Variance Analysis

1. Why Variance Analysis Matters for the CRMA

The Certification in Risk Management Assurance (CRMA) tests your ability to evaluate how well an organization identifies, assesses, and responds to risk. Within the domain covering risk assessment approaches and data analytics, variance analysis is one of the most frequently referenced analytical techniques because it sits at the intersection of three things the exam cares about: risk identification, control monitoring, and data-driven assurance.

Variance analysis matters because:
• It converts raw data into risk signals. A deviation from what was expected is, by definition, a potential indicator that something has changed, failed, or been misrepresented.
• It is a cornerstone of analytical procedures used by internal auditors to direct audit effort toward areas of highest risk, consistent with a risk-based approach to planning and fieldwork.
• It underpins Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs). Most KRI dashboards are essentially structured variance analysis: actual versus threshold.
• It supports continuous monitoring and continuous auditing, where automated comparisons flag exceptions in near real time.
• It is a recognized fraud detection tool. Unexplained variances, or variances that are suspiciously absent, often point to manipulation.
• It helps assess whether management is operating within risk appetite and tolerance, which is the heart of risk management assurance.

On the exam, you are rarely asked to compute a variance. Instead, you are tested on whether you understand what a variance means for risk, how an internal auditor or risk practitioner should respond, and what the limitations of the technique are.

2. What Variance Analysis Is

Variance analysis is the systematic comparison of actual results against an expectation (budget, forecast, standard, prior period, benchmark, or statistical prediction), followed by the identification, quantification, and investigation of the differences.

Key terms you must know:
• Variance: the difference between actual and expected. Expressed in absolute terms (currency, units, hours) and relative terms (percentage).
• Favorable variance: actual results are better than expected (e.g., revenue higher than budget, costs lower than budget).
• Unfavorable (adverse) variance: actual results are worse than expected.
• Threshold or tolerance: the pre-defined level above which a variance is considered significant enough to warrant investigation. Thresholds are linked to materiality, risk appetite, and the cost-benefit of investigation.
• Root cause: the underlying reason for the variance, as opposed to the symptom.
• Offsetting variances: two or more variances that net against each other, potentially hiding problems when data is viewed only in aggregate.

Common types of variance analysis relevant to risk assurance:
• Budget-to-actual: compares actual performance against the approved plan. Most common in financial and operational reviews.
• Period-over-period (trend): compares the current period with prior months, quarters, or years to detect shifts in behavior or patterns.
• Forecast-to-actual: compares results with the most recent re-forecast, which tests the reliability of management's predictive capability.
• Standard cost variances: in manufacturing and operations, splits differences into price/rate variances and quantity/efficiency/usage variances.
• Benchmark variances: compares the organization or a unit against peers, industry norms, or internal best performers (e.g., branch-to-branch comparison).
• Expectation-based (predictive) variances: compares actuals to a value derived from a model, such as regression or ratio analysis, where the auditor builds an independent expectation.
• Non-financial variances: deviations in cycle time, error rates, incident counts, headcount, system downtime, customer complaints, and other operational metrics. The CRMA emphasizes that risk analytics is not limited to financial data.

3. How Variance Analysis Works in Practice

Think of the process as a disciplined cycle. Examiners like questions that test whether you know the correct order and the purpose of each step.

Step 1 – Define the objective and the risk being assessed. Ask what the variance analysis is meant to reveal: a control weakness, fraud, poor forecasting, inefficient operations, or non-compliance. The objective determines which data and which comparison base are appropriate.

Step 2 – Establish an independent expectation before looking at actuals. This is a critical professional point. If you examine actual results first and then rationalize them, the analysis is biased. Expectations should be built from reliable sources: approved budgets, historical trends, operational drivers, external benchmarks, or statistical models.

Step 3 – Set the investigation threshold. Decide what constitutes a significant variance. Typically a combination of an absolute amount and a percentage (e.g., more than 10% and more than a set currency amount) to avoid chasing large percentages on trivial balances or ignoring material amounts that are small in percentage terms. Thresholds should reflect risk appetite, materiality, and the inherent volatility of the item.

Step 4 – Obtain and validate the data. Confirm the completeness, accuracy, and consistency of both actual and expected data. A variance caused by a mapping error or a different period cut-off is not a business problem but a data problem. Data integrity testing comes before interpretation.

Step 5 – Compute and disaggregate the variances. Calculate differences at the appropriate level of granularity. Aggregated figures can mask offsetting variances, so drill down by location, product, cost center, vendor, or time period.

Step 6 – Identify significant and unusual variances. Apply the thresholds, but also use professional judgment. Look for patterns: the same unit consistently just under threshold, variances that reverse the following period, results that are too close to budget, or metrics that never change when business conditions do.

Step 7 – Investigate and corroborate explanations. Obtain management's explanation and then corroborate it with independent evidence (documents, system data, third-party confirmation, re-performance). An uncorroborated explanation is an inquiry, not evidence. This step is where most exam questions focus.

Step 8 – Determine root cause and risk implications. Classify the cause: controllable vs. uncontrollable, one-time vs. recurring, planning error vs. execution error, legitimate business change vs. error or fraud. Assess whether the variance indicates a control deficiency, an emerging risk, a breach of risk tolerance, or a reporting issue.

Step 9 – Report, recommend, and follow up. Communicate findings in terms of risk and impact, recommend actions (improve controls, refine budgets, adjust KRIs, escalate), and track remediation. Feed insights back into the risk assessment so that future planning is better informed.

4. Variance Analysis as a Risk Assessment Tool

For the CRMA, you should be able to articulate how variance analysis fits within enterprise risk management and internal audit:
• Risk-based audit planning: areas with large, unexplained, or recurring variances are candidates for higher audit priority.
• Testing the risk management process itself: if management's variance reporting is weak, late, or ignored, that is a finding about the monitoring component of the control environment, not merely about the numbers.
• KRI design: effective KRIs are leading indicators with defined thresholds, owners, and escalation paths. Variance analysis provides the mechanism for measuring against those thresholds.
• Assurance over management reporting: internal audit may evaluate whether variance explanations provided to the board are accurate and complete.
• Fraud risk: red flags include variances that are always explained by the same person, explanations that cannot be verified, results that exactly meet targets, and sudden changes in previously stable relationships.

5. Strengths and Limitations

Strengths: relatively inexpensive, uses existing data, easy to automate, provides broad coverage, directs attention efficiently, and supports both detective and monitoring controls.

Limitations (heavily tested):
• The analysis is only as good as the expectation. A padded, outdated, or politically negotiated budget produces meaningless variances.
• Aggregation can hide offsetting problems.
• Timing differences, accruals, reclassifications, and cut-off errors create apparent variances with no economic substance.
• It is backward-looking unless combined with forecasts or leading indicators.
• It identifies that something differs, not why. Root cause requires further work.
• Both management and the analyst can suffer from confirmation bias and threshold gaming (keeping variances just under the investigation trigger).
• Correlation is not causation; a plausible story is not proof.
• Favorable variances are often ignored, yet they can indicate deferred costs, under-investment, aggressive revenue recognition, or errors.

6. How to Answer Exam Questions on Variance Analysis

CRMA questions are scenario-based and ask for the best answer. Use this reasoning framework:

(a) Identify what the question is really testing. Is it asking about the purpose of the technique, the appropriate next step, the interpretation of a result, the risk implication, or a limitation?

(b) Apply the professional sequence. Expectation first, data validation second, computation third, investigation and corroboration fourth, conclusion last. Any answer that skips a step or reverses the order is usually wrong.

(c) Prefer evidence over inquiry. If management offers an explanation, the best next step is almost always to corroborate it, not to accept it or to immediately report a finding.

(d) Think in terms of risk, not just numbers. The right answer connects the variance to a risk, a control, a KRI, or risk appetite.

(e) Watch for absolute language. Options stating that variance analysis proves fraud, eliminates risk, or guarantees detection are distractors.

7. Exam Tips: Answering Questions on Variance Analysis

• Tip 1 – Significant does not mean large only. Choose answers that consider both absolute and percentage thresholds and that account for the inherent risk and volatility of the item.

• Tip 2 – Favorable variances still require investigation. If an option dismisses a favorable variance as not needing attention, it is likely wrong. Favorable results can conceal deferred maintenance, understated liabilities, or revenue recognition issues.

• Tip 3 – A variance is a symptom, not a conclusion. The correct answer typically involves determining root cause before recommending action.

• Tip 4 – Management explanation plus corroboration. When a scenario says management explained the variance, the best next step is to obtain supporting evidence, not to close the issue and not to escalate without verification.

• Tip 5 – Challenge the baseline. If the scenario hints that the budget was unrealistic, outdated, or set after the fact, the appropriate response involves assessing the reliability of the expectation before drawing conclusions about performance.

• Tip 6 – Disaggregate. If the scenario presents only consolidated figures with small total variances, the best answer often involves drilling down to detect offsetting variances.

• Tip 7 – No variance can be a red flag. Results that exactly match budget period after period, or metrics that never move despite business changes, suggest manipulation, stale data, or a broken feed.

• Tip 8 – Distinguish variance analysis from related techniques. Ratio analysis compares relationships within data; regression builds a predictive expectation; benchmarking compares with external peers; trend analysis looks across time. Variance analysis is the comparison of actual with expected and may use any of these to build the expectation.

• Tip 9 – Keep internal audit's role clear. Internal audit evaluates and tests management's variance analysis and uses it in planning. Internal audit does not set budgets, approve explanations on management's behalf, or take ownership of operational decisions, as that would impair independence and objectivity.

• Tip 10 – Link to the monitoring component. If management does not perform or act on variance analysis, frame the issue as a weakness in risk monitoring and governance, not merely a numerical discrepancy.

• Tip 11 – Data integrity before interpretation. If the question mentions a new system, a reclassification, or a change in accounting policy, consider whether the variance is a data artifact before treating it as a business or control issue.

• Tip 12 – Consider cost-benefit. Answers that recommend investigating every variance regardless of size are inconsistent with a risk-based approach. Thresholds exist to focus effort where risk is highest.

• Tip 13 – Think continuous monitoring. For questions about automation or data analytics programs, the strongest answers describe pre-defined rules and thresholds, exception reporting, ownership of follow-up, and periodic recalibration of thresholds.

• Tip 14 – Read the question stem for the verb. Identify, assess, evaluate, recommend, and conclude each imply a different stage. Match your answer to the stage requested.

8. Quick Revision Summary

• Variance analysis = actual versus expectation, then investigate significant differences.
• Build the expectation independently and before reviewing actuals.
• Use combined absolute and percentage thresholds tied to materiality and risk appetite.
• Validate data, disaggregate, and look for offsetting and recurring patterns.
• Investigate both favorable and unfavorable variances; corroborate every explanation.
• Determine root cause and translate into risk and control implications.
• Know the limitations: baseline quality, aggregation, timing, bias, and backward-looking nature.
• Internal audit evaluates and uses variance analysis; it does not own management's processes.

Master these principles, apply the professional sequence, and always choose the option that corroborates, drills down, and connects to risk, and you will handle any CRMA question on variance analysis with confidence.