The development of the auditor in the digital age

Digital trust evolves. And so should auditors. It promises to be a challenging yet fun journey. Rob Fijneman remembers how in 2014, while celebrating 25 years of technology auditing education at Tilburg University, a vision was launched, inspired by a song from Talking Heads: 'We're on a road to nowhere'. As the song implies: Although we do not have all the answers, and we never will, our intention is to look to the future, and we are willing to take that ride.

This confirms the common wisdom that predicting the future is hard, which is equally valid when it comes to predicting the future of auditing.

We know that technology is fully embedded in our everyday life and in economic reality. We also know that digital transformation is ongoing at an astonishing pace, resulting in new types of organizations such as digital insurers or digital hospitals. The dominant position of technology on the board's agenda has consequences, which will also have an impact on auditing.

The working domain of the modern IT auditor now covers the whole life cycle of technology, starting from strategy through to the handling of legacy systems, from development to operations and maintenance, from conceptualizing business cases to improving IT cost efficiency, from narrow IT support to full stakeholder management. IT auditors must play a role on this level. 

The reality of today strongly differs from the practice of around 50 years ago. By then, technology was relevant in supporting financial back-office processes, and financial auditors experienced challenges in coping with technical details. This led to the start of the IT audit discipline. It quickly became apparent that there was a need for a common knowledge area between both auditing professions.

By the end of the 20^th century, my PH.D. research focused on the common body of technology knowledge that was needed in order to perform a high-quality financial statement audit. In those days, universities and post-master's programs offered different courses and the number of hours spent on technology hugely differed. A common body of knowledge was shaped by an increase in technology courses and onboarding both the audit with technology and the audit of technology.

The graph illustrates some key developments over the past 50 years. It highlights that the Audit of Technology started early and is still happening today with a focus on key financial relevant applications (application controls) as well as supporting IT general controls (embedded in the operating systems, database and network layers).

Over the past few years, the impact of algorithms and AI has increased and has become part of the audit scope.

The Audit with Technology has been boosted since 2015 by advanced data analytics (to validate application controls, ITGC's and even complete datasets) and nowadays by also using AI as an audit tool.

All of this aligns with the views of the World Economic Forum on Digital Trust: digital technologies and services – and the organizations providing them – will protect all stakeholders' interests and uphold societal expectations and values. 

As stated before, there are few certainties about the future.

Today's modern audit already encompasses many elements of technology. Not only are relevant key controls tested both in applications (IT controls) and the relevant layers of the infrastructure (IT general controls), real-time system assurance auditors are already validating the quality of new controls during system design and data migration. The review of cyber governance and any cyber incident is now part of the audit.

Nowadays, integrated teams of both financial audit and technology audit experts are moving into an era of continuous auditing while technology is being standardized. Continuous monitoring tools are real and algorithms and the like strongly support this. A so-called data driven audit is becoming reality and may replace many of today's auditing techniques.

In addition, artificial intelligence enabled solutions will further help in the evaluation and assessment of outliers. 

There is a feeling that we are ruled by compliance and risk-adverse approaches leading to a relatively slow change of agenda in our profession. We have seen other industries being swept away due to a lack of speed, and potentially this could also happen to the audit professions.

Technology could take over the control and monitoring of activities, cognitive learning models can be used to improve processes, and robots can be trained on a permanent basis to become better auditors. Ideally everything will be secured by design, and there will be no need to have concerns once tested and put into operation.

At the same time, this thinking creates opportunities. Who will validate the quality of the initial rules built into the fully automated control, monitoring and auditing systems? Someone will have to define and validate the rules used, a vital role to be played by the auditor…

In order to play this role, we need tech savvy financial auditors assisted by teams of IT audit specialists. The curriculum, initially developed in 1999, consists of several topics that are vital for this. Examples are topics such as cloud and databases, the audit of IT controls and algorithm assurance.

Hopefully, the professional body combined with company-specific courses can bring the curriculum to the next level to futureproof the profession. More than ever, we need integrated teams with team members that have a certain overlap in expertise.

Ultimately, the expertise of a financial auditor and a technology specialist will converge and form a unique symbiosis that defines the new standard. In other words, the audit of IT and the audit with IT will move closer together and form the basis for a new way of auditing and a new generation of financial auditors.

One thing is certain: it will be fun to be part of that ride. Or, to refer again to the Talking Heads song: it will be fun on the road to nowhere.