Technology Increases Business Productivity, Reduces Risk and Lowers Costs

Introducing the Virtual Audit

A business crisis alerts finance leaders to their organization’s vulnerabilities. When lockdowns prevented people from being in their offices in 2020, organizations with the right technology and processes demonstrated their ability to adapt, overcome and sustain operations under extraordinary circumstances. That experience opened eyes and has led to the increasing use of technology to transform core departmental processes to improve performance, enhance financial controls, reduce risk and build a risk-intelligent culture throughout the organization. Ventana Research advocates the adoption of the “virtual audit,” an approach to managing the annual external audit that is more productive, lowers internal costs, and may reduce audit fees and expenses. A virtual audit reduces process friction and eliminates unnecessary work for both the auditor and client by providing the auditor’s staff direct (but controlled) access to an organization’s finance and accounting systems. We assert that by 2026, more than one-half of organizations will have adopted some form of a virtual audit.

A Brief Description of the Virtual Audit

A virtual audit is not the same as a remote audit. The latter is effectively the same process as an on-site audit but excludes in-person elements. However, the success of remote audits demonstrates the feasibility of redefining the process using technology. Here is a six-point summary of the virtual audit approach:

• The audit firm is provided with read-only access to the company’s general ledger with exceptions related to confidentiality, such as the payroll detail. The system’s security parameters ensure that only those with the right permissions can access systems during the defined audit period.
• Auditors have full remote access to the close management system to confirm that, for example, cash ties and that any anomalies in the system logs are investigated and properly resolved.
• Remote access is provided to any other relevant system that adds efficiency and transparency to the process and that does not pose confidentiality issues. For example, risk management and compliance will document that the necessary internal audits have been completed and approved, that all separation of duties issues or access violations have been examined and resolved, and that systems are in place to monitor security and manage access workflows.
• Auditors have read-only access to one or a limited set of data stores that serve as a “single source of truth,” aggregating required data from one or multiple systems to eliminate the need for data extracts and transformations. For example, it may be the data set that internal audit uses to analyze spending for fraud, duplicate payments or out-of-policy items, or data the external auditor typically needs for its own tests.
• Auditors access all documents remotely because the process is paperless.
• There is a secure collaborative environment that supports messaging, shared to-do lists with tasks and deadlines, and video chat to facilitate one-on-one or small group conversations in an anytime, anyplace fashion.

The virtual audit is not all-or-nothing. Each corporation’s journey to a completely virtual audit is likely to be different. Retiring legacy systems, especially ERP, just to adopt a virtual audit is unlikely to happen immediately. However, beginning the journey to a virtual audit is likely to provide the business case to speed up the retirement of aging systems. Many companies already have systems and processes in place to support a remote audit as well as manage their accounting close and compliance processes, and other changes can be implemented on a schedule that is expeditious but not disruptive.

Making the Business Case

Audits are absolutely necessary, but because they are a regulatory requirement and not strategic, organizations must find ways to minimize their cost while being fully compliant. Increasing the productivity of the finance organization, lowering the costs of the audit and potentially reducing above-average audit fees are the three main reasons underlying the business case for adopting a virtual audit.

The virtual audit can free up a considerable amount of staff time, enabling organizations to spend more time on things that improve risk management, performance and profitability. The external auditor operates in a self-service mode, which means not having to respond to a long “provided by client” list with reams of data and documents and the inevitable rounds of follow-ups. Creating a regular schedule of video chats to raise and resolve issues eliminates ongoing interruptions. Staff time not spent on audit matters can be spent more productively, for example on providing a broader set of timelier information to business leaders who increasingly rely on the department for analytics and insights.

Savings are possible and measured in the reduced internal staff time required, and because the auditors’ on-site time can be substantially reduced, there are fewer travel and accommodation expenses. And organizations that have above-benchmark audit fees may be able to reduce these by streamlining the process for the auditor.

Working virtually also makes changing the audit cycle feasible. The once-a-year audit can be broken up into semi-annual or quarterly events that make it possible to resolve issues early and reduce the amount of work that must be done at fiscal year-end.

Technology for the Virtual Audit

Technology is essential to the smooth functioning of finance and accounting departments, a point that was amply demonstrated when businesses locked down in 2020. A majority of organizations were unprepared because, as our 2019 Office of Finance Benchmark Research found, 45% of participating organizations were at the lowest level of technology competence while just 12% scored at the highest. The research also demonstrated that there is a correlation between technology competence and how well an organization performs core departmental functions such as financial and management accounting, budgeting and financial analysis. Through diligence and hard work almost all finance organizations overcame the challenges posed by lockdowns and many have profited from the experience by launching “digital transformation” initiatives, using technology to fundamentally change their core processes. The virtual audit is one such example.

Using existing, proven technologies, external auditors would have sufficient access to an organization’s books and record-keeping systems to mainly work remotely, with limited on-site presence. Instead of packing as much work as possible into a short annual visit, some of the work could be done over the course of the year, making it possible to identify issues and resolve them before year-end. Here are some considerations on the technology necessary to make the virtual audit the best approach.

Cloud-based software should be the first choice—unless there are business, regulatory or functional issues that rule it out—because the cloud deployment eliminates the constraints of having to be in a specific place at a specific time. Providing auditors with remote access to cloud-based systems is more straightforward and scalable than giving them access to on-premises systems. Cloud software is not a prerequisite to adopting the virtual audit however, and many companies will retain on-premises legacy systems for many years to come. Those still concerned about the security of the cloud should not be, because an on-premises system is verifiably more vulnerable to hacking and disasters (like floods and fires) than systems based in the cloud.

Since companies keep their books in an ERP or financial management system, these will be the primary focus of an auditor’s work. Many have accounting consolidation software to manage that process. In addition, software that manages the accounting close has become popular because it provides multiple benefits. Auditors can take advantage of the “paper trail” it creates, including file attachments, review notes, signoffs and comments. Close management software provides evidence of the strength of accounting controls as well as a comprehensive electronic file box that can be examined externally with permissions.

There are significant benefits to close automation software besides the audit. Our Office of Finance Benchmark Research demonstrates the link between the software and the ability to close sooner: 88% of organizations that have automated substantially all of their close processes complete their quarterly close in six business days or less, compared to 59% that have only automated some parts and just 40% that have little or no automation in their close.

As computing systems became more transparent and interconnected, and as companies became increasingly reliant on computer-based systems to manage every element of their operations, people recognized the importance of ensuring the security of their systems. For that reason, companies have access and systems controls in place to ensure that security is effective, and auditors need to examine these systems—ideally with a remote option—to assess their effectiveness. Software-based GRC systems that document internal controls, system tests, approvals and signoffs as well as issue resolution are also helpful in speeding the close. Similarly, risk management software embedded in an ERP system can centralize and automate security and audit to provide greater control and security while reducing manual workloads.

Digitally Transform the Audit

CFOs and finance leaders typically have looked at technology as important but not essential. Technology proved its value to finance and accounting organizations in supporting business continuity during the most challenging circumstances and it will continue to do so in more normal times. Virtualizing the audit can streamline the audit process to enhance internal staff productivity, spread workloads to avoid crunch periods and reduce stress, cut costs and make it a more cost-effective process that ensures business continuity. The year 2020 created a digital divide between a world where technology was a nice-to-have appendage to finance and accounting operations and one where executives now see it as an essential element and the means of transforming processes to make them more productive, more sustainable and less costly.