What audit committees should be asking about the digital transformation of audit

Digital transformation affects almost every aspect of business, including many areas under the purview of a board of directors in its risk oversight role. One such area is the audit process.

Sara Lord, partner and chief auditor at RSM US LLP, sat down with Directors & Boards to discuss the competitive advantages of a digitally transformed audit function.

Below is a transcript of the discussion; the conversation has been edited for clarity and length.

Q: Let's start with digital transformation itself. What does that mean for board members?

A: Digital transformation can mean so many things to a company.

From a board member’s perspective, it's about understanding what the company you serve is doing with digital transformation. And that could mean a lot of different things, depending on the company.

They could be transforming their business operations. They could be transforming their finances. They could be transforming how they interact with their clients and their investors.

What you want to understand—that’s where you ask questions. Where are we as a company transforming digitally? Is it in how we're analyzing the data we get to run our business? Is it in how we're automating some of our activities, either internally—within how we run the business—or with customers? And what other things are we doing to digitally transform the business?

Then as a board member, it's stepping back and reflecting: Is that right? Is management looking at the right areas? Are we doing enough? And how does this fit into our strategic plan?

Q: What about the digital transformation of the audit process? That's not something I think is on the radar of some board members. What's happening there?

A: Just like in companies, a lot is happening in the digital transformation of audits. We're looking at both how we interact with our clients and our clients’ data.

As our clients become more digitally enabled and we're also able to digitally enable our audit and pull in information and analyze larger sets of data, we can use that for really identifying risks and saying, Where do we want to focus our procedures in the audit? Or we can work through a client’s systems and data to understand where we can do less work. Because maybe the system in place at the client has a lot of controls and enhancements that have been done as part of a client's digital journey.

In addition, we look to automate our internal processes just like companies do. Where do we have tasks being done by people that maybe don’t add value or aren't that difficult to think through—they're not adding a lot of professional judgment or professional skepticism? Those are the important parts of an audit. Where we can use digital transformation to automate those gives us more time to work on the high value, the skepticism, the judgment additions to the engagement.

Q: Let's talk about the benefits at the board level. You talked about risk assessment, but what else can boards look forward to from a digital transformation of their audit?

A: Being able to have conversations with their auditor: What are you seeing? As you're digitally transforming your audit, if you're able to analyze more of our data, what are you learning from that, and what things should we be thinking about?

Your board can have a higher-level conversation with the auditor based on the auditor’s analysis, and compare and contrast that to the analysis the board is getting from management or from internal audit—to see where the consistency is and what new things one of those groups is bringing forward that you would want to dig into, or maybe ask across the groups for their common understanding.

Q: What questions should boards, especially the audit committee, be asking of their auditors about digital transformation? What do they need to know?

A: Boards should ask their auditor, What are you doing for digital transformation? When you're looking at our data, is it good? A big part of being able to use and manipulate data is the quality of the data. Manipulating inaccurate data doesn't do a lot of good from an audit perspective.

As the auditor is working with management, saying, What are you learning? Our systems that we have in process at the company, are you finding that they're implemented very well? Are you finding that the data that management is using and providing to us at the board is solid? Is it accurate? As you go in and do more with digital information, are you finding anything we should be worried about?

And then also looking to understand whether the digital work that's being done changes the frequency of conversations. Is more work being done throughout the year, so that it would be good to have further conversations with the auditor for real-time insights? In addition, I think audit committees typically do meet with the auditors at least quarterly. But is that the right cadence, or should any changes happen?

Q: Is there anything in the digital transformation here that a board—the audit committee, especially—needs to worry about with the PCAOB (Public Company Accounting Oversight Board) or other bodies?

A: The standard setters—the PCAOB, the SEC (Securities and Exchange Commission) and the AICPA (American Institute of Certified Public Accountants)—are all closely involved in what's happening in the world and how we capture audit evidence. When I first started auditing, we would go through books of pages of invoices. But thinking about the companies you're working with right now, how many issue paper invoices to their customers? A lot of that is already done digitally.

So, when we think about the paper trail, it's then getting into, What are the systems that are creating the invoices? How are invoices being exchanged? Are there risks that a system can be manipulated? It's not necessarily a paper trail anymore; it's an electronic trail. And as we advance into digital auditing, then you start to talk about things like metadata as opposed to a signature match or a signature block from the bank. It's just a shift in understanding how you look at the accuracy of the information.