Alter Everything Podcast

AlteryxMatt

In this episode, Michael Keiffer, an Alteryx training specialist and Alteryx ACE, shares his extensive experience in data analytics, particularly in internal audit. Michael discusses the pivotal role of data analytics in improving audit processes, highlighting the limitations of traditional sampling methods. Tune in to hear about the transformative potential of tools like Alteryx in automating and enhancing audit practices, saving auditors an incredible amount of time!

Panelists

Michael Keiffer, President/Owner @ Michael P. Keiffer, CPA, P.C. - @mkeiffer, LinkedIn
Megan Bowers, Sr. Content Manager @ Alteryx - @MeganBowers, LinkedIn

Topics

Ep 195 (YT thumbnail).png

Transcript

Episode Transcription

Ep 195 Data Analytics for Internal Auditors | Alter Everything Podcast | Full Episode Audio
===

[00:00:00] Introduction to the Podcast and Guest
---

[00:00:00] Megan Bowers: Welcome to Alter Everything, a podcast about data science and analytics culture. I'm Megan Bowers, and today I am talking with Michael Keiffer, Alteryx training specialist and independent data analysis consultant. In this episode, we chat about applying data analytics in auditing, where internal audit shops face challenges, and how Alteryx is bridging the gap. Let's get started.

Hey Mike, it's great to have you on our show today. Thanks so much for joining. Could you give a quick introduction to yourself for our listeners?

[00:00:40] Mike Keiffer's Background and Career Journey
---

[00:00:40] Michael Keiffer: Sure. I'm Mike Keiffer. Currently, I'm working as a training specialist for Alteryx. I've been an Alteryx user since January of 2020. I was appointed an Alteryx ACE in August of 2024, so I'm celebrating my one-year ACE anniversary this month. One of my goals when I first started using Alteryx was to someday become an ACE, so I was really excited to realize that goal, uh, last August. I own my own company, MPK Data Analytics, and I've been providing data analytics, consulting, and training services since 2004, primarily through my own company, but I've also worked as a contractor for other software providers such as ACL and Idea. In fact, I'm still currently working as a contractor for Idea. I don't do as much training work for them. Uh, so I've been doing this work for over, uh, 20 years. My career started as a bank internal auditor. For the first, uh, 15 years or so of my career, I worked as a bank internal auditor. I also worked for a spell for American Express. And then prior to, uh, starting my own company, I worked for a company here in Phoenix, Arizona. That's where I'm based, called Avnet. They're basically, uh, in supply chain distribution. So again, a very different environment compared to bank internal auditing.

[00:01:49] Megan Bowers: Yeah, definitely. I'm really interested to hear more about your experience in the audit field and your experience being an analytics consultant there.

[00:01:58] The Role of Analytics in Auditing
---

[00:01:58] Megan Bowers: So I think a good spot to start out would be, I'd like to just hear about how you view the role of analytics in auditing.

[00:02:07] Michael Keiffer: I think analytics and internal auditing are actually auditing in general, but especially internal auditing, is a super huge component, but I think it's something that a lot of internal audit shops are not actively utilizing as effectively or as often as they could. They can definitely help develop more meaningful audit findings because without data analytics, like coming from a banking environment where, uh, the focus was on audit budgets, we did a lot of sampling where you would take a sample of 50 items or 75 items, do your testing, and then you go and present your findings to the audit client or the audit entity. And you weren't looking at like the entire population of transactions because the data was so large and most folks either didn't have the time or didn't have the tools or resources to look at the entire data population. So they were doing a lot of sampling, but I've often found that when you're presenting an audit finding, saying "We looked at a sample of 50 items and found five exceptions," by the time you get done with that sentence, the audit client is starting to nod off because it's not really terribly exciting to say, "We found five errors out of 50 transactions." When you say, "We looked at 50 million transactions and found, you know, exceptions totaling tens of thousands of dollars or hundreds of thousands of exceptions," findings like that tend to have a little bit more weight than the, the standard, "We looked at a sample of 50 or 75." So I think internal, uh, data analytics rather, in internal audit will allow internal audit shops or audit shops to do more than, I think maybe develop more complete audit findings because they're looking at the entire population and not just a sample of data.

[00:03:36] Megan Bowers: Yeah, that makes a lot of sense. So like when you see people doing smaller samples, like samples of 50, what kind of tools are they using for that versus maybe traditional analytics tools?

[00:03:47] Michael Keiffer: I see a lot of folks using Excel and it's really hard, especially within the, in the internal audit. I think just like I think in data analytics in general, it's hard to get people to let go of that death grip on Excel and start using other tools such as Alteryx because that's what they've had on their computer forever. They're very comfortable with it. But typically I've seen folks using like Excel to set their samples. And ironically, when I've taught classes, especially for Idea, for some reason, they want to use Idea to select samples. Even though Idea gives them that ability to look at a look at the entire data population. A lot of times I get surprised when I ask folks, "What would you like me to teach you about in Idea?" "Well, how are we, how could we, how are we going to do like a random sample?" I'm thinking, "I can show you that, but I'd rather show you how to test the entire population and not just a sample of data."

[00:04:31] Megan Bowers: Yeah. Yeah. That's really interesting.

[00:04:34] Challenges in Implementing Data Analytics
---

[00:04:34] Megan Bowers: I know when we talked before too, you mentioned you're going to conferences a decent amount. I'm curious like what some of your takeaways have been about using data analytics and audits from attending and speaking at some of these conferences.

[00:04:47] Michael Keiffer: I get invited to appear at a lot of conferences for the Institute of Internal Auditors, the IIA or ISACA [Information Systems Audit and Control Association]. And, uh, it seems like the general theme seems to be help us improve or get better at utilizing data analytics. And typically one of my questions I'll always ask, no matter where I'm presenting or what that topic is, I'll just say, you know, "How many folks here are, are currently utilizing data analytics?" and you'll see maybe 75% of the hands will shoot up. And I'll say, "How many folks are happy with, uh, with how they're utilizing data analytics or you're happy with where you're currently at with your desire to utilize data analytics more effectively?" Then maybe at that 75 you'll see 45 or 50 hands go up. And I'll say, "How many folks are not happy at all or you feel like you're not hitting your objectives by utilizing data analytics?" And I'll see a lot more hands, uh, go up there, but seems like the general prevailing theme is folks want to be better than where they're currently at today, and a whole variety of reasons for why they're not being successful, but no matter what presentation I'm doing, I often will pull up a slide that will say in, in 2025, "What's the biggest challenge facing internal auditors?" And that's the effective use of data analytics. And I'll say, "I've used this slide for about 15 years. I had to simply change the date. That's 2012, now we're up to 2025." But it's like that's always the ongoing conversation that's at least my takeaway, as internal audit shops want to get better at data analytics. And I think there's a whole host of reasons as to why they're not successful doing that. But um, that seems to be the general theme.

[00:06:22] Megan Bowers: Yeah. What do you think some of those reasons are? Some of the, the challenges unique to internal audit?

[00:06:28] Michael Keiffer: I think for me, like when I first began in internal audit, I had a very forward-thinking, uh, audit manager who she recognized very early on that data analytics was going to be big, whether you were in internal audit or just in general, it was going to be big for your organization. So she was really good at trying to kind of mesh data analytics with internal audit, kind of employing a good understanding of the business objectives, but how that related to the actual data. So the IT folks could tell you what kind of issues, uh, the systems were having or any breakdowns there, but they really didn't, they really couldn't relate the, uh, the data to the business objectives. Whereas the internal auditors had a pretty good understanding of what the business objectives were for the company, but they really couldn't like map that over to the actual mapping of the data or doing data analytics. 'Cause I think, uh, really where a lot of shops fall short is a lot of times internal auditors don't know how to align their business objectives with what I call the data objectives. What data will you need electronically to start knocking out these different tests that you've lined up? Uh, and I think there's like a disconnect between what the business does and how it actually relates to their data. So I think that's often one of the biggest, uh, the biggest disconnects.

[00:07:37] Megan Bowers: I think you do see that in all sorts of departments throughout organizations. The disconnect between the people who know about the data and then those that control it or manage it. So that can always be a challenge for sure. But, but I think that was interesting what you said about identifying the data objectives in addition to your test and audit objectives.

[00:08:00] Michael Keiffer: Sometimes too, the disconnect can be like where to go to get the data or who to talk to. So I always, oftentimes I will encourage the internal auditors, find out who the gatekeepers are, the folks that control the data, that have access to the data. And then you want to make them your big 'asbestos buddy.' You know, you really want to develop those good relationships because those, they can really make or break your audit projects. So, as a good example for that, Avnet, the company that I mentioned, uh, we used an off-the-shelf mainframe system called Genesis. They made a lot of modifications to it over the years and there really wasn't a whole lot of documentation nearby that actually told you about the system. But we had one person, uh, her name is Ida Vio. I still remember her name to this day, and I made her my best buddy in the whole world. Anytime we did anything, even that remotely touched the Genesis system, she was the first person I called. We called because she knew where to find everything. So a lot of times as I was mapping up or trying to align my test objectives with the data objectives, I would call her, for example, "We're looking to see, we had some vendors who were being miscoded as being exempt from paying sales tax 'cause they were resellers." So I just simply called Ida and said, "Okay, I'm trying to do some analytics on our vendors here. We're having some issues where we were getting assessed tax penalties, interests and penalties and back taxes because we had vendors that were set up as resellers tax exempt, but in reality they really were not." And so she essentially showed me exactly where to go, what system, what fields to look at, to identify who were properly set up as tax exempt vendors and who weren't. I could ask her the business questions. She could give me the specific answers within the data, where to find or how to test for those business questions.

[00:09:37] Megan Bowers: That's really interesting. It seems like there, I had another conversation recently around the need for almost like a, a translator translating between the business needs and then the data sources you already have. So identifying those people at your company. Ideally there would be documentation, but so many times there isn't. And I experienced that at a previous company as well, where even after I left that company, I got messages of, "Hey, do you remember what's in this table?" I'm like, "You guys gotta start documenting that." But either way, it's definitely a need and, and you do need to like rely on those people and identify kind of your key stakeholders there. But yeah, I like that example. Do you have any other examples of like untapped opportunities to leverage data analytics in auditing?

[00:10:25] Michael Keiffer: Yeah, I think, uh, that's definitely the, uh, uh, the operative key word is I think there are just, uh, numerous untapped opportunities just because I don't think folks really realize what's there. So as an example, I have one, uh, restaurant, Texas Roadhouse, one of my clients. And so I actually asked that same question. I said, "What kind of data analytics are you currently running right now?" And there's like this long pause in the room and someone said, "Well, that's what you're here for. We're hoping you could tell us what we should be doing with data analytics." And that really took me by surprise because I've, I'm thinking to myself, uh, in all of your audits, uh, not employing data analytics should be the exception and not the rule. And you really don't even have to think that hard about where to start deploying data analytics. So I uh, answered his question with a question. I said, "Well, do you have employees?" He said, "Well, of course we do." "Do you have vendors at your company? Are you making payments to those vendors?" And I said, "Well, one thing you could do right off the bat would be like a duplicate, um, accounts payable, uh, where you're making duplicate, uh, AP payments to your vendors. You could do that test, uh, tomorrow if you have employees. You can compare your employees to vendors and vice versa. A big risk there is looking to see, 'Do you have employees who are masquerading as vendors or vice versa because of a conflict of interest?' Um, I said, 'Do your, uh, do your employees travel?' You could review their travel and entertainment expenses. If you're using, uh, procurement cards, PCards, you could look at, uh, PCard purchases for personal transactions." In fact, a friend of mine had just got done putting together a dashboard using Power BI, and I believe American Express was a credit card vendor for his company. And he showed me a list of, I think by transaction amount, spends, uh, using their PCard. And, uh, the number one hit for the most dollars was like a, it was like a, a racing simulation vendor. And I said, "Uh, Greg, do me a favor on that one little table there. Pivot the that from doing the highest dollars to the volume of transactions, total number of transactions." So I had a feeling before you even, before you even changed the, uh, the uh, dashboard, I knew that if it goes from total dollars to number of transaction, volume of transactions, I figured Apple iTunes or the iTunes store, and Amazon would be in the top three, and they both were. Without even seeing the data. I knew right off the bat, just by knowing like human nature, I figured you probably have some employees there who are using their PCard. 'Cause the mentality might be, 'It's a small dollar amount, it's going to slide below the radar. No one's going to notice it.'" So you see different things like that. So I really think for some reason, auditors think that employing data analytics that they're, and their, within their internal audits is a hard endeavor and I try to encourage them it is actually really easier than you think. If you have, you have a general ledger, there's a whole host of data analytics you can do on your general ledger, GL entries that don't balance, manual entries that look suspect. You see a lot of postings to the suspense account or miscellaneous, you might want to take a peek at that. If you have a lot of folks making GL postings after quarter-end close or year-end close, you might want to take a, a look at that, so, um,

[00:13:19] Megan Bowers: Sounds suspicious.

[00:13:21] Michael Keiffer: Yeah, so there's really a lot of, I guess I, I would think it would be harder to not do data analytics on an internal audit than to try to find a way to employ, uh, data analytics, what I would call the low-hanging fruit. All companies have vendors, employees, they're making payments to those vendors. They have a general ledger, system access. Don't even get me started on system access. But again, everything is controlled by data. And if you work for a bank or a healthcare client or a hospital system, that data is obviously very secure. Of course, there's going to be a lot of confidential data, and if you're in healthcare, there's actually regulations, uh, HIPAA, surrounding, you know, the protection of that data. Just doing a system access review, looking to see how many of your employees have access to your data after they've been terminated is a really good test to do. If you have a disgruntled employee that has a lot of system access after they've been terminated, they can do a lot of damage to your company. And that's why I always say it's really important to make sure your employees are 'tittled,' as opposed to 'disgruntled.' You want happy, you want happy employees.

[00:14:22] Megan Bowers: Yeah, fair enough.

[00:14:24] Success Stories and Practical Applications
---

[00:14:24] Megan Bowers: I'm curious to hear too about maybe some success stories that you've seen for people and companies using Alteryx for some of those data analytics challenges, for some maybe transforming some audit processes. Like where have you seen people have success?

[00:14:42] Michael Keiffer: One success story I wanted to say right off the bat is, uh, Arizona Blue Cross and Blue Shield. They were talking about how they were getting a lot of information, a lot of data from PDF files, and so they were having people manually grabbing the data from those PDF files. I think they were like typing, like in, like typing the data into like an Excel spreadsheet to get answers to, uh, different questions from these scanned PDF files. And then using Designer and Intelligence Suite, they can read in the scanned PDF documents, they can scrape the data from those PDFs. And the manager that was doing that process said last year they saved like 935,000 man-hours from what was a very manual process of this. Literally going through this PDF. And I know in true audit shops, they get a lot of PDF files. Those are kind of like a, the file type I tell them to try to avoid if at all possible. But if you have Alteryx and Intelligence Suite, you can actually use those files fairly effectively.

[00:15:37] Megan Bowers: Yeah. I honestly can't imagine working with PDFs without a tool like Alteryx and Intelligence Suite. It sounds really tedious to, to have to sort through PDFs to me, so that's a huge one. That's crazy time savings too. Oh yeah. Inconceivable amount of time saved. Um,

[00:15:55] Michael Keiffer: Yeah, I thought that 935,000 is a pretty big number, but I know as, like I said, PDFs can be a tedious process. And then another one, going back to bank system access testing using Alteryx. Uh, I had a banking client that, uh, they wanted to review system access for all their employees across the entire bank. And then what they also wanted to do was they wanted to prepare a list of, uh, individual employees by manager showing their branch or department, all their employees under them who was required to have a system access review. And they also wanted to create an email where they wanted to email these reports for their, uh, the employees coming up for a system access review automatically. So I developed a workflow, uh, in Alteryx that could actually go through, read through the data. The data was very messy because what they had was like this, uh, text file, and they had the system access templates embedded with the actual system access assigned to the individual employees. So you had to basically separate the system access for a bank teller, a branch manager, a loan officer from the actual templates the access that was actually granted by the individual employee. So then compare to see, did they have the right access based on their role within the bank? So if you're a bank teller, you might have access to different applications than say from an admin assistant or a branch manager. And so I think at the end of the day I created close to, I think 350 plus individuals, individual Excel files. And then each one of those files was emailed, automatically had a list, a separate little macro, had a list of the, the managers who were supposed to be receiving these reports. Automated the process of not only creating these Excel files from pretty messy data, but also automatically emailing the appropriate uh, uh, manager within the bank. I think they told me they were spending, I think six to nine weeks with up to six employees doing this once a year. Very manual process took over two plus months, and I think we timed it a couple of times. How long it took the macro, the workflow in Designer to run. And I think the longest it took was like a minute and a half. In fact, when I got on the phone call to present my findings, I said, "Someone go and kick off the workflow and I'll hit the run button." And, um, I borrowed off the folder where it's going to show where all the Excel files were going to be, were going to be placed, the folder was empty. So I said, "Okay, Shannon, where should I send the files?" And she's like, "They're done." I go, "Yeah." I go, "No, they're not." I go, "Yes, they are." "No, it's not." "Yes, it is." I, it took me longer to convince her the workflow had finished running, than it actually took for the workflow to complete, but she really could not believe that it, that it actually ran as quickly as it did. Going from, you know, two plus almost a two-month process once a year to literally, the workflow ran, like I said, about a minute, 30 seconds.

[00:18:29] Megan Bowers: Yeah. That's just crazy productivity gains it seemed like. Yeah. Your first example, being able to unlock like new file formats, like PDFs, being able to like read those more systematically and process those as well as just like automating other processes like emailing. That's very cool. Yeah, that part they really

[00:18:49] Michael Keiffer: liked because again, they literally, I said, as long as they can find the workflow and hit run, they could put it on the server. I think they were looking at getting an Alteryx Server to get, to simply run that workflow from Server so that way they could just schedule it and have it and do its thing. They wouldn't even have to touch the Designer, but yeah, they were really, they couldn't believe it, how, how easy and effective Alteryx was at doing that work. Especially given how the structure of the file was actually pretty, pretty messy. System access report, kind of like, uh, PDFs, it can be a little bit on the tedious side to work with 'cause they're not super structured in terms of, you know, the format of the data.

[00:19:20] Megan Bowers: Yeah, yeah. And can you talk a little bit about some of the differences between an Alteryx workflow and an Excel workbook that's been like really, you know, has a lot of formulas, has a whole process, just for folks that are unfamiliar with Alteryx, like the repeatability and scalability of that.

[00:19:39] Michael Keiffer: Oh yeah, yeah. I was doing a, another training class where I was going through and demonstrating basically processes you would do in Excel and how those would translate to Alteryx. And at one point someone said, "We can do this in Excel. Why would I need to do this in Alteryx?" I say, "That's a fair question. Let's say you put in all your formulas here, maybe even have like a pivot table or two, uh, some different reporting outputs here. Once you're done with that, you have that process done, but it's basically static just for the data that you put in. So now you want to do that for next month's data coming in. How would you basically replicate that process?" Or maybe you want to automatically feed that data into your workbook, apply those formulas, do your pivots and all that, and there's that long pause and someone goes, "I could write a macro in Excel." I said, "Yeah, you can have, you would have to write a program in Excel, a macro, and using Visual Basic is the language that you would use in Excel to automate that process." And I've done some work with Visual Basic, and it's a, it's a, not a bad programming language, but again, you have to essentially know how to code to automate that process. And I said, "Well, now a Designer here. Once you have that workflow built, guess what? Now it's automated. It's very easy to simply swap out the old data for the new data, but you can easily now pull new data into your workflow, set up a macro, automate that process if you'd like. But once you're done building the workflow, not only is your data analytics completed, you've actually built the automation at the same time," and I think especially for folks in internal audit, that's where the game changer is at with Designer, because you don't have to take that second step to now go back and write a program, or write a script or write a macro to automate that process.

[00:21:17] Megan Bowers: Yeah, 100%. And you don't have to know how to code, which is huge, especially if you create this process and you do have to hand it off to someone in the future who might not have the VBA skills that you have. See that as like a huge win for sure. With the automation piece.

[00:21:33] Michael Keiffer: I think you kind of mentioned before why a lot of audit shops maybe weren't embracing, uh, data analytics. And I think that's because coming from working with a lot of folks that were initially using ACL. ACL was the same way. You would, it'd be like a two-step process. You could run the analytics manually through the user interface. Then if folks wanted to automate that process, you would have to build again, a fairly involved script. My old training manager at ACL, Michael Kaner, was actually the one who said, "Have you heard of Alteryx?" He was actually the one that made me aware that Alteryx was even out there. And I think when I saw the Transpose tool run for the first time, I was like, "Hey, you've gotta be kidding me." Because doing this in ACL involved a very complicated script to pivot data from horizontal to vertical. One tool on the canvas, and for me it's like, "Okay, this is definitely a, a better mouse trap."

[00:22:20] Megan Bowers: Yeah, I'm sold. Yeah. That's awesome.

[00:22:23] Getting Started with Alteryx
---

[00:22:23] Megan Bowers: So what would your advice be for auditors who are looking to get started with Alteryx and get started doing some more analytics and automation for their processes?

[00:22:34] Michael Keiffer: I would say the first thing they would want to do is, uh, Alteryx does have the trial license, so I would definitely say get the trial license and then, uh, joining the Alteryx User Community. And then just seeing what some folks have posted there about, uh, different ways to employ data analytics in an internal audit environment. Uh, maybe do some of the weekly challenges, start doing some of the interactive lessons that they have there. To get that exposure and maybe even pick like a project, something that you would do in Excel or something that you're fairly comfortable doing, and then try and do that same project in Alteryx and see how that goes and getting the feedback from that process alone. I think for folks that are more visual, uh, especially for internal auditors, seeing the workflow set up, having the tools on the canvas, seeing how the data progresses through that workflow, visually, I think folks can probably relate to that much better than just seeing raw data in an Excel spreadsheet. So,

[00:23:24] Megan Bowers: Yeah, yeah, you can start to see what transformations are happening and go back. That's something I've heard from people is the ability to like, go back three steps, look at the data there, see what happened. Whereas sometimes in Excel, you already created a new column or like reformatted some existing thing and it's like, "Oh no, I lost that data," kind of thing. And so I think that's good advice to, to try it out with an existing Excel process that you have and see, um, see what it could look like in Designer.

[00:23:54] Michael Keiffer: When I first started working with my sales rep at Alteryx, uh, that was actually one of the first things that I did was I got my trial license and I took an, an audit or a process that I did using ACL and I put that through Designer. And like I said, it took one project for me to realize, "Okay, this is, this is a better, you know, a better mousetrap." And again, I think with the way Designer is laid out, the one-tool examples, there's just so many great resources that are there to really help minimize that learning curve. And I tell folks, you can be very, very productive with Designer, literally in a matter of hours as opposed to days, weeks, or months, or maybe even longer. Some folks never even get there with tools like ACL or Idea. They never really get to where they, they want to be. So.

[00:24:35] Megan Bowers: That's awesome.

[00:24:36] Conclusion and Farewell
---

[00:24:36] Megan Bowers: Thanks so much, Mike, for coming on the podcast. It's been really interesting to hear about your field and all of your expertise, so thanks for joining us.

[00:24:44] Michael Keiffer: Oh, thank you so much, Megan. Thank you for having me. It's, I really, I really enjoy being a part of the podcast. So, uh, yeah, it was definitely my pleasure to be here, so thank you.

[00:24:52] Megan Bowers: Thanks for listening to Connect with Michael. Head over to our show notes on alteryx.com/podcast. And if you like this episode, leave us a review. See you next time.

Ep 195 Data Analytics for Internal Auditors | Alter Everything Podcast | Full Episode Audio=== [00:00:00] Introduction to the Podcast and Guest--- [00:00:00] Megan Bowers: Welcome to Alter Everything, a podcast about data science and analytics culture. I'm Megan Bowers, and today I am talking with Michael Keiffer, Alteryx training specialist and independent data analysis consultant. In this episode, we chat about applying data analytics in auditing, where internal audit shops face challenges, and how Alteryx is bridging the gap. Let's get started. Hey Mike, it's great to have you on our show today. Thanks so much for joining. Could you give a quick introduction to yourself for our listeners? [00:00:40] Mike Keiffer's Background and Career Journey--- [00:00:40] Michael Keiffer: Sure. I'm Mike Keiffer. Currently, I'm working as a training specialist for Alteryx. I've been an Alteryx user since January of 2020. I was appointed an Alteryx ACE in August of 2024, so I'm celebrating my one-year ACE anniversary this month. One of my goals when I first started using Alteryx was to someday become an ACE, so I was really excited to realize that goal, uh, last August. I own my own company, MPK Data Analytics, and I've been providing data analytics, consulting, and training services since 2004, primarily through my own company, but I've also worked as a contractor for other software providers such as ACL and Idea. In fact, I'm still currently working as a contractor for Idea. I don't do as much training work for them. Uh, so I've been doing this work for over, uh, 20 years. My career started as a bank internal auditor. For the first, uh, 15 years or so of my career, I worked as a bank internal auditor. I also worked for a spell for American Express. And then prior to, uh, starting my own company, I worked for a company here in Phoenix, Arizona. That's where I'm based, called Avnet. They're basically, uh, in supply chain distribution. So again, a very different environment compared to bank internal auditing. [00:01:49] Megan Bowers: Yeah, definitely. I'm really interested to hear more about your experience in the audit field and your experience being an analytics consultant there. [00:01:58] The Role of Analytics in Auditing--- [00:01:58] Megan Bowers: So I think a good spot to start out would be, I'd like to just hear about how you view the role of analytics in auditing. [00:02:07] Michael Keiffer: I think analytics and internal auditing are actually auditing in general, but especially internal auditing, is a super huge component, but I think it's something that a lot of internal audit shops are not actively utilizing as effectively or as often as they could. They can definitely help develop more meaningful audit findings because without data analytics, like coming from a banking environment where, uh, the focus was on audit budgets, we did a lot of sampling where you would take a sample of 50 items or 75 items, do your testing, and then you go and present your findings to the audit client or the audit entity. And you weren't looking at like the entire population of transactions because the data was so large and most folks either didn't have the time or didn't have the tools or resources to look at the entire data population. So they were doing a lot of sampling, but I've often found that when you're presenting an audit finding, saying "We looked at a sample of 50 items and found five exceptions," by the time you get done with that sentence, the audit client is starting to nod off because it's not really terribly exciting to say, "We found five errors out of 50 transactions." When you say, "We looked at 50 million transactions and found, you know, exceptions totaling tens of thousands of dollars or hundreds of thousands of exceptions," findings like that tend to have a little bit more weight than the, the standard, "We looked at a sample of 50 or 75." So I think internal, uh, data analytics rather, in internal audit will allow internal audit shops or audit shops to do more than, I think maybe develop more complete audit findings because they're looking at the entire population and not just a sample of data. [00:03:36] Megan Bowers: Yeah, that makes a lot of sense. So like when you see people doing smaller samples, like samples of 50, what kind of tools are they using for that versus maybe traditional analytics tools? [00:03:47] Michael Keiffer: I see a lot of folks using Excel and it's really hard, especially within the, in the internal audit. I think just like I think in data analytics in general, it's hard to get people to let go of that death grip on Excel and start using other tools such as Alteryx because that's what they've had on their computer forever. They're very comfortable with it. But typically I've seen folks using like Excel to set their samples. And ironically, when I've taught classes, especially for Idea, for some reason, they want to use Idea to select samples. Even though Idea gives them that ability to look at a look at the entire data population. A lot of times I get surprised when I ask folks, "What would you like me to teach you about in Idea?" "Well, how are we, how could we, how are we going to do like a random sample?" I'm thinking, "I can show you that, but I'd rather show you how to test the entire population and not just a sample of data." [00:04:31] Megan Bowers: Yeah. Yeah. That's really interesting. [00:04:34] Challenges in Implementing Data Analytics--- [00:04:34] Megan Bowers: I know when we talked before too, you mentioned you're going to conferences a decent amount. I'm curious like what some of your takeaways have been about using data analytics and audits from attending and speaking at some of these conferences. [00:04:47] Michael Keiffer: I get invited to appear at a lot of conferences for the Institute of Internal Auditors, the IIA or ISACA [Information Systems Audit and Control Association]. And, uh, it seems like the general theme seems to be help us improve or get better at utilizing data analytics. And typically one of my questions I'll always ask, no matter where I'm presenting or what that topic is, I'll just say, you know, "How many folks here are, are currently utilizing data analytics?" and you'll see maybe 75% of the hands will shoot up. And I'll say, "How many folks are happy with, uh, with how they're utilizing data analytics or you're happy with where you're currently at with your desire to utilize data analytics more effectively?" Then maybe at that 75 you'll see 45 or 50 hands go up. And I'll say, "How many folks are not happy at all or you feel like you're not hitting your objectives by utilizing data analytics?" And I'll see a lot more hands, uh, go up there, but seems like the general prevailing theme is folks want to be better than where they're currently at today, and a whole variety of reasons for why they're not being successful, but no matter what presentation I'm doing, I often will pull up a slide that will say in, in 2025, "What's the biggest challenge facing internal auditors?" And that's the effective use of data analytics. And I'll say, "I've used this slide for about 15 years. I had to simply change the date. That's 2012, now we're up to 2025." But it's like that's always the ongoing conversation that's at least my takeaway, as internal audit shops want to get better at data analytics. And I think there's a whole host of reasons as to why they're not successful doing that. But um, that seems to be the general theme. [00:06:22] Megan Bowers: Yeah. What do you think some of those reasons are? Some of the, the challenges unique to internal audit? [00:06:28] Michael Keiffer: I think for me, like when I first began in internal audit, I had a very forward-thinking, uh, audit manager who she recognized very early on that data analytics was going to be big, whether you were in internal audit or just in general, it was going to be big for your organization. So she was really good at trying to kind of mesh data analytics with internal audit, kind of employing a good understanding of the business objectives, but how that related to the actual data. So the IT folks could tell you what kind of issues, uh, the systems were having or any breakdowns there, but they really didn't, they really couldn't relate the, uh, the data to the business objectives. Whereas the internal auditors had a pretty good understanding of what the business objectives were for the company, but they really couldn't like map that over to the actual mapping of the data or doing data analytics. 'Cause I think, uh, really where a lot of shops fall short is a lot of times internal auditors don't know how to align their business objectives with what I call the data objectives. What data will you need electronically to start knocking out these different tests that you've lined up? Uh, and I think there's like a disconnect between what the business does and how it actually relates to their data. So I think that's often one of the biggest, uh, the biggest disconnects. [00:07:37] Megan Bowers: I think you do see that in all sorts of departments throughout organizations. The disconnect between the people who know about the data and then those that control it or manage it. So that can always be a challenge for sure. But, but I think that was interesting what you said about identifying the data objectives in addition to your test and audit objectives. [00:08:00] Michael Keiffer: Sometimes too, the disconnect can be like where to go to get the data or who to talk to. So I always, oftentimes I will encourage the internal auditors, find out who the gatekeepers are, the folks that control the data, that have access to the data. And then you want to make them your big 'asbestos buddy.' You know, you really want to develop those good relationships because those, they can really make or break your audit projects. So, as a good example for that, Avnet, the company that I mentioned, uh, we used an off-the-shelf mainframe system called Genesis. They made a lot of modifications to it over the years and there really wasn't a whole lot of documentation nearby that actually told you about the system. But we had one person, uh, her name is Ida Vio. I still remember her name to this day, and I made her my best buddy in the whole world. Anytime we did anything, even that remotely touched the Genesis system, she was the first person I called. We called because she knew where to find everything. So a lot of times as I was mapping up or trying to align my test objectives with the data objectives, I would call her, for example, "We're looking to see, we had some vendors who were being miscoded as being exempt from paying sales tax 'cause they were resellers." So I just simply called Ida and said, "Okay, I'm trying to do some analytics on our vendors here. We're having some issues where we were getting assessed tax penalties, interests and penalties and back taxes because we had vendors that were set up as resellers tax exempt, but in reality they really were not." And so she essentially showed me exactly where to go, what system, what fields to look at, to identify who were properly set up as tax exempt vendors and who weren't. I could ask her the business questions. She could give me the specific answers within the data, where to find or how to test for those business questions. [00:09:37] Megan Bowers: That's really interesting. It seems like there, I had another conversation recently around the need for almost like a, a translator translating between the business needs and then the data sources you already have. So identifying those people at your company. Ideally there would be documentation, but so many times there isn't. And I experienced that at a previous company as well, where even after I left that company, I got messages of, "Hey, do you remember what's in this table?" I'm like, "You guys gotta start documenting that." But either way, it's definitely a need and, and you do need to like rely on those people and identify kind of your key stakeholders there. But yeah, I like that example. Do you have any other examples of like untapped opportunities to leverage data analytics in auditing? [00:10:25] Michael Keiffer: Yeah, I think, uh, that's definitely the, uh, uh, the operative key word is I think there are just, uh, numerous untapped opportunities just because I don't think folks really realize what's there. So as an example, I have one, uh, restaurant, Texas Roadhouse, one of my clients. And so I actually asked that same question. I said, "What kind of data analytics are you currently running right now?" And there's like this long pause in the room and someone said, "Well, that's what you're here for. We're hoping you could tell us what we should be doing with data analytics." And that really took me by surprise because I've, I'm thinking to myself, uh, in all of your audits, uh, not employing data analytics should be the exception and not the rule. And you really don't even have to think that hard about where to start deploying data analytics. So I uh, answered his question with a question. I said, "Well, do you have employees?" He said, "Well, of course we do." "Do you have vendors at your company? Are you making payments to those vendors?" And I said, "Well, one thing you could do right off the bat would be like a duplicate, um, accounts payable, uh, where you're making duplicate, uh, AP payments to your vendors. You could do that test, uh, tomorrow if you have employees. You can compare your employees to vendors and vice versa. A big risk there is looking to see, 'Do you have employees who are masquerading as vendors or vice versa because of a conflict of interest?' Um, I said, 'Do your, uh, do your employees travel?' You could review their travel and entertainment expenses. If you're using, uh, procurement cards, PCards, you could look at, uh, PCard purchases for personal transactions." In fact, a friend of mine had just got done putting together a dashboard using Power BI, and I believe American Express was a credit card vendor for his company. And he showed me a list of, I think by transaction amount, spends, uh, using their PCard. And, uh, the number one hit for the most dollars was like a, it was like a, a racing simulation vendor. And I said, "Uh, Greg, do me a favor on that one little table there. Pivot the that from doing the highest dollars to the volume of transactions, total number of transactions." So I had a feeling before you even, before you even changed the, uh, the uh, dashboard, I knew that if it goes from total dollars to number of transaction, volume of transactions, I figured Apple iTunes or the iTunes store, and Amazon would be in the top three, and they both were. Without even seeing the data. I knew right off the bat, just by knowing like human nature, I figured you probably have some employees there who are using their PCard. 'Cause the mentality might be, 'It's a small dollar amount, it's going to slide below the radar. No one's going to notice it.'" So you see different things like that. So I really think for some reason, auditors think that employing data analytics that they're, and their, within their internal audits is a hard endeavor and I try to encourage them it is actually really easier than you think. If you have, you have a general ledger, there's a whole host of data analytics you can do on your general ledger, GL entries that don't balance, manual entries that look suspect. You see a lot of postings to the suspense account or miscellaneous, you might want to take a peek at that. If you have a lot of folks making GL postings after quarter-end close or year-end close, you might want to take a, a look at that, so, um, [00:13:19] Megan Bowers: Sounds suspicious. [00:13:21] Michael Keiffer: Yeah, so there's really a lot of, I guess I, I would think it would be harder to not do data analytics on an internal audit than to try to find a way to employ, uh, data analytics, what I would call the low-hanging fruit. All companies have vendors, employees, they're making payments to those vendors. They have a general ledger, system access. Don't even get me started on system access. But again, everything is controlled by data. And if you work for a bank or a healthcare client or a hospital system, that data is obviously very secure. Of course, there's going to be a lot of confidential data, and if you're in healthcare, there's actually regulations, uh, HIPAA, surrounding, you know, the protection of that data. Just doing a system access review, looking to see how many of your employees have access to your data after they've been terminated is a really good test to do. If you have a disgruntled employee that has a lot of system access after they've been terminated, they can do a lot of damage to your company. And that's why I always say it's really important to make sure your employees are 'tittled,' as opposed to 'disgruntled.' You want happy, you want happy employees. [00:14:22] Megan Bowers: Yeah, fair enough. [00:14:24] Success Stories and Practical Applications--- [00:14:24] Megan Bowers: I'm curious to hear too about maybe some success stories that you've seen for people and companies using Alteryx for some of those data analytics challenges, for some maybe transforming some audit processes. Like where have you seen people have success? [00:14:42] Michael Keiffer: One success story I wanted to say right off the bat is, uh, Arizona Blue Cross and Blue Shield. They were talking about how they were getting a lot of information, a lot of data from PDF files, and so they were having people manually grabbing the data from those PDF files. I think they were like typing, like in, like typing the data into like an Excel spreadsheet to get answers to, uh, different questions from these scanned PDF files. And then using Designer and Intelligence Suite, they can read in the scanned PDF documents, they can scrape the data from those PDFs. And the manager that was doing that process said last year they saved like 935,000 man-hours from what was a very manual process of this. Literally going through this PDF. And I know in true audit shops, they get a lot of PDF files. Those are kind of like a, the file type I tell them to try to avoid if at all possible. But if you have Alteryx and Intelligence Suite, you can actually use those files fairly effectively. [00:15:37] Megan Bowers: Yeah. I honestly can't imagine working with PDFs without a tool like Alteryx and Intelligence Suite. It sounds really tedious to, to have to sort through PDFs to me, so that's a huge one. That's crazy time savings too. Oh yeah. Inconceivable amount of time saved. Um, [00:15:55] Michael Keiffer: Yeah, I thought that 935,000 is a pretty big number, but I know as, like I said, PDFs can be a tedious process. And then another one, going back to bank system access testing using Alteryx. Uh, I had a banking client that, uh, they wanted to review system access for all their employees across the entire bank. And then what they also wanted to do was they wanted to prepare a list of, uh, individual employees by manager showing their branch or department, all their employees under them who was required to have a system access review. And they also wanted to create an email where they wanted to email these reports for their, uh, the employees coming up for a system access review automatically. So I developed a workflow, uh, in Alteryx that could actually go through, read through the data. The data was very messy because what they had was like this, uh, text file, and they had the system access templates embedded with the actual system access assigned to the individual employees. So you had to basically separate the system access for a bank teller, a branch manager, a loan officer from the actual templates the access that was actually granted by the individual employee. So then compare to see, did they have the right access based on their role within the bank? So if you're a bank teller, you might have access to different applications than say from an admin assistant or a branch manager. And so I think at the end of the day I created close to, I think 350 plus individuals, individual Excel files. And then each one of those files was emailed, automatically had a list, a separate little macro, had a list of the, the managers who were supposed to be receiving these reports. Automated the process of not only creating these Excel files from pretty messy data, but also automatically emailing the appropriate uh, uh, manager within the bank. I think they told me they were spending, I think six to nine weeks with up to six employees doing this once a year. Very manual process took over two plus months, and I think we timed it a couple of times. How long it took the macro, the workflow in Designer to run. And I think the longest it took was like a minute and a half. In fact, when I got on the phone call to present my findings, I said, "Someone go and kick off the workflow and I'll hit the run button." And, um, I borrowed off the folder where it's going to show where all the Excel files were going to be, were going to be placed, the folder was empty. So I said, "Okay, Shannon, where should I send the files?" And she's like, "They're done." I go, "Yeah." I go, "No, they're not." I go, "Yes, they are." "No, it's not." "Yes, it is." I, it took me longer to convince her the workflow had finished running, than it actually took for the workflow to complete, but she really could not believe that it, that it actually ran as quickly as it did. Going from, you know, two plus almost a two-month process once a year to literally, the workflow ran, like I said, about a minute, 30 seconds. [00:18:29] Megan Bowers: Yeah. That's just crazy productivity gains it seemed like. Yeah. Your first example, being able to unlock like new file formats, like PDFs, being able to like read those more systematically and process those as well as just like automating other processes like emailing. That's very cool. Yeah, that part they really [00:18:49] Michael Keiffer: liked because again, they literally, I said, as long as they can find the workflow and hit run, they could put it on the server. I think they were looking at getting an Alteryx Server to get, to simply run that workflow from Server so that way they could just schedule it and have it and do its thing. They wouldn't even have to touch the Designer, but yeah, they were really, they couldn't believe it, how, how easy and effective Alteryx was at doing that work. Especially given how the structure of the file was actually pretty, pretty messy. System access report, kind of like, uh, PDFs, it can be a little bit on the tedious side to work with 'cause they're not super structured in terms of, you know, the format of the data. [00:19:20] Megan Bowers: Yeah, yeah. And can you talk a little bit about some of the differences between an Alteryx workflow and an Excel workbook that's been like really, you know, has a lot of formulas, has a whole process, just for folks that are unfamiliar with Alteryx, like the repeatability and scalability of that. [00:19:39] Michael Keiffer: Oh yeah, yeah. I was doing a, another training class where I was going through and demonstrating basically processes you would do in Excel and how those would translate to Alteryx. And at one point someone said, "We can do this in Excel. Why would I need to do this in Alteryx?" I say, "That's a fair question. Let's say you put in all your formulas here, maybe even have like a pivot table or two, uh, some different reporting outputs here. Once you're done with that, you have that process done, but it's basically static just for the data that you put in. So now you want to do that for next month's data coming in. How would you basically replicate that process?" Or maybe you want to automatically feed that data into your workbook, apply those formulas, do your pivots and all that, and there's that long pause and someone goes, "I could write a macro in Excel." I said, "Yeah, you can have, you would have to write a program in Excel, a macro, and using Visual Basic is the language that you would use in Excel to automate that process." And I've done some work with Visual Basic, and it's a, it's a, not a bad programming language, but again, you have to essentially know how to code to automate that process. And I said, "Well, now a Designer here. Once you have that workflow built, guess what? Now it's automated. It's very easy to simply swap out the old data for the new data, but you can easily now pull new data into your workflow, set up a macro, automate that process if you'd like. But once you're done building the workflow, not only is your data analytics completed, you've actually built the automation at the same time," and I think especially for folks in internal audit, that's where the game changer is at with Designer, because you don't have to take that second step to now go back and write a program, or write a script or write a macro to automate that process. [00:21:17] Megan Bowers: Yeah, 100%. And you don't have to know how to code, which is huge, especially if you create this process and you do have to hand it off to someone in the future who might not have the VBA skills that you have. See that as like a huge win for sure. With the automation piece. [00:21:33] Michael Keiffer: I think you kind of mentioned before why a lot of audit shops maybe weren't embracing, uh, data analytics. And I think that's because coming from working with a lot of folks that were initially using ACL. ACL was the same way. You would, it'd be like a two-step process. You could run the analytics manually through the user interface. Then if folks wanted to automate that process, you would have to build again, a fairly involved script. My old training manager at ACL, Michael Kaner, was actually the one who said, "Have you heard of Alteryx?" He was actually the one that made me aware that Alteryx was even out there. And I think when I saw the Transpose tool run for the first time, I was like, "Hey, you've gotta be kidding me." Because doing this in ACL involved a very complicated script to pivot data from horizontal to vertical. One tool on the canvas, and for me it's like, "Okay, this is definitely a, a better mouse trap." [00:22:20] Megan Bowers: Yeah, I'm sold. Yeah. That's awesome. [00:22:23] Getting Started with Alteryx--- [00:22:23] Megan Bowers: So what would your advice be for auditors who are looking to get started with Alteryx and get started doing some more analytics and automation for their processes? [00:22:34] Michael Keiffer: I would say the first thing they would want to do is, uh, Alteryx does have the trial license, so I would definitely say get the trial license and then, uh, joining the Alteryx User Community. And then just seeing what some folks have posted there about, uh, different ways to employ data analytics in an internal audit environment. Uh, maybe do some of the weekly challenges, start doing some of the interactive lessons that they have there. To get that exposure and maybe even pick like a project, something that you would do in Excel or something that you're fairly comfortable doing, and then try and do that same project in Alteryx and see how that goes and getting the feedback from that process alone. I think for folks that are more visual, uh, especially for internal auditors, seeing the workflow set up, having the tools on the canvas, seeing how the data progresses through that workflow, visually, I think folks can probably relate to that much better than just seeing raw data in an Excel spreadsheet. So, [00:23:24] Megan Bowers: Yeah, yeah, you can start to see what transformations are happening and go back. That's something I've heard from people is the ability to like, go back three steps, look at the data there, see what happened. Whereas sometimes in Excel, you already created a new column or like reformatted some existing thing and it's like, "Oh no, I lost that data," kind of thing. And so I think that's good advice to, to try it out with an existing Excel process that you have and see, um, see what it could look like in Designer. [00:23:54] Michael Keiffer: When I first started working with my sales rep at Alteryx, uh, that was actually one of the first things that I did was I got my trial license and I took an, an audit or a process that I did using ACL and I put that through Designer. And like I said, it took one project for me to realize, "Okay, this is, this is a better, you know, a better mousetrap." And again, I think with the way Designer is laid out, the one-tool examples, there's just so many great resources that are there to really help minimize that learning curve. And I tell folks, you can be very, very productive with Designer, literally in a matter of hours as opposed to days, weeks, or months, or maybe even longer. Some folks never even get there with tools like ACL or Idea. They never really get to where they, they want to be. So. [00:24:35] Megan Bowers: That's awesome. [00:24:36] Conclusion and Farewell--- [00:24:36] Megan Bowers: Thanks so much, Mike, for coming on the podcast. It's been really interesting to hear about your field and all of your expertise, so thanks for joining us. [00:24:44] Michael Keiffer: Oh, thank you so much, Megan. Thank you for having me. It's, I really, I really enjoy being a part of the podcast. So, uh, yeah, it was definitely my pleasure to be here, so thank you. [00:24:52] Megan Bowers: Thanks for listening to Connect with Michael. Head over to our show notes on alteryx.com/podcast. And if you like this episode, leave us a review. See you next time.

This episode was produced by Megan Bowers (@MeganBowers), Mike Cusic (@mikecusic), and Matt Rotundo (@AlteryxMatt). Special thanks to @andyuttley for the theme music track, and @mikecusic for our album artwork.

Alter Everything Podcast

Podcast Guide

195: Data Analytics for Internal Auditors

Panelists

Topics

Transcript

This episode was produced by Megan Bowers (@MeganBowers), Mike Cusic (@mikecusic), and Matt Rotundo (@AlteryxMatt). Special thanks to @andyuttley for the theme music track, and @mikecusic for our album artwork.