say, their departments can't get what they need because they just don't have the resources. Another common complaint is the difficulty in securing tools to meet the audit departments' specific needs--this year's No. 1 software-related concern. And finally, developing effective and innovative software training programs for corporate audit departments has consistently been cited as a challenging, if not daunting, task.

[ILLUSTRATION OMITTED]

To demonstrate how some practitioners are dealing with software challenges, several auditors--each of whom has encountered one of the top-cited concerns from the survey--explain in the coming pages how they've met these difficulties head on. Their stories reveal how some companies are succeeding in making the most of their audit tools. In addition, the accounts are interspersed with results from Internal Auditor's 2004 software poll, where respondents collectively sound off on which tools they use, how they use them, and how satisfied they are with their software's performance.

[GRAPHIC OMITTED]

[GRAPHIC OMITTED]

A STAGED APPROACH TO TRAINING

The best software ever devised won't do an audit department any good if staffers don't know how to use it. But training is often time-consuming and difficult, taking up department managers' time and companies' financial and human resources. Is there a clearer path through the woods? Richard B. Lanza, an audit manager for a Fortune 200 retailer and founder of AuditSoftware.net, a Web site that advises auditors about using audit tools, advocates a step-by-step approach for especially complicated software and a quicker, easier approach for simpler-to-use products.

[GRAPHIC OMITTED]

[GRAPHIC OMITTED]

[GRAPHIC OMITTED]

[GRAPHIC OMITTED]

TEACHING COMPLEX MATERIAL Lanza says he's learned through his extensive experience in the field that a measured approach to training works best when what's being taught is particularly detailed or difficult to intuit, such as data analysis packages, where staffers need to learn about dense functionality. "Some of those programs," he points out, "are basically freeform data query tools. They don't really provide any guidance for users."

[GRAPHIC OMITTED]

Lanza notes that, although such programs are simple to open, they can be complex to run. "For such complicated products," he says, "what I've learned is to do one- to two-hour training sessions once a week, supplemented with on-the-job exercises participants can complete on their own. Those exercises have to be practical as much as possible, and there should be some sort of feedback mechanism for questions and additional direction."

[ILLUSTRATION OMITTED]

Such a training program, he adds, may need to run for as long as six months. And, he advises, it should start with the basics. "For the more challenging software, I suggest building up the training plan from general concepts like 'why we're even using this product' to 'how to use it' and then to more advanced topics over time."

[GRAPHIC OMITTED]

Lanza also suggests maintaining a Web site that provides information on what was done in the last training session and what will be covered in upcoming sessions. The Web site can also link to a message board, where participants can post questions and everyone can collaborate on the answers. "They don't have to ask for last week's information," he explains, "which saves the trainer's and the students' time." Although message board vendors charge a monthly fee, it's usually minimal, he adds.