The great audit software talent search

By Richard B. Lanza, CPA/CITP, CFE, PMP & Dean Brooks

Has audit software fulfilled its potential? Is it changing the audit landscape? The answer depends on how you approach the question.

Surveys have shown since the late 1990s that most organizations-in some cases as many as 98 percent-report using software for data analys is , work management, continuous monitoring, fraud detection, and other tasks. Major audit - software vendors claim to have hundreds of thousands of users worldwide.

Product choices are multiplying at a dramatic pace. Two decades ago, audit software was a cottage industry. Most vendors were small shops set up by accountants and audit ors, and many products had no more than one or two competitors, if any. Today, fields like SOX compliance are crowded and highly competitive. Half of all vendors identified in the 2005 Buyer's Guide for Audit , Anti-Fraud, and Assurance Software launched new products since 2002. New entrants are often backed by venture capital, and development of the market is characterized by aggressive marketing activity as well frequent acqu is itions and mergers. In dollar terms, sales appear to be r is ing again after a lull in 2000-2001.

This all suggests that things are going well in audit software .

The ongoing shortage of skilled users

However, the numbers are weaker than they look, on several counts. Th is is not yet a mature market, and may never be mature in the sense that many other software markets are. We believe there are two key facts that must be kept in mind when looking at the use of audit software .

1. There are never enough strong users to go around. Shortage of talent, not software , determines how the work gets done. In our experience, a handful of power users may be the only ones making regular use of the tools in a particular shop-following what we call the 5/50 rule, 5 percent of users do half the automated audit work.
2. Despite their power, very few specialized audit software products are a professional 'must-have'. The only tools that are must-have for all internal audit ors (or for external audit ors, or fraud examiners) are those that are basic to all business, such as spreadsheets, Web browsers, and word processing. None that we know of are unique to audit .

Our claim that the profession relies on a handful of strong software users, but not on software as such, may strike some readers as surpr is ing. It shouldn't. Similarly skewed patterns prevail in other professions, and organizations have adapted to deal with them. In sales, consulting, real estate or insurance, a handful of outstanding performers tend to capture most of the business, and for every star there are numerous part-timers and short-timers. To be successful, firms in these fields have no choice but to focus on attracting and keeping top talent. That was true before the Web or even the PC.

Let's take a closer look by application type:

For risk management and SOX compliance tools , which are essentially large databases, the skill level required to simply enter data is not especially high. However, managing such projects involves dealing with data conversion and cleansing, sampling, and routine analysis of thousands of control items. Success requires careful design of the data structure by someone with experience in the field, so that thousands of individual controls can be entered and maintained. Many companies-even those with several highly skilled users on staff-tend to start with vast numbers of ad hoc spreadsheets and try to shoehorn them into an inflexible proprietary application without proper planning. We know of numerous cases where companies simply abandoned such software because the data as entered was largely useless and reorganizing the process to fit the tool was beyond their capacity. A handful of skilled users may not be enough to overcome the logistical difficulties, and as a result, genuine automation stays out of reach.

There are other issues holding back automation of SOX and risk management, of course. Some blame the tools themselves as being too rigid. Many companies prefer not to be the first to buy unproven technology, and there is widespread skepticism about whether regulatory requirements will be reduced in coming years. However, these factors only tend to mask the underlying shortage of skills. If they went away, implementation would still be a major challenge. One leading vendor in this area remarked to us privately that "not one client uses our product properly".

The picture is equally troubling for specialized data analysis and continuous monitoring tools. Here is a simple comparison: it is estimated that there are more than 1 million Java programmers around the world. Tens of thousands of job ads for Java developers appear in the UK each year alone. There cannot be many organizations-in business or government-that need software but would not also benefit from automated audit techniques. Yet based on book sales, attendance at classes, and d is cussions with insiders, we estimate the number of worldwide users of ACL or IDEA or other audit data analysis packages who can write a script in those languages as somewhere between a few hundred and a few thousand.

If you have no one on staff who understands the sort of analysis that ACL or IDEA does, then implementing continuous monitoring or fraud detection routines is likely to be a frustrating, even futile enterprise. Thoroughly understanding your data is not optional.

The ubiquity of consultants

If skilled users are so scarce, how does the work get done? A substantial proportion of what remains is contracted out. The fact is that even today, although the number of vendors in the audit software market has doubled in recent years, there are still more consulting firms specializing in payables recovery alone than there are selling dedicated audit software tools of all kinds. Add in the consulting firms specializing in telecommunications audit s, or healthcare audit s, or SOX software implementation, and such organizations number in the hundreds.

These are all areas where the main task is data analys is , and once it is set up, the software does the actual work -in other words, areas where increasing automation ought to greatly empower the client. Yet so far it hasn't. A high proportion of all audit software power users are doing consulting work in some form. From what we can tell, worldwide revenue from audit consulting in this area remains far larger than audit software sales. More money is spent finding someone from outside who can run audit software than on audit software itself.

Consulting stays profitable (and necessary) because talent, and not software , is the primary driving force for success. In researching the 2005 Buyer's Guide for Audit , Anti-Fraud, and Assurance Software , we confirmed that many firms now offering audit software started out as consulting firms. In virtually every case, consulting remains their primary source of revenue. That fact alone speaks volumes. Why create a tool that will make your services unnecessary-unless you know from long experience that it won't?

Even more incredible, we know of consulting firms (we are thinking particularly of payables recovery work here) that do not themselves use software. Their methods are virtually unchanged from what prevailed in the mid-1980s. These firms would hardly be competitive if there was not a global shortage of skilled software users.

Our reluctant conclusion is that the audit software market is not mature yet. Personally, we have great enthusiasm about audit software . Software is a professional necessity to those with the right skills. It ra is es productivity enormously, and there are many specific tasks that can not be completed without it. Modern enterpr is es generate millions of transactions, and these can not be reviewed manually.

Where the implementation challenge is hardest

Let us agree that more automation is definitely better. Large organizations and small ones will have to make better use of software in future. The percentage of audit ors who use specialized audit tools every day will need to r is e. The problem is dealing with the scarcity of talent in the meantime.

Large organizations have the easiest time of it. They tend to approach implementing audit software as a 'top-down' process similar to other IT initiatives. At th is point most large organizations of 20+ audit ors will likely include one or more competent leaders and mentors in the use of data analys is or fraud detection tools, and will have in place some kind of basic policy on automating work management or continuous monitoring. The level of active use by the rest of the department is in one sense a simple matter of policy-the organization is free to choose its own course. Some departments are rigorous in committing to automation, rolling out the tool to every staff member, training them, and making software skills a requirement of everyone's job. Others do less.

The problem comes into sharp focus when we look at small and medium-sized businesses, banks, regional governments and smaller municipalities, and smaller CPA firms. These organizations often can not think in terms of a top-down IT-style plan, even if their IT resources are good. They tend to have only a handful of audit professionals on staff, perhaps just one. Most still tend not to have any kind of dedicated analys is or fraud detection software , or anyone on staff actively using it. As a result, thousands of smaller organizations lag far behind the state of the art. The overall proportion of audit ors with strong software skills in these organizations is n't necessarily lower than in bigger firms-we think it is still about 5 percent-but where 5 percent is enough to guarantee every large firm at least one strong user, here the same proportion results in most groups not having any.

What to do now

What the profession needs is for the 5 percent of auditors with strong software skills to become 15 percent, or 25 percent. This is not something that any one group can fix-employers, software vendors, consultants, professional associations, and schools all must contribute. The culture of audit is gradually changing, and it will change more quickly once the problem is fully recognized.

In the meantime, individual audit organizations have to ensure that they find and retain 'power users' who can keep them moving forward. Just as important, they have to work on finding productivity improvements that do not require such high skill levels. We have identified a simple process almost any organization can adopt:

• Create a master list of your audit objectives that identifies the potential for automated monitoring or data analysis. Each assertion should be associated with some sort of evidence-and where the evidence is digital, the testing can involve software. Then out of the objectives with potential for software-driven testing, identify the easiest and most worthwhile items-the 'low-hanging fruit'.

• Don't be afraid to look for outside help to get the first productivity improvement started. This can mean hiring in new permanent staff with audit software skills, or hiring temporary help, or both. A very effective strategy is to hire a payables recovery expert to review your master list of audit objectives, and to build recovery routines that your own inside expert can re-use later. The cost of hiring someone to create a simple application is not very large, especially in proportion to the funds you can recover over time by checking for missed discounts, duplicate payments, excess inventory, unused vendor credits, and so on. If you would like assistance in identifying a recovery vendor for you, please feel free to contact us at info@auditsoftware.net or by phone at 973-601-3701.

• Consider training staff, even if it is in just the basics of data analysis or audit software usage. AuditSoftware.Net hosts numerous events that are mostly self study or delivered in a web based format. In other words, they are inexpensive and can be done in just a few hours when convienant for you and your team. See the Training, Services, and Events tab on www.auditsoftware.net for more information.

• Keep management focused on the automation goal. As soon as you have secured a productivity improvement, start working on the next one. Treat automation as an ongoing issue, not a one-time project. Ensure that any significant findings receive high-level attention and that everyone knows that software-driven analysis was responsible. Recognizing whatever 'power users' you have is the best way to encourage others on your staff to emulate them.

Dealing with the shortage of skilled users is a challenge that will audit will continue to face for years to come. The right strategy can turn the challenge into an opportunity.

Richard B. Lanza, CFE, CPA-CITP, PMP, president of Cash Recovery Partners, L.L.C., in Lake Hopatcong , N.J. , provides audit technology and project management assistance to companies. He focuses much of his time in developing computerized audit and fraud tests. Lanza is the founder of the non-profit Web site, www.auditsoftware.net. His e-mail address is: rich@auditsoftware.net.

Dean Brooks is president and owner of Ekaros Analytical Inc., a publishing and consulting company that focuses on audit and analysis. He has edited and published numerous audit-related books, and is co-author of the "Buyer's Guide to Audit, Anti-Fraud, and Assurance Software." His e-mail address is: dean@ontics.com.