Communicating Data Analytics Results (CIA Part 2: Information Gathering, Analysis and Evaluation)
Introduction
Communicating data analytics results is a key topic in CIA Part 2 (Practice of Internal Auditing), under the domain of Information Gathering, Analysis and Evaluation. Internal auditors increasingly use data analytics to examine whole populations, find anomalies, and assess risk. The value of that analysis depends on how well the results are communicated. A brilliant analysis presented poorly can be misunderstood, ignored, or misused.
Why It Is Important
1. Drives action: Analytics results support findings, recommendations and management action. If stakeholders cannot understand the results, corrective action will not happen.
2. Supports audit evidence quality: Under the IIA's Global Internal Audit Standards, information must be sufficient, reliable, relevant and useful. Clear communication shows that analytics-based evidence meets these criteria.
3. Builds credibility: Accurate, objective and well-explained results strengthen the reputation of the internal audit activity with the board, senior management and auditees.
4. Reduces the risk of misinterpretation: Data can easily be misread, for example by confusing correlation with causation or reading too much into outliers. Good communication explains context, limitations and assumptions.
5. Meets the needs of different audiences: Boards want concise, risk-focused insights. Operational managers need detailed, actionable information.
6. Enables continuous assurance: Dashboards and visual reports allow ongoing monitoring of risks and controls.
What It Is
Communicating data analytics results is the process of presenting the outputs of analytical procedures in a way the intended audience can understand, trust and act on. Those procedures include descriptive, diagnostic, predictive and prescriptive analytics. Communication involves:
- Interpreting results: turning raw outputs (exceptions, trends, ratios, statistical results) into meaningful insights about risk, control and performance.
- Data visualization: using charts, graphs, heat maps, dashboards and tables to show patterns and exceptions.
- Storytelling with data: building a logical narrative from the objective, through the analysis and the findings, to the conclusion and recommendation.
- Disclosing limitations: stating data sources, completeness, accuracy, the period covered, assumptions and any scope restrictions.
- Tailoring to the audience: adjusting detail, technical language and format to suit the stakeholders.
This topic links to the IIA's requirements for communication quality. Communications must be accurate, objective, clear, concise, constructive, complete and timely.
How It Works
Step 1: Understand the audience and purpose
Identify who will receive the results (board, audit committee, senior management, process owners) and what decisions they need to make. Executives usually prefer summary dashboards and key risk indicators. Process owners may need exception lists and transaction-level detail.
Step 2: Validate the results before communicating
Confirm data integrity: completeness, accuracy and reliability of the source data. Investigate exceptions to remove false positives before reporting them as findings. Reconcile record counts and control totals to source systems.
Step 3: Choose the right visualization
Common choices:
- Line charts: trends over time (e.g., monthly expense growth).
- Bar or column charts: comparisons across categories (e.g., exceptions by business unit).
- Pie charts: parts of a whole, used sparingly and with few categories.
- Scatter plots: relationships or correlations between two variables, and outliers.
- Histograms: distribution of values (e.g., invoice amounts, Benford's Law analysis).
- Heat maps: risk intensity across units or processes.
- Dashboards: several key metrics in one view, often interactive, used for continuous monitoring.
- Tables: when precise values matter.
Good visualization principles:
- Keep it simple.
- Avoid clutter and 3D effects.
- Use consistent scales and do not truncate axes misleadingly.
- Label clearly.
- Use color purposefully, for example to highlight exceptions.
- Make sure the visual does not distort the data.
Step 4: Provide context and interpretation
Explain what the results mean in business and risk terms. Quantify impact where possible, such as monetary exposure, number of transactions or percentage of the population. Compare results with benchmarks, thresholds, prior periods or policy requirements.
Step 5: Disclose methodology and limitations
State the data sources, period, tools, tests performed, and any assumptions or limitations. Examples include incomplete data, data owned by third parties, and sampling versus full-population testing. This preserves objectivity and prevents overreliance.
Step 6: Link to findings and recommendations
Analytics results become audit observations using the elements of a finding:
- Criteria: what should be.
- Condition: what is, shown by the analytics.
- Cause: why it happened.
- Effect / consequence: the risk or impact.
- Recommendation: the action needed.
Step 7: Deliver through appropriate channels
Options include formal audit reports, executive summaries, interactive dashboards, presentations, and exception reports to process owners for follow-up. Timeliness matters, because analytics often supports continuous auditing and real-time alerts.
Step 8: Protect confidentiality
Make sure sensitive data (personal data, payroll, customer information) is masked, aggregated or restricted in line with data privacy laws and organizational policy.
Common Pitfalls
- Reporting unvalidated exceptions (false positives) as findings.
- Using overly technical jargon with non-technical audiences.
- Misleading visuals, such as truncated axes, inappropriate chart types or cherry-picked data.
- Confusing correlation with causation.
- Failing to disclose data limitations.
- Information overload, meaning too many charts and no clear message.
- Ignoring privacy and confidentiality requirements.
Exam Tips: Answering Questions on Communicating Data Analytics Results
1. Think audience first: If a question asks for the best way to present results to the board or audit committee, choose concise, high-level, risk-focused summaries or dashboards, not detailed transaction listings.
2. Validation before communication: When asked what an auditor should do before reporting analytics exceptions, the answer is usually to validate or investigate them to eliminate false positives and confirm data integrity.
3. Match chart to purpose: Know which visualization fits each scenario: trend over time = line chart, comparison = bar chart, relationship = scatter plot, distribution = histogram, risk concentration = heat map, ongoing monitoring = dashboard.
4. Look for the IIA communication qualities: Accurate, objective, clear, concise, constructive, complete and timely. Wrong options often violate one of these, for example by being biased, overly detailed or misleading.
5. Spot misleading presentations: Questions may describe a chart with a truncated axis or an inappropriate scale. Identify it as a distortion that undermines objectivity.
6. Correlation is not causation: If an option concludes cause from a correlation alone, it is likely incorrect. The auditor should perform further analysis to establish root cause.
7. Disclosure of limitations: Answers that include stating data sources, assumptions and limitations are generally preferred. They support objectivity and appropriate reliance.
8. Link to the elements of a finding: Analytics results usually represent the condition. Be ready to identify which element a described item represents.
9. Confidentiality: Prefer options that protect sensitive data through masking, aggregation or restricted access.
10. Eliminate extremes: Options such as 'include all raw data in the report' or 'present only favorable results' are almost always wrong.
11. Read for the keyword 'MOST' or 'BEST': Several options may be partly correct. Choose the one that best serves the audience's decision-making needs and keeps the results reliable.
Sample Question
An internal auditor used data analytics to test 100% of vendor payments and identified 250 potential duplicate payments. What should the auditor do FIRST before reporting the results to management?
A. Present a dashboard to the audit committee showing all 250 exceptions.
B. Investigate the exceptions to confirm whether they are true duplicates.
C. Recommend the vendor master file be purged.
D. Issue the final report immediately to ensure timeliness.
Answer: B. Analytics outputs may include false positives. The auditor must validate exceptions before communicating them, so that results are accurate and reliable.
Key Takeaways
- Analytics has value only when communicated clearly, accurately and in a way that prompts action.
- Tailor content and format to the audience.
- Validate results and disclose limitations.
- Use honest, appropriate visualizations.
- Connect analytics to the criteria, condition, cause, effect and recommendation.
- Always protect confidential information.
