In this #jammingwithjason #internalauditpodcast I speak with Joe Oringel about some of the challenges #internalaudit is facing when it comes to #dataanalytics. It turns out one reason people struggle is not understanding the seven body of knowledge areas we should be focusing on and determining where you want to be.
We discuss personnel issues (e.g. do you hire a data scientist and teach them how to audit, or train internal auditors how to be a data scientist) and how to plan out your multi-year path on incorporating more data analytics into your audit activities.
If you are working to improve data analytics in your internal audit department, you need to listen to this episode.
Joe Oringel is the Managing Director of Visual Risk IQ. Learn more at: http://visualriskiq.squarespace.com/
To get a copy of the data analytics maturity model discussed during the episode, send an e-mail to [email protected]
Transcript
1
00:00:00.840 –> 00:00:12.210
Jason Mefford: Welcome everybody to another episode of jamming with Jason. Hey. Today we are going to talk about a topic that I know many of you may be struggling with or thinking ah
2
00:00:12.780 –> 00:00:32.880
Jason Mefford: I got to add that to my audit plan. I got to figure out how we’re going to deal with data analytics. Okay, so today I have my friend Joe Oren go with me and he is the Managing Director at visual risk IQ and like me. Joe is a rock star, but just in
3
00:00:33.960 –> 00:00:35.820
Jason Mefford: Data Analytics. So welcome, Joe.
4
00:00:36.990 –> 00:00:37.770
Joe Oringel: Hi, Jason.
5
00:00:37.980 –> 00:00:48.030
Jason Mefford: Hi. Now I know you know as, as we’ve talked before. Lots of people are trying to start doing data analytics, because everybody knows they’re supposed to do it right.
6
00:00:48.840 –> 00:00:56.640
Jason Mefford: But there seems to be some common things that end up being kind of roadblocks to getting people started
7
00:00:57.210 –> 00:01:04.470
Jason Mefford: So I want to kind of go through and talk about that with you today, but maybe first just kind of get give a little brief introduction
8
00:01:04.920 –> 00:01:17.670
Jason Mefford: You know about kind of what you do, because I know their visual risk IQ you guys do some things different than other people do. So maybe just kind of explain kind of what you guys do and how you help people as well with us.
9
00:01:18.150 –> 00:01:22.200
Joe Oringel: Sure. Well, thanks. Thanks for asking. Um so visual risk IQ were
10
00:01:23.220 –> 00:01:33.000
Joe Oringel: Quite a bit of a unicorn, if you will. Jason in that we bring together both the the business Akamai, and also the technical and data acquisition
11
00:01:33.390 –> 00:01:53.220
Joe Oringel: And finding those two different skills in the same individual is somewhat like finding a unicorn. I hear that from my from my recruiter friends who who always want to know who’s a really solid it and data analytics on it, senior
12
00:01:54.390 –> 00:01:56.730
Jason Mefford: Women and they run all of those skills in one person.
13
00:01:56.730 –> 00:02:12.720
Joe Oringel: Talk all those skills in one person. So what we do is we help people see and understand data, but particularly we help finance and internal audit people see and understand data.
14
00:02:13.110 –> 00:02:29.700
Joe Oringel: I’m the, the proud father of a data scientist, a budding data scientist. My son is a college junior, and he and I will be at the MIT sports analytics conference this coming weekend.
15
00:02:30.210 –> 00:02:46.680
Joe Oringel: Looking at data helping tell the coach at his school infield shift swing don’t swing curveball off speed fastball, I would tell you that there’s a domain.
16
00:02:47.460 –> 00:03:03.780
Joe Oringel: Knowledge of baseball that taking the best data scientist from our team who’s not into baseball and putting them on that team would not yield good results. And you asked about people.
17
00:03:04.260 –> 00:03:26.550
Joe Oringel: The big thing that we see organizations do is they lean too much toward one or two of the the skills that are needed in the portfolio and they lean toward those at the, at the expense of having other other skills on the team. Mm hmm.
18
00:03:27.360 –> 00:03:33.000
Jason Mefford: Well, because I think it’s interesting, you know, like you said, you bring up your, your, your son, because I know we talked about him before. It’s kind of like
19
00:03:33.360 –> 00:03:41.940
Jason Mefford: You know, for anybody who’s ever watched the movie Moneyball right. It’s kind of like that. Right. You know what, and, but, but, as you said, right, it’s
20
00:03:42.510 –> 00:03:51.360
Jason Mefford: It’s not just, you know, the fact of being a data scientist or understanding you know how to manipulate how to analyze data.
21
00:03:51.750 –> 00:04:01.380
Jason Mefford: But you have to have a base understanding of the area that you’re looking at as well. Right, so that’s that’s why you’re talking about kind of bringing the business and data act.
22
00:04:02.370 –> 00:04:10.170
Jason Mefford: Together, because I think you know like we took. We talked before we started you know there’s there’s some different blocks that people have, and one of them is around personnel.
23
00:04:11.190 –> 00:04:27.960
Jason Mefford: And you know, I think what you just kind of described in you know even like you said your recruiter friend, you know, hey, I need somebody that’s strong and it audit and data analytics and it’s like, well, you’re probably not going to find one person with all of that stuff.
24
00:04:28.200 –> 00:04:48.240
Joe Oringel: They need great interpersonal skills they need to be a really good project manager change management strategic thinking and they need to be up on all the latest technical tools tablo Power BI and also open source tools like R and Python and
25
00:04:49.260 –> 00:04:56.370
Joe Oringel: The latest machine learning algorithms and you just kind of laugh and you think you’re going to find all those things in in one
26
00:04:57.780 –> 00:04:59.880
Joe Oringel: And that are
27
00:05:00.690 –> 00:05:00.930
Jason Mefford: My
28
00:05:00.960 –> 00:05:19.920
Joe Oringel: My background is internal audit. First I lead data analytics for a fortune 100 company when I was in charge of what we call integrated it auditing. I was moved cyber and data center security guy, but I was also the the data.
29
00:05:21.120 –> 00:05:27.420
Joe Oringel: The data analytics person. And what I learned pretty quickly, was I didn’t even think I could be good at both of those.
30
00:05:27.690 –> 00:05:28.110
Jason Mefford: So I
31
00:05:28.200 –> 00:05:43.560
Joe Oringel: Quickly hired strong data center it general controls person underneath me, man. I moved almost exclusively toward financial and operational auditing what I call auditing with a computer.
32
00:05:44.070 –> 00:05:44.550
Jason Mefford: Instead,
33
00:05:45.210 –> 00:05:55.140
Joe Oringel: Of a computer right it automates me is auditing all the computer and it or data analytics is more auditing with the
34
00:05:56.190 –> 00:06:06.660
Joe Oringel: Computer to do the math, the science, the manipulations, so that the auditor pollution from the population of data.
35
00:06:07.500 –> 00:06:14.550
Jason Mefford: Well, yeah. And so you know i again i mean i’m putting myself, you know, back in my chief audit executive role right so
36
00:06:15.240 –> 00:06:22.680
Jason Mefford: You know, if I were doing it right now to try to give people some, you know, ideas or tips to kind of take away right
37
00:06:23.250 –> 00:06:32.070
Jason Mefford: If you want to start doing data analytics, you realize are probably need to realize you’re not going to find one person with all of the skills that you need.
38
00:06:32.820 –> 00:06:39.390
Jason Mefford: You’re going to need people that have the business and the auditing side, but the but the data acumen side of it, too.
39
00:06:40.080 –> 00:06:45.900
Jason Mefford: Is, is there kind of a rule of thumb, because I know you guys work differently with companies to which which I actually
40
00:06:46.800 –> 00:06:54.150
Jason Mefford: Really appreciate it and it’s kind of my philosophy to more of the teach to fish and send it just coming in and doing everything for you, but
41
00:06:54.900 –> 00:07:01.530
Jason Mefford: Is there kind of a rule of thumb. I mean, if I if I have an audit department of say 10 or 15 people, you know,
42
00:07:01.830 –> 00:07:10.050
Jason Mefford: Is there, is there some point when it’s like okay, it makes sense for you to hire somebody maybe who’s, who’s more technical as a data scientist.
43
00:07:10.890 –> 00:07:21.030
Jason Mefford: On the team versus, you know, where maybe that’s that’s a skill. You just have to outsource but you you know you’ve got your auditors that kind of understand the business side and the auditing.
44
00:07:21.360 –> 00:07:29.370
Jason Mefford: You bring in that technical expertise. If you need to, but maybe kind of talk about some of that and what you’ve seen successful for companies to do
45
00:07:29.880 –> 00:07:34.830
Joe Oringel: Certainly. Well, what we’ve done is we’ve got a whole body of knowledge.
46
00:07:34.860 –> 00:07:38.310
Joe Oringel: Is basically seven different areas that we think
47
00:07:39.420 –> 00:07:40.800
Joe Oringel: An organization needs.
48
00:07:40.920 –> 00:07:41.250
Jason Mefford: To
49
00:07:41.340 –> 00:07:50.250
Joe Oringel: Have skills on their team as it relates to analytics and sevens, a long list, but let me let me go over them here quickly.
50
00:07:50.700 –> 00:08:05.460
Joe Oringel: Um, several of them are typical audit kinds of skills, project management good communication skills and change management, sort of a strategic thinking
51
00:08:05.850 –> 00:08:18.000
Joe Oringel: Those three different areas, project management communication and and change management strategic thinking if you’ve got those three skills as the baseline.
52
00:08:18.510 –> 00:08:30.330
Joe Oringel: Then you’re looking to layer on top of them. Some data Ackerman, and specifically the domain expertise of finance and
53
00:08:30.840 –> 00:08:42.360
Joe Oringel: Internal audit, but the domain experience of your industry, your company, things like that, from a technical skills. Right. So from for my project management.
54
00:08:43.050 –> 00:09:00.270
Joe Oringel: Communications communication is change management strategic thinking the middle layer of the sandwich, if you will, is the domain expertise of finance and internal audit and then on top. The, the next three layers are data acquisition
55
00:09:01.320 –> 00:09:20.070
Joe Oringel: Statistics and also visual reporting that presentation layer of turning the spreadsheet into pictures and even among the data science community, you will find data specialists who are stronger or less strong
56
00:09:20.550 –> 00:09:39.390
Joe Oringel: In the data acquisition data prep versus statistics, the math and the visual reporting I’m quick to see to feed to my 20 year old. He’s way better at statistics and mathematics even than, than I am.
57
00:09:40.380 –> 00:09:57.600
Joe Oringel: But being better at math doesn’t necessarily make him stronger at some of the data acquisition, it’s needed in in our world, or even some of the visual reporting that I think is really the big change in technology over the last five or eight years.
58
00:09:58.140 –> 00:10:01.620
Jason Mefford: Well, so from that, from those seven areas you can really see kind of how it
59
00:10:02.220 –> 00:10:10.770
Jason Mefford: It builds upon each other, you know, like you said, you’ve got like this baseline area, then you’ve got kind of, you know, these domain domain expertise and then you’ve got kind of the
60
00:10:11.100 –> 00:10:20.550
Jason Mefford: Acquisition statistics and like the analysis and reporting that kind of go over the top of that. So, so if I’m building. I need to make sure that I’ve got that baseline first
61
00:10:20.910 –> 00:10:34.380
Jason Mefford: Before I really try to jump in to just go hire somebody or just decide, hey, I’m going to start doing data analytics, because everybody is and it sounds really cool. If the baseline. It’s a very probably not going to be very effective. Right.
62
00:10:34.980 –> 00:10:43.860
Joe Oringel: Exactly. And one of the, one of the questions that we get all the time is, are we better off hiring the data scientist and teaching them auditing.
63
00:10:44.280 –> 00:10:55.140
Joe Oringel: Or are we better off hiring the auditor and teaching them the the data science and typical politician or auditor. I think the right answer is it depends.
64
00:10:55.710 –> 00:11:07.950
Joe Oringel: And it depends on the other, the other skills of the individual brain we work with plenty of organizations who have hired the the data skills first and our teaching the auditing.
65
00:11:08.400 –> 00:11:18.600
Joe Oringel: And those, those, those organizations and have hired they’ve invested in the person’s areas where they need to improve and they’ve thrived in in those roles.
66
00:11:19.080 –> 00:11:30.720
Joe Oringel: Likewise, we also work with people who have the finance and audit domain expertise and we add or layer. The, the data science on top of their fundamental
67
00:11:31.830 –> 00:11:42.420
Joe Oringel: Business and an audit accurate when it works both ways. And if I were going to say, which would make me pick one. Joe, you only you only get one choice.
68
00:11:44.310 –> 00:11:47.880
Joe Oringel: I would say hire the individual with the stronger interpersonal skills right
69
00:11:48.120 –> 00:11:57.420
Joe Oringel: Okay you trust from a project management from a communications from a change management standpoint, and if you trust the data scientists
70
00:11:58.140 –> 00:12:11.730
Joe Oringel: In a personal skills more hire them and teach the auditing, or if you if you trust the, the auditors interpersonal skills and may they’re showing an enthusiasm and a genuine interest.
71
00:12:12.060 –> 00:12:15.870
Joe Oringel: In learning the data science, then yes, the data science can be taught as well.
72
00:12:16.440 –> 00:12:27.840
Joe Oringel: When I care more about or the personal attributes, who is somebody who’s going to take feedback. Well, who is somebody who who is skeptical, who has an enthusiasm for learning.
73
00:12:28.290 –> 00:12:41.310
Joe Oringel: And is self aware this is what I’m good at this is what I need to do to improve and that they’re willing to invest and shore up the skills that they might need.
74
00:12:42.210 –> 00:12:54.480
Jason Mefford: Yeah, so it’s interesting because I, I do have my own personal opinion or predisposition. But, you know, like you said not to not to sound like a politician, but it does depend. It depends on the person.
75
00:12:54.960 –> 00:13:02.730
Jason Mefford: Right. I mean, so if you have somebody who’s a good auditor that you think is, you know, has these good interpersonal skills and also
76
00:13:03.180 –> 00:13:12.330
Jason Mefford: Can learn the well, then sure, you know, maybe go ahead and invest in that audit person if you can hire you know a data scientist.
77
00:13:13.050 –> 00:13:25.200
Jason Mefford: It’s usually I think probably easier to teach a data scientist, how to audit than an auditor. How to Be a data scientist because I think there’s a lot more body of knowledge.
78
00:13:26.040 –> 00:13:31.920
Jason Mefford: behind that. But like you said you’ve got to be careful about the interpersonal skills because I’ve worked with some really technical people
79
00:13:32.370 –> 00:13:43.260
Jason Mefford: And I’ve got an IT auditor that just jumps into my mind from before guy was brilliant at what he did, but he would sit over in the corner cross legged on the ground.
80
00:13:43.830 –> 00:13:53.940
Jason Mefford: very introverted very awkward dealing with people. And so, you know, could only use them for specific things he would not be somebody
81
00:13:54.330 –> 00:14:04.680
Jason Mefford: Right, that that I would have given more responsibilities to because he didn’t have those interpersonal skills, but he was really good at a technical thing. So you do have to kind of consider both sides of that well.
82
00:14:05.010 –> 00:14:14.100
Joe Oringel: Then, like, like I mentioned, I came into data analytics from audit first with a strong foundation of coding
83
00:14:14.550 –> 00:14:33.930
Joe Oringel: layered on top of my undergraduate accounting degree my business partner is a data scientist, first and foremost, came up through the it ranks Chief Technology Officer He’s clearly been data first. We started working together 15 years ago inside of PTC
84
00:14:35.160 –> 00:14:48.390
Joe Oringel: And his project was to recommend technology to the firm that would help our internal audit practice thrive. And the first question was, So what’s internal audit.
85
00:14:49.830 –> 00:14:57.360
Joe Oringel: In 15 years ago, I can still remember him asking what’s the difference between internal audit and external audit he understood
86
00:14:58.230 –> 00:15:08.400
Joe Oringel: You know, external audit opinion and sign off on the, the annual 10 K and he knew that that was usually back then. I think one of five or six firms that
87
00:15:09.240 –> 00:15:17.430
Joe Oringel: That was going to sign off on the opinion he didn’t exactly understand the difference between internal audit and external on it. So what I would tell you is
88
00:15:18.090 –> 00:15:33.810
Joe Oringel: If you’re a chief audit executive trying to build analytics capabilities on your team, you can hire almost anyone and work with us to accentuate the positive skills that they bring
89
00:15:34.320 –> 00:15:52.440
Joe Oringel: And to work with us to shore up the areas that may be new to them. And if what they need to work on our data acquisition and statistics, then our project will have a little bit more, maybe even a lot more Kim Jones than or Intel
90
00:15:52.560 –> 00:16:04.500
Joe Oringel: Yeah but but if you if you’ve hired a really strong data scientist and you’re teaching them internal audit, they’re going to see a little more Joe and a little less camera, David. Yeah, yeah, which
91
00:16:04.530 –> 00:16:10.650
Jason Mefford: makes total sense. And so, like you said, I mean, that’s, that’s one of the first blocks that a lot of people have is trying to figure out the personnel.
92
00:16:11.130 –> 00:16:15.450
Jason Mefford: Issues. And so, like you said, there’s kind of these seven areas. Make sure you got your baseline.
93
00:16:15.870 –> 00:16:22.920
Jason Mefford: Then you got to start figuring out, you know. All right. Do you have somebody internal do you hire somebody, how are you going to going to go about this, but
94
00:16:23.340 –> 00:16:28.650
Jason Mefford: It takes some time. You know, to go through this as well. So that’s another thing I want everybody to realize is like
95
00:16:29.010 –> 00:16:38.220
Jason Mefford: You’re not just going to, you know, snap your fingers and all of a sudden the month from now you have this, you know, kick butt kind of data analytics thing going on. It takes a while to do right
96
00:16:39.450 –> 00:16:46.650
Jason Mefford: Now, another one. You know, I know that that a lot of people seem to struggle with is getting data. So maybe let’s let’s talk a little bit about
97
00:16:47.130 –> 00:16:55.530
Jason Mefford: That because, you know, I know. That was one of the issues that I used to have, you know, many years ago because we couldn’t get some of the data.
98
00:16:56.070 –> 00:17:06.180
Jason Mefford: That we wanted to actually analyze, right. So, so what are some of the challenges that people have there and maybe some things they can do to help actually get data so they can actually analyze it.
99
00:17:07.140 –> 00:17:13.350
Joe Oringel: Sure. Um, what can we can we talk about your, your challenge Jason with getting data.
100
00:17:14.370 –> 00:17:30.120
Joe Oringel: We tend to break up a challenges into one of two buckets. Right, it’s a it’s a technical challenge. I don’t know what buttons to press. I don’t have the data dictionary from SAP, then I have a data dictionary, but it’s in German.
101
00:17:31.920 –> 00:17:46.110
Joe Oringel: I don’t know what these these tables are. I know I want to look at payroll data but i’m i’m not sure which payroll tables, I need to download that. That’s a technical problem, right.
102
00:17:46.500 –> 00:17:46.890
Yep.
103
00:17:47.940 –> 00:17:55.710
Joe Oringel: And then there are also what I call organizational or maybe even political problems, and that is that an auditor.
104
00:17:56.100 –> 00:18:03.000
Joe Oringel: Ought to be able to go get the data themselves, right, our charter allows us unfettered access to the
105
00:18:03.450 –> 00:18:14.280
Joe Oringel: Company’s books and records, certainly, nobody would quibble if you went to the head of HR and said that you wanted to look through some files you wanted to
106
00:18:14.640 –> 00:18:25.140
Joe Oringel: Look at employment practices or hiring practices they would let you look through the paper files to the extent that your organization has paper files.
107
00:18:25.170 –> 00:18:31.020
Joe Oringel: They would let you they would let you look at that information. But as soon as you say, I want to download
108
00:18:31.530 –> 00:18:43.710
Joe Oringel: All of the personnel records on to my auditor laptop, then all of the sudden HR start saying, but but but you can’t have this or it’s sensitive or
109
00:18:43.950 –> 00:19:07.260
Joe Oringel: Or things like that. So, so in the challenge of getting data do ask yourself, Is your problem, political, and that you’re being blocked from getting the data because of policy or security protocol or some other non technical
110
00:19:07.650 –> 00:19:08.250
Joe Oringel: Problem.
111
00:19:08.430 –> 00:19:16.830
Joe Oringel: Where are you being blocked from a truly technical problem, right. The, the payroll system is supported by a vendor, the only
112
00:19:17.910 –> 00:19:36.360
Joe Oringel: Way we get data files is if we open up a support ticket and the vendor bills us $300 an hour for making the file available and I’m concerned, Jason, the file that you’re asking for may take them days and days.
113
00:19:36.990 –> 00:19:52.500
Joe Oringel: Programmer time to get the data and does audit have a blank check to get the data file that you need for the audit. Again, that’s more of a political or an organizational problem than necessarily a technical
114
00:19:54.000 –> 00:20:01.110
Jason Mefford: Yeah, so it’s interesting that you bring that up because you know again in my career, I’ve experienced both of those right and and, especially, you know,
115
00:20:01.560 –> 00:20:08.940
Jason Mefford: Because I remember we had one where where we were. We needed to access certain records for some different investigation work that we would do.
116
00:20:09.750 –> 00:20:22.230
Jason Mefford: And you know, we just pretty much couldn’t tell them why. But it was, hey, we need x, y, z. And I remember you know there was a manager that in the IT department that all of that stuff kind of went through.
117
00:20:22.740 –> 00:20:27.180
Jason Mefford: And his first pushback was no you can’t really have access to that. That’s confidential. I can’t give you that.
118
00:20:27.630 –> 00:20:38.550
Jason Mefford: You know. So then again it was kind of the easy thing of Well here’s the audit charter that says we can do it and tell you what, let’s have a meeting with the CIO and and
119
00:20:39.120 –> 00:20:51.000
Jason Mefford: He’ll make sure and, you know, clarify everything that, yep. When Jason sends you a request, you know, you have my approval to do that. Right. So that was a fairly easy.
120
00:20:52.170 –> 00:21:07.200
Jason Mefford: Organizational thing for me to deal with. But I would guess, especially now with all the privacy concerns that you know it departments are probably, you know, tightening down even more, because again, you know, it’s like
121
00:21:08.460 –> 00:21:29.670
Jason Mefford: I remember the old there was a story of a an external accounting firm to be not mentioned that accidentally left a CD of data of all of the high wealth clients for a private bank in the in the seat back cover or you know pocket of an airplane now.
122
00:21:32.040 –> 00:21:44.340
Jason Mefford: So there is some of that stuff that we have to deal with. And I’m guessing, people are experiencing privacy push back now even more because of some of the breaches. Right. Absolutely.
123
00:21:45.480 –> 00:21:58.200
Joe Oringel: You know in the in the short time since you and I have been speaking today I’ve got a text message here from a client will we be available to help them talk with HR about data redaction
124
00:21:58.860 –> 00:22:00.420
Jason Mefford: And and the
125
00:22:00.450 –> 00:22:13.800
Joe Oringel: technical problem, the political problems that are disguised as technical problems or vice versa can often be overcome with data redaction
126
00:22:14.940 –> 00:22:29.190
Joe Oringel: Capabilities right we we do this just to limit the liability of our firm we have no interest if you’re doing a payroll audit. We don’t want to know the names and addresses and the salaries.
127
00:22:29.490 –> 00:22:46.860
Joe Oringel: Of all of the people that are on your HR master file. We are content to tell you that row number 40 703 has a overtime compensation that is higher than their base salary.
128
00:22:47.790 –> 00:22:49.080
Jason Mefford: So you probably have an issue.
129
00:22:49.590 –> 00:23:01.320
Joe Oringel: And you might look at the scheduling system and make sure that all of the overtime is bonafide but we don’t want to know their first name, last name,
130
00:23:01.890 –> 00:23:19.260
Joe Oringel: Address cell phone number. I’m in that particular circumstance we would probably mask or redact the Employees. Name build our analytics to compare over time to base pay
131
00:23:19.680 –> 00:23:26.370
Joe Oringel: Show you the outliers and then on your computer, not, not the consultant computer
132
00:23:26.730 –> 00:23:36.840
Joe Oringel: But on the employee issued computer, we would show you how to update our analytic update our dashboard, so that your list of transactions to investigate.
133
00:23:37.140 –> 00:23:53.670
Joe Oringel: Might have that person supervisor or might have that person’s department or cost center, but we can build all of the the mathematics together to identify the outliers without our staff ever having to touch truly sensitive information.
134
00:23:54.690 –> 00:24:12.810
Joe Oringel: So again, let’s separate the technical problems from the political problem. And often we can put in some controls that get people comfortable with the organizational or the political so that the technical can be overcome.
135
00:24:14.190 –> 00:24:22.800
Jason Mefford: Yeah, I think that’s interesting. Sometimes what appears at first to maybe be a technical issue may be more of an organization or political issue that we have to deal with. So
136
00:24:23.220 –> 00:24:30.600
Jason Mefford: I think separating those is good. And also, I think, on the technical side, you know, we already talked about how you know maybe sometimes
137
00:24:32.130 –> 00:24:40.290
Jason Mefford: The data that we want isn’t available in the way that we thought it might be right. Like maybe maybe the data has to get pulled from
138
00:24:40.980 –> 00:24:51.930
Jason Mefford: You know, like your example of, well, it’s a third party. They’re going to have to go do a bunch of development work because maybe the fields we need are there, but they’re in three different tables or something like that. So we have to
139
00:24:52.440 –> 00:25:05.700
Jason Mefford: Be able to pull everything together into one. So there’s that side of the technical that we have to deal with. But I think too that there’s probably this other side to which is sometimes we don’t know what we’re asking for
140
00:25:06.960 –> 00:25:12.840
Jason Mefford: Because I know I’ve had that a few times in my career where, you know, we thought we were asking for one thing.
141
00:25:13.320 –> 00:25:27.570
Jason Mefford: But it really wasn’t what we wanted, as well. So you have to, you know, probably some of that comes back to our understanding of it to be able to get the right data that we need by knowing what to ask for right
142
00:25:27.630 –> 00:25:36.540
Joe Oringel: What one of the very common things the way that we typically engage with our clients is through what we call a data discovery workshop in in a
143
00:25:37.440 –> 00:25:52.200
Joe Oringel: Day to a day and a half of often in person time, what we’re doing is we’re asking the audit team, and even the the client area. What are the business questions that we want to know the answer to.
144
00:25:52.740 –> 00:26:05.670
Joe Oringel: Right. Is there, is there anybody who’s on the clock. But I’m perhaps there’s no evidence of them working. Is there somebody who there is evidence of
145
00:26:06.210 –> 00:26:18.180
Joe Oringel: Them doing work, but for some reason the time and attendance system says that they’re not working right. That’s what we call wage theft, your, your ogre of a boss says punch out
146
00:26:18.570 –> 00:26:31.410
Joe Oringel: But keep keep working. Keep sweeping until the restaurant is clean. Keep vacuuming until the retail stores spotless that’s wage theft. The, the pay theft is where
147
00:26:32.190 –> 00:26:43.650
Joe Oringel: You leave for the day and ask your buddy punch me out at the end of the day, I’m a fact. But the brainstorming what questions are we looking to uncover
148
00:26:44.070 –> 00:26:56.490
Joe Oringel: In the audit. What do we want to know the answer to that happens during brainstorming. But then we’re also looking inside the data dictionary at the tables at the columns.
149
00:26:56.880 –> 00:27:09.720
Joe Oringel: What are the digital evidence that somebody was doing work in the hospital. What are the tables that are the digital evidence that somebody was in the building. Maybe I need badge data.
150
00:27:10.110 –> 00:27:23.760
Joe Oringel: Together with pay data to see if I’ve got a problem in in those examples in the data discovery we connect the business questions to the digital data.
151
00:27:24.150 –> 00:27:37.110
Joe Oringel: And by having some real digital data in the discovery session, we’re able to identify what charts and graphs can practically be developed, given the information that you
152
00:27:38.250 –> 00:27:45.420
Jason Mefford: Want i think that’s that’s probably one of the most important steps is to be clear on that. To begin with,
153
00:27:46.380 –> 00:27:59.280
Jason Mefford: Before you ever go try to ask. Ask for stuff right because it’s if you don’t, if you don’t know why you’re asking for the data or are the questions you want answered by analyzing the data.
154
00:27:59.790 –> 00:28:06.810
Jason Mefford: Then you’re never going to know which which stuff to pull right and especially as we said, you know, with, with some of the
155
00:28:07.380 –> 00:28:20.520
Jason Mefford: issues around, you know, political or organizational issues of getting the data we need to make sure that we really are only getting what we need to have, you don’t need a full download of the payroll master file.
156
00:28:21.600 –> 00:28:28.980
Jason Mefford: There’s certain fields, you probably need but you don’t need the whole thing. And like you said, you know, you don’t need names and addresses and everything else.
157
00:28:29.340 –> 00:28:44.880
Jason Mefford: Some identifier, so that you know you know or can go back and figure out what line 47 is but but a lot of this stuff you don’t probably need. So you got to be clear on that. To begin with, and in something like this data discovery workshop that you go through
158
00:28:45.390 –> 00:28:56.940
Joe Oringel: Very much so in, you know, back to back to how we work with what organizations often find is in a really thoughtful data discovery session with us where we link.
159
00:28:57.450 –> 00:29:07.200
Joe Oringel: The, the business questions to the digital data we can answer 80% of the questions with two tables or with three tables.
160
00:29:07.560 –> 00:29:20.340
Joe Oringel: The last 20% of the questions on the audit plan may require multiple additional data sources to be appended or to be gathered to those first few
161
00:29:20.790 –> 00:29:29.070
Joe Oringel: We there’s an expression I I like and don’t like in the same breath, which is don’t boil the ocean and
162
00:29:30.000 –> 00:29:42.960
Joe Oringel: You certainly can learn data analytics techniques with just one or two tables build the capability build the confidence of your audit t
163
00:29:43.320 –> 00:29:56.700
Joe Oringel: By showing them how you’ve answered several important questions with analytics and scope out perhaps two or three of the the additional questions of it requires
164
00:29:57.120 –> 00:30:18.510
Joe Oringel: And especially difficult to get ahold of data source scope those out for the follow up. But let’s go in, get out be agile development illusions, with a very finite list of data sources and that often is a strong recipe for success. Yeah.
165
00:30:19.290 –> 00:30:23.940
Jason Mefford: Starts start small. Start slow and then go from there, which is always the best idea.
166
00:30:25.080 –> 00:30:35.550
Jason Mefford: Because then you get those those small wins along the way. Now you know i know we kind of mentioned earlier on, but kind of wanted to maybe kind of wrap up on this too, because
167
00:30:35.970 –> 00:30:44.490
Jason Mefford: You know I I sometimes get the sense of people think, oh, you know, data analytics, I can just kind of, you know, start snapping my fingers and boom, it’s going to be done, but
168
00:30:44.970 –> 00:30:56.250
Jason Mefford: This is more of like a multi year kind of plan. And I know, I know there’s a resource that you guys kind of walk. Walk clients through to help them kind of understand this and think about
169
00:30:56.730 –> 00:31:12.600
Jason Mefford: Which areas to focus on to. So maybe just kind of talk talk about that a little bit, because as we said, you know, it’s some of these small steps. So what are some things people could start doing on their path to get to where they ultimately want to be
170
00:31:13.260 –> 00:31:18.990
Joe Oringel: Sure. Well, this is feedback from a, from a client actually that we met with last week, he’s
171
00:31:19.710 –> 00:31:34.290
Joe Oringel: Now chief audit executive at a third organization since we began working with them 15 years ago and and he thought we would be even more successful and help more CA’s explain to their audit committee.
172
00:31:34.860 –> 00:31:48.960
Joe Oringel: How they were going about data analytics that they were going to invest in a relationship with the data analytics consultant being us, but that the audit committee should not expect data and Nirvana.
173
00:31:50.220 –> 00:32:03.570
Joe Oringel: Is three or six months after the completion of a single project or even two or three projects. So we had built for them a maturity model kind of across the top.
174
00:32:04.050 –> 00:32:17.430
Joe Oringel: Five different stages. Anything from ad hoc to repeatable to schedule to Continuous Auditing and monitoring, but not just having those five steps because there are certainly other
175
00:32:18.360 –> 00:32:33.300
Joe Oringel: Other models that you can get out, find online from the firm’s from the software firms that have these these different levels of maturity. The back to arm acquiring the data or
176
00:32:34.530 –> 00:32:51.000
Joe Oringel: Writing your scripts or writing your audit report and having your audit report reflect the the data analytics view that the one through five maturity probably varies
177
00:32:51.450 –> 00:32:58.980
Joe Oringel: Both from a people standpoint, a process standpoint and a technology standpoint. So we built a
178
00:32:59.400 –> 00:33:09.690
Joe Oringel: Three or four page maturity model that put some words in the boxes of each of those five different levels of maturity.
179
00:33:10.140 –> 00:33:23.460
Joe Oringel: And our CA’s advice for us is to share the maturity model with others, CA please let them do a bit of a self assessment. Right. Which of these areas.
180
00:33:23.820 –> 00:33:36.210
Joe Oringel: Are they strongest with today. And importantly, where do they see themselves in six or 12 or or 18 months and as you and I were were talking before
181
00:33:37.350 –> 00:33:50.220
Joe Oringel: Getting started here on the podcast. You can’t move from level one to level five in 90 days all of these, these different areas. You’ve got to have
182
00:33:51.330 –> 00:33:55.170
Joe Oringel: A measured approach on how you’re going to move forward. Yeah.
183
00:33:55.830 –> 00:34:06.090
Jason Mefford: Well into, you know, just, just for anybody who’s listening that maybe isn’t familiar with maturity models. Right. I mean, because like you said, you know, you usually they’re five steps, you know, from
184
00:34:06.600 –> 00:34:15.900
Jason Mefford: Whatever they call it ad hoc up to optimized on the top end. But what you guys have done is actually gone through and kind of had layers. Right, so that, again, you can think about
185
00:34:16.260 –> 00:34:26.190
Jason Mefford: Well, where am I at on this maturity model visa v. My people, or you know the process, the technology. Some of these different aspects that you can actually consider
186
00:34:26.760 –> 00:34:34.380
Jason Mefford: Because what’s important and how you usually use them is find out where you’re at right so you can go through and kind of self assess yourself.
187
00:34:34.830 –> 00:34:39.330
Jason Mefford: Figure out where you’re currently at and where you would like to be
188
00:34:39.870 –> 00:34:50.280
Jason Mefford: And I’ll tell you the top five is not where you want to be on all of them. You’ve got to figure out, you know, where the right point is. But then what you’re what you’re able to do as it starts to give you a project plan.
189
00:34:50.850 –> 00:34:55.920
Jason Mefford: At that point, because if you score. No one maybe on people and you want to be two or three
190
00:34:56.340 –> 00:35:05.910
Jason Mefford: Maybe within two or three years. Well, now you see the gap you know the difference of what you need to do. Right. And at that point, then you can actually start making the plans and start working
191
00:35:06.420 –> 00:35:16.380
Jason Mefford: Towards it because I love what you said, don’t, don’t expect that you’re going to have data Nirvana three to six months. Not gonna happen. It’s gonna take a while. It is very much so.
192
00:35:18.240 –> 00:35:23.460
Jason Mefford: Yeah, so this is grimy and like you said, you know, this is a great you know tool for kind of
193
00:35:24.660 –> 00:35:39.240
Jason Mefford: You know, people to kind of self assess and I think this is kind of generic sized, I believe, to you said right is this is something that we could offer to give away to people that listen that actually want a copy of this so that they can go through and take a look at it to
194
00:35:39.840 –> 00:35:46.200
Joe Oringel: Certainly, you know, we’re happy to send it to anyone via email that drops us a line.
195
00:35:47.610 –> 00:35:52.260
Joe Oringel: And will not only send it back to them but but certainly spend, you know,
196
00:35:53.340 –> 00:35:59.250
Joe Oringel: Half an hour or an hour, getting their feedback on it. Right. What, what words do they want to put in the boxes.
197
00:35:59.310 –> 00:36:11.220
Joe Oringel: To the name. There are different, different words that belong in the box based on their company or their industry or or their company size we’re always interested in having our
198
00:36:12.060 –> 00:36:20.250
Joe Oringel: Feedback on the artifacts that we’ve built for other client assignments to have the those artifacts live and flourish and
199
00:36:20.610 –> 00:36:37.350
Joe Oringel: Adapt for for other organizations. So yes, happy to share this this model and will will certainly provide a no cost consultation for anybody that wants to ask us some Q AMP a
200
00:36:37.530 –> 00:36:38.160
Jason Mefford: Questions about
201
00:36:38.850 –> 00:36:40.920
Joe Oringel: Our model and feedback on
202
00:36:41.550 –> 00:36:49.350
Jason Mefford: Well, thank you. So I’ll make sure I’m put stuff in the show notes about that. But what’s, what’s the best email. What should they email if they’re if they’re interested in it.
203
00:36:50.070 –> 00:37:14.430
Joe Oringel: Sure. Well, our company is visual risk IQ so simply info i n fo at visual risk iq.com. And again, we’ll put that in the show notes as you suggest, and folks can can find it, and we’ll send it back out to them with a, with an offer to to have that new cost consultation.
204
00:37:15.270 –> 00:37:20.400
Jason Mefford: Well, perfect. So Joe, thank you know we’re kind of wrapping up on our timer. So we’re going to kind of
205
00:37:20.910 –> 00:37:25.980
Jason Mefford: But, but just to kind of, you know, again, give, give a summary and thank you you know again for being willing to
206
00:37:26.460 –> 00:37:37.740
Jason Mefford: To share that model with people that listen, you know, sending the email info at visual risk IQ com and you can get a copy of that. And again, Joe’s also
207
00:37:38.280 –> 00:37:45.000
Jason Mefford: You know offered to sit down with you for a few minutes and actually talk about it, see what you think and get your feedback and trying to see where you’re at, as well. So
208
00:37:45.450 –> 00:37:47.460
Jason Mefford: We’ll have that included down below, but
209
00:37:47.970 –> 00:37:54.600
Jason Mefford: You know, again, everybody if you’re if you’re interested in getting started in data analytics, you know, today we’ve talked about a few things.
210
00:37:54.870 –> 00:38:03.810
Jason Mefford: You know some of the different roadblocks, if you will, that people have around, you know, personnel issues you know the right kind of people that you need on your team.
211
00:38:04.200 –> 00:38:14.100
Jason Mefford: To how you actually get or acquire the data and then thinking about it kind of from a multi year plan standpoint, where you are now where you want to get to
212
00:38:15.720 –> 00:38:21.780
Jason Mefford: Because like you said, it’s gonna it’s gonna take you a little while to do it. And this is just the tip of the iceberg. But Joe, thank you.
213
00:38:22.650 –> 00:38:29.190
Jason Mefford: You know, for. Come on. We’ve known each other for quite a few years and it’s nice to kind of reconnect and and let
214
00:38:29.700 –> 00:38:40.800
Jason Mefford: You know, people hear, hear your knowledge because again I love what you guys are doing over there in the way you’re you’re actually really helping people improve what they’re doing.
215
00:38:41.700 –> 00:38:51.030
Jason Mefford: And make that knowledge resident within their team. Yeah, you know, ultimately, you guys kind of work yourself out of a job, which is, you know,
216
00:38:52.830 –> 00:38:57.210
Jason Mefford: It’s good, it’s good, it’s good. But it’s bad for business at the same point. But anyway, so
217
00:38:57.570 –> 00:39:06.450
Joe Oringel: It’s, it’s good for business. I was saying yesterday, you know, we’re not looking for a badge and a cube and a desk at our clients.
218
00:39:07.170 –> 00:39:14.430
Joe Oringel: Audit teams, but we what we want to do is help the people that they do have that have a badge and have a desk.
219
00:39:14.760 –> 00:39:24.090
Joe Oringel: help them get better at analytics and to be successful in their role and to do that very often, you need a coach, somebody who knows you.
220
00:39:24.390 –> 00:39:37.260
Joe Oringel: Somebody who’s been on that journey. And that’s, that’s what we we bring to folks that we work with, is that experience and that on the job ad hoc coaching as it relates to analytics.
221
00:39:37.380 –> 00:39:43.080
Jason Mefford: Yeah, and really kind of filling in the gaps, if you will, like we were talking about before when we discuss personnel.
222
00:39:44.790 –> 00:39:52.260
Jason Mefford: Excuse me, to make sure that you have, you know, people on your team that can actually implement implement and go forward with this so
223
00:39:53.430 –> 00:39:55.500
Jason Mefford: Joe again thank you and
224
00:39:56.670 –> 00:40:09.180
Jason Mefford: We’ll probably have to have you back in the future. I’m sure as well because there’s a lot to talk about here. But with that everybody we’re gonna sign off for the for today and we’ll catch you on the next episode of jam with Jason, have a good rest of your week. Thank you, Jason.
