Business News

Future of internal audit in an increasingly digital world

The exposures to financial loss and data compromise in the digital space is a significant concern that requires auditors who not only understand internal business processes but also have the skills base to understand the digital processes and exposures the Bank faces.

The anonymity that digitalization brings – remote account opening processes, use of robots by tech-savvy individuals, groups and entities to simplify processes (or impersonate actual humans), single individuals creating multiple accounts either of their own making or by impersonating existing individuals – is an avenue for revenue leakage and reputational damage for Banks. Auditors need to think along such lines in the execution of their roles.

5. Evolution of Regulatory Requirements

We cannot overlook the regulatory angle of increased digitization. Regulatory frameworks will, by necessity, continue to evolve in order to put checks in place around the operation and reporting of new technologies adopted by Banks. From the use of banker’s cheques to the use money of transfer forms; from the use of ATMs to the use of internet banking and POS machines; from the use USSD (Unstructured Supplementary Service Data) codes and mobile money apps to the use of QR (Quick Response) codes, regulations have evolved to protect customers and Banks from exploitation, abuse and misuse.

Data privacy laws, information assets of customers and the internal policies on access to, storage and security over customer and Bank proprietary data/information are areas auditors need to monitor, with increasing importance as the world moves forward in the digital space. With open banking today and its use of APIs (Application Programming Interfaces), this is a key area that cannot be overlooked.

Today, we have the advent of crypto currencies. Regulations around these and future innovations need to be covered by audit teams. Processes, controls and regulations around the recognition, reporting, safeguarding and management of crypto currency accounts, account holder information, transactions and all the possible money laundry and financing of terrorism risks that such innovation can bring are areas auditors must watch out for.

The Central Bank of Nigeria issued a circular to all deposit money banks and payment service providers in February 2021 on its regulatory framework for open banking in Nigeria; CBN Regulatory Guidelines on the e-Naira was issued in October 2021 – to provide few examples of new regulations coming up in the digitization age.

The tools, knowledge and skills of internal auditors must evolve with the evolving times. The tools used to carry out audits; the knowledge – terms, terminologies, applications, options, uses – of digital platforms, outlets, services; and the skills – comfort with basic computer applications and IT (Information Technology) audit software, development of IS (Information Systems) audit skills, (re)learning – must rise to meet the changes in the industry.

The volume and breadth of transactions, reports, customer service requests, incident reports, regulatory filing and the checks that will need to be done on these items cannot be done effectively with the usual tools and cannot be done effectively using the usual processes.

Throughout the history of auditing, audit tools have had to be more advanced or at least at par with the tools used by process owners. As of today, there is no audit team that does not use a computer system and one or more software applications to carry out their audits. From the use of various Spreadsheet software applications to the Computer Assisted Audit Techniques (CAATs) i.e. specifically designed auditing software; our current audit teams leverage existing technologies in executing their roles.

Our current audit teams generally are divided – in one way or another – between business process auditors and IT/IS auditors and perhaps Investigation or Forensic teams. While IT/IS auditors specialize in the audit of information technology or information systems, the future demands that business process auditors, who are now dealing with more advanced and more technical business processes, require more advanced and more technical IT and IS audit skills to bring increased value to their audit execution and in proffering recommendations.

We know from experience that the computer knowledge, expertise and experience of our audit teams has direct impact on their ability to optimize the use of the technology available to them. Likewise, our auditors’ knowledge, expertise, and experience of existing and advancing technologies will have a direct impact on their ability to review and advise management on risks and controls related to technologies adopted by the organization.

Technological advancement in hardware and software applications, have brought about automations that continuously reduce the need for human interference in processes and by default, human interference in auditing of such processes; especially where the applications are intelligent systems that learn and evolve based on their learnings – most commonly referred to as AI (Artificial Intelligence).

We have robots responding to customer queries on websites and mobile apps, we have cookies that record and report on webpages visited by website users, we have algorithms that report on how often an item was clicked on, how long a page was open and whether a transaction was concluded on shopping sites, streaming services, social media sites, etc. We can speak to our phones and other devices, and they respond to our enquiry.

Virtual reality (VR) systems are growing in the real world – once mainly only focused on or used by gamers, now we have the metaverse where a whole ecosystem can be created for people to live digital lives, where meetings can be held in virtual reality simulated spaces by people in different locations on the globe, each fully seated at a desk or in a board room with a presentation being made by a facilitator in a virtual office with attendees using avatars of their choosing.

Accenture’s report on “Banking Top 10 Trends for 2022” provides a good summary of all the aforementioned topics and considerations. 6 of the 10 items speak directly to what we have discussed:

In conclusion, where in the past auditors used paper and the infamous green pen auditors and their tools continue to evolve to meet or stay ahead of the technologies used by businesses.

A new breed of internal auditors will be needed to move organizations forward in the digital world. Business must recognize and support this as our auditors are a vital part of our workforce – trainings, sessions, seminars, knowledge sharing, meetings and all other avenues where new technologies are discussed should have audit team members in attendance and continually learning to stay ahead of or at least in sync with the changes.

The journey has already begun, the digital role of audit in each organization must be defined, the mindsets and aspirations of internal auditors must be assessed and any roadblocks to the achievement of digital auditors must be identified and addressed by each organization.

For this, regular upskilling, trainings, attendance at seminars and knowledge-sharing sessions, continuous engagements with groups such as the Association of Chief Audit Executives of Banks in Nigeria (ACAEBIN), security agencies and continuous interactions with regulators, would serve to keep auditors abreast of new technologies, audit approaches and guidelines and regulations affecting new and emerging technologies.

Thank you for the opportunity given to NOVA Merchant Bank to host the Association on the 52nd Quarterly General Meeting. I wish you successful deliberation in the course of your meeting.






Leave a Reply

Your email address will not be published.

Back to top button