In the fourth episode of ‘Inside the Auditorium’, Peter Jones, the Head of Data Analytics Audit for Legal & General, dives into the intersection of data analytics and internal audit.  

This episode explores:  

• Synergy between data experts and auditors: Peter sheds light on how analytics can transform core processes and applying tools to discover new insights and identifying anomalies. Learn how the fusion of a good auditor and a skilled analyst creates magic in the realm of internal audit. 
• Keeping monotony at bay: Discover why some repeatability keeps the role interesting. From applying a new piece of code and developing that across different business divisions and verticals. Find out how each application remains interesting and dynamic in the world of data analytics. 
• The power of analytics: Peter explains what drives his passion for data analytics, sharing his enthusiasm for problem-solving in the complexity of big organisations and the opportunity to be able to provide insight and solutions.  
• Insight over data: Peter shares his invaluable advice on the importance of being a good storyteller. Understand that data is a means to gain insight, and the key is to communicate those insights effectively.  

Whether you're an internal audit professional or simply intrigued by the world of data analytics, this episode is packed with valuable takeaways. 

Enjoy! 

Note: The views expressed by Peter are his own and do not necessarily reflect those of his employer. 

Hi Peter, welcome to the podcast. Good morning. Obviously you've got quite a very different career in terms of, I know that you're working with an internal audit now for doing data analytics, but perhaps you could just tell us a little bit about your career and your journey of how you got here.

Certainly. Thank you. Yes, so I'm sort of like the accidental auditor really. I've been doing data work for 15 years or so. I started out in central government doing ID cards under Tony Blair's government, which shows you how old I am. And since then I've had an odd career path including women's fashion, retail, various other government departments, higher education and transport for London. So lots of verticals, but always data. And yes, I've landed myself in a fts E 30 finance company where I lead the analytics functioning internal audit.

Can you tell me, in terms of working within data analytics throughout your career, is there any different, doing data for fashion to financial services, was there ever when you're growing up you want to, working with a bank and things like that, did you ever have that industry that you particularly wanted to work in particularly?

No, I never had a vocation. Lots of my friends did and I felt like something was missing deep inside me. But no, I've always been a bit of a nerd as a child doing puzzles and problem solving and such. So what is it like doing this sort of thing in internal audit? Well, it's the same across all the verticals really. Every business has challenges and the different sectors are broadly the same, whether you work in retail or government, people have problems to solve and data and they'd like to put the two things together. I think the difference is probably speed. When I worked in retail fashion, everything was now, now super fast. You make a decision and two days later it's in a store. Whereas when you work in central government, you think about it and then you think about a bit more, and then you do a three month procurement tender and everything's very slow, but the problems don't change. People want to increase profit cut cost, take away risk, that sort of universal. So the skillset applies through all those verticals.

Sure. And tell me, so if we go back now to financial services, data analytics, so what is the things that allows you to find and to resolve, I suppose, like continuous monitoring or how does that work within an internal audit department?

Yeah, so I've been internal audit for four and a bit years now, and when I started I knew absolutely nothing. So started with the basics, started around storytelling with data visualizations to explain complex findings, that sort of thing. I have done some fairly interesting and good work around where is a traditional audit sampling perfectly sufficient, and where should you use full a hundred percent population sampling, which analytics allows you to do so If you're looking at fraud, you need to look at every single one because just one fraud is bad. Whereas if you're looking for general trends and statistics, then you don't need to do that. So it's been about where to apply analytics and where not to break, what isn't broken already about auditing. And then as you've mentioned, continuous evaluation, continuous monitoring, that sort of ongoing look at how controls are performing. That's been our USP over the last year or so, just looking at what are the key controls in the organization and when we audit them, you think, well, is looking at them every two or three years sufficient, particularly if we found some issues with it and we'd ask them to be remediated.

We don't want to find out in two years that the fix wasn't great. We want to keep looking at it. So building that infrastructure around the ongoing monitoring of controls has been really different. And a lot of people think, well that's second line's job to monitor controls, but actually I would argue that audit's job is to go where second line isn't. So where audit goes is somewhat determined by the shape of your second line, and there are things second line are brilliant at and they do all the time. And then there are new and emerging risks like AI and you think, well, do people know what to look for and can audit come in and supply some insight and a new perspective.

So if we can just say talk from an idiot's guide, then

Sure.

Considering I know about nothing about data analytics really. So in terms of who would set the data, so how do you know what analytics you should be looking at? Is that set by the head of all IT to turn around and say, right this year we're going to have a look at this, so go and use data analytics and then look at the outcome or does the data from the programming tell you what you should be looking at?

I mean, there's no right answer to that. I'll tell you how we try to do it and we'll see where we go. So something I introduced to cover up my complete lack of knowledge about audit when I joined was I stole heavily from Dun Humvee's Power of two, which is what was used behind Tesco's club card. So you take a data expert, IE me and an audit expert, and you put them together and you do questions and answers. And the way it's sort of got better over the years is now we have a good understanding of where the data is in the organization. So when we do our annual plan and we get our a hundred odd pieces of audit work, we say, well, which of these are

In areas where we have lots of data? So if it's about governance or change programs, typically the data's not great because they're being run by project managers on spreadsheets. And then you have your core processes which are in systems with automatic data capture. So analytics will lend itself to the latter. And so to some extent it's about putting the pin in the areas where the data is, but also what the data expert brings. That conversation is what the art of the possible, what are the data techniques? Where could you apply a regression analysis? Where could you apply process mining? Where could you apply machine learning to learn something new or identify an anomaly or whatever it is? And it's that you might find someone who's both a data analytics genius and a brilliant internal auditor, but more than likely you'll get a good auditor and a good analyst and you'll put them together and that's where the magic happens.

Okay. So perhaps you can enlighten me then if you are a programmer in your programming, happily in your day, once you've built the audit program, then does the role get a bit more monotonous or are there more things that can be done?

So there is some repeatability, but we actually see that as a positive thing rather than monotony because you get banged for your buck. So one of the exciting things about working for legal in general, which is a very large SE 30 finance company is it's got lots of business divisions, lots of verticals. And if we create a piece of code, which we've done this year, so we've created a very clever piece of code that can read letters that we send to customers. So we can read every letter and pull out the information and check that the amounts we've told them that they're due are the amounts in our database and we reconcile it and go, great, that process is working really well. But you don't just apply that in one division, you can then apply it to others or you can apply it to do different things. So rather than look at the amounts, you might want to look at something else like who the beneficiary is or whether the address is right or whatever. So you can start to apply clever machine learning, sorry, natural language processing techniques to different problem statements across different verticals. So yeah, some reuse of code, but it's usually different problem statements and it requires some tweaking. So it remains interesting. It would be dely dull if I did the same thing every day, but I think I've had two days the same yet.

And then so tell me, if you were speaking to a data analyst and try to entice them into internal wool debt, which you once was, what would do you think is the sell to somebody to come into internal audit from a data background?

Yeah, I mean honestly it took on some persuading to get me into internal audit. It was never the career beacon that called me, but actually I'm really thrilled that I joined because what I hadn't appreciated was just the sheer breadth of it. Because audit has the powers to have any and all data access to any and all data in order to fulfill its function. You can do a different thing every week and do a different audit every week for years. So I could be, one day I might be looking at health and safety data from one of our building sites and the next day financial statements and balance sheet reconciliations. There's just so much breadth to be an audit, you get to go across the whole organization. So in terms of just sheer access to data and therefore opportunity, that's been really good. And I think there's a second order effect as well, which is each business and the second line there as well are dedicated to what they do, but they haven't really been given the headspace necessarily to join the docs and see what other opportunities and risks there are. So there's a real big opportunity to be insightful and insight is valuable to the board. So it's a great way to advance your career, I think.

And so you've got that more within financial services then. So is that just because you're doing data in financial services and not particularly within audit or Yeah,

Well, yeah. So there's variety in lots of places, lots of variety in retail, lots of variety in transport for London. But when I was in transport for London for example, I was part of the London Underground Park, so did loads of interesting things about trains but didn't really look at buses or walking or boats. But when you're in audit, your audit plan covers everything your organization does and okay, it's not every single thing, but genuinely the opportunity for breadth of data analysis via an audit function is the broadest remit I've ever had and therefore it's the most interesting.

And also as well, wellbeing within internal all debt to your previous companies. Do you find that there's other skills that you need to have?

That's a good question. Not necessarily other skills, but the mix of what you use and how often varies I would say. So having come to financial services, because there are millions of customers and not millions of products, but there are lots of products and millions of customers, there are many permutations. So certain techniques, things like process mining where you follow from the whole customer journey through various systems and teams, that has far more applicability in financial services, I would say, than it did in higher education where you don't have those kind of complex processes that people go through in the same way. So yeah, so it changes the shape of you as an analyst, which skills you flex more often change, but I don't think I needed extra skills as such.

And so then in other worlds of data then, is it still very soft in terms of communication skills or do you find that that's more needed in the role that you are doing now in terms of speaking to stakeholders or That's always been about data,

Data roles. So there are preconceptions about data analysts that they sit in the basement with a wet tower around their head stop, their brain exploding, clever, but not necessarily extroverted, actually data analysis, pure and simple. That is fine, but if you want to be insightful and cause an organization to change, to influence the strategy, to really set a fire under something and make an opportunity, then you have to be able to communicate your findings. So communication skills and data are really important together. Not every data analyst has it, but I think it's really important to have enough in your team. And in order to augment that, we've had a really big focus on what we call storytelling with data. And that's not just for the analyst. We put every single auditor through that training. And I don't in any way mean to disparage my audit colleagues, but they tend to write like novelists first we looked at this problem, we did this, we found this. So the tadda moments at the end, whereas I want 'em to say it first, we found this like a headline in a newspaper, and that's just not the way they're trained. But actually if you want to make a splash with analytics, you want it in your exec summary or near the top of your audit report, there's this thing and it needs acting on quickly. There's a bit of a mindset shift for the auditors, but it's always been part of the data mindset as you have to explain your findings. So yeah, two worlds have collided there, but I think we're getting there.

And do you think the general business auditor, let's say, because I know data is very much towards more technology when it first come out, do you think nowadays business auditors are given a lot more buy-in to data analytics?

Yeah, I mean they should. I mean, I'm a member of the Institute of Internal Auditors data panel, so I meet with lots of people about data and banking's way ahead on this and insurance and other financial services a little bit behind. But there are other sectors where they're still thinking about starting this. So my view is data is growing exponentially. We know that, and it's going to be harder and harder for auditors to operate in that landscape unless they have some level of data skills. And what we've worked really hard on is, well, what is the sufficient level? So we look at a sort of a data journey. So there's asking the right questions, and I'm sure my global chief, sorry group chief auditor wouldn't mind me saying he's not a hands-on data person, but he can ask all the right questions. So there's that commissioning piece, which is really essential.

And we get our senior auditors focus on, you don't need to know how to do it. You need to know that it can be done and ask good questions about risk, about controls, whatever. Then there's a bit on data cleansing, blending, joining, which is very technical and not very sexy, but it's where all the effort goes and we don't need everyone to be able to do that. But we like our junior auditors to have sufficient skill to join 60 finance spreadsheets covering the last five years of monthly accrual. So we teach 'em to do that, but I wouldn't expect them to be doing code in Python. That's too much. But we have a specialist function for that. And then there's analysis itself and most orders, so generally analytical people and thinkers. So that's not the hardest thing to teach, but there are a range of new analytics techniques to get your head around. And then there's the presentational bit that communication at the end. So we've done this life cycle and we've tried to attach it to the roles. So what should our, in a score of one to five, where should the junior auditors be on those four things? Where should the senior audit managers, where should the leadership team be, et cetera. We've tried to codify it like that and put some structure in. It doesn't always fit everybody perfectly, but it's a shape to aim for

Sure. Sure. So would you say then, would you recommend any business auditor, whichever industry that they're in now is really to try and maybe go and get some sort of data analytics qualification or understanding?

I dunno that you need a qualification because there are lots of online schemes out there who want 50 quiddity or hard earned cash to do two hours of watching their video. Look what some of the qualifications are good and some are not. What I would say is if I think about that data journey, the bit that nearly everyone needs to do is visualize or express the fines of their data. So I would say go and get hold. Microsoft Power BI is a data visualization tool, which is largely, most corporations get it for a few pence or nothing via Microsoft along with their Excel and their PowerPoint. Have a play, get used to drawing pictures and do a bit of research about what are the right types of charts for the right type of thing. So a pie chart is never the right answer of course, but also there are times when you want lines or bars or scatterplots, and if you use the wrong types, you're going to lose your message.

So there's lot to learn about how to express your data, and it's a great place to start. If it's for you and you like it, you'll naturally then gravitate to some of the data cleansing you need to get there and that sort of thing. But I'd say start somewhere. You don't need to do the whole data journey. I don't expect everyone in audit to be Python coders or anything like that, but I think auditors have been put in charts in audit reports for forever. This is just about the complexity of the data behind them and how to sell the insight from your good work.

So do you think in terms of data analytics now and how that is moving forward, do you think eventually it will take out the human aspects of internal all depth?

Oh, never, never, ever. I mean, I'm not just saying that I want a job. I genuinely don't think that works. So I sat down with our director for audit methodology and was saying, where can we apply analytics? And if you think about something that is completely binary like an outcomes test, so worthy expenses within the limit, you can absolutely automate that and you don't need a person to ever do that piece of analysis. You can get a machine or a bit of code or whatever, but audit judgment, which is what audit reports are all about, you can't automate that. So there will always be auditors. The shape of the role of the auditor of tomorrow, as you might think of it, will certainly have data analytics in their toolkit even if they can't do it themselves. But we're not getting rid of auditors anytime soon or ever that I can see.

Wow. As long as it's not for the next 10 years anyway.

Yeah, you're all right.

So tell me what drives your passion for this line of work then?

Apart from being a big geek? I think so I've always liked the problem solving and there's just so much complexity in big organizations and because not everybody can do analytics, there is a real opportunity just to be insightful. And it's that I think it's the insight that inspires me. If you can start a new conversation about here's this problem, maybe no one's got their eyes on it or maybe there's a new way of fixing it, that's kind of exciting to me. I like fixing things that are broken. So it's a great place to be because you find lots of things that maybe need a tweak. So yeah, that's what I'm very excited about, that I do get a buzz out of getting my audit colleagues to have that penny drop moment when they realize that they too can make use of all this stuff. And it's genuinely pleasing when I see people I don't expect suddenly go, I've done a course in such and such because I find that so useful. And I think it's part of my career journey, so that's pleasing as well. But deep down, I'm not problem solvers.

Sure, sure. So do you think really data analytics is getting a lot more buying now and because people are understanding it a lot more and they know how to use it and integrate it into their daily life

In lots of ways, I really do. It's now part and parcel. We don't do audit planning without it. Data drives where the risks are and what we look at data drives, how we do the audits, data drives how we express the finding as part of the whole audit lifecycle. But also at an organizational level, when audit come in and give an opinion, that's important. If they've got a very well evidenced opinion with a stack of evidence behind it, that's really impactful. And so what data analytics does is it is the systemic use of data. That's what analytics is. It's really saying, this is uncontestable, this is the problem, this is the issue. And so the board listen. And in fact, I would say right from the top now the real hunger for more insight and analytics, they want more and more of this stuff because it takes risk out of the business in a really powerful way.

And would you say then the data analytics also, what's the word? I don't want to say catch people out, but because you can get to the end of the findings, you can actually see which work hasn't been done.

Well, yeah, I mean it has that potential, but I think audit always had that potential anyway, long before analytics. I think it's how you use it. So if I think about, I'll give process mining as an example. When you go for your walkthrough with the business, they'll say, this is the process, which is how they and plan for it to work. And then you run the data and you run every single customer who's gone through that process for the last 12 months and you say, yeah, do you know what 94% of the time you were spot on? But sometimes these other things are happening and you can actually have a really constructive conversation about why is it deliberate and if so, is it documented? Is it accidental? Do you need to stop it? It can be really, it doesn't have to be a gotcha where you make someone look bad. It can be very powerful, it can be a very positive experience. But there have absolutely been gotcha moments because sometimes you just find something a bit horrendous under the body and you need to shine a light on it.

And can I ask, in terms of culture's becoming a very big thing at the moment, I don't know whether on a data analytics point of view, whether you're getting involved in that at all or ECG climate or

Yeah, I mean culture's massive When we do our root cause analysis around issues, culture and human error are right up there as common themes and lots of things you can do around culture. Some easy things we did right from the start is with every audit we do what call a risk and control culture questionnaire where the auditor makes an assessment of the area that's been audited and you can sum all of that data up, collect it from all the audits and start to get a sort of patchwork quilt view of, well, where are there cultural issues in the organization when we overlaid two years worth of opinion on that topic? And that's quite useful. But also there's a whole science around this. There are companies out there that will take your data on risks and risk events and issues and attestations and plow it all into an engine and produce your scores.

And I know some of the big banks have done this sort of thing. We've sort of kicked the tires on thinking about doing it. So data can help you with culture, but it is limited. I mean really that's one of the areas where I think the auditor opinion is really important because you can't really capture really high quality on culture, high quality data on culture. And even if you do, there's a risk of misinterpreting it. Are the people not very productive, not well-trained or they hate their manager or they're not very well or something else, you might infer the wrong thing. And that's why culture is one of the harder areas to use analytics on.

Sure, sure. And being in data analytics for internal audit, I mean, what do you think from being internal audit, maybe moving internally into another role, do you find that that's quite easy, good transferable skills or

Oh yeah, massively. I mean, we run a fairly flat audit structure here, so we have not that many grades. So a lot of people, and it's pyramid shapes, there's not that many roles at the top. So a lot of people take their analytic skills and they use that to get roles in second line, first line, whatever. I mean we are really fortunate. I'm not fortunate, maybe it was planned, but we're in a good place in that gi. So internal audit here is regarded as one of the centers of excellence for analytics. And people do want our people because they are skilled and good and can apply those skills elsewhere. So yeah, it's a real launch pad for people. And we have people applying. So I want to come here, people join our audit function from other areas. Say, I want to come to this audit function because I want the data analytics on my cv. I want to learn those things. So it's a bit build it and they will come. It becomes a virtuous cycle.

And is there anything when you're interviewing then a data analysts to come and work within the internal audit team, is there a common error? Is there a common error that when interviewing a must not do as a data analyst?

I'm not sure we've got quite that far. I mean, what we did do was we introduced minimum standards for analytics for our junior audit posts a few years back. We said, this is the new normal, we'll train our own, but if you're going to join, you need to have some of this already. And that's a bar that creeps up over the years. I dunno, the thing that probably worries me the most is when people say, I use Excel for everything. I mean Excel's very powerful and good, but it struggles in the modern environment, just can't handle the volumes of data that are out there. So I think if you are one of those Excel fans, I think maybe you're on old tech and you might want to look at diversifying, that's always a warning sign for me during interviews, but I'm not going to push any other one in particular. But yeah, I think even so you can do some wonderful things in Excel. I'm not sorry, Microsoft, I'm not against your product. It's one where it's just a matter of, it doesn't say to me as the interviewer, you are up to date. Whereas

So

Much better stuff out there.

Okay. So on that note then, any valuable advice or lessons that you'd like to share with our listeners?

Yeah, so I would say, so 0.1 is forget data, actually, it's about insight. So data is a means to get insight. So be a good storyteller first and foremost. There's no point in me boring you to tears about why my stochastic model is excellent, nobody caress. What you want to know is that I found this thing and it acting on. So story first always, if you're going to do a course, do writing for the web, don't do something in Excel. Learn to be a really good communicator. And the other piece of advice is think really hard about where you're going to apply this. So it's very easy to go down a rabbit hole and spend a month doing a very complicated task, but if it's not top of your risk register, and if it's not actually giving you that much more value than a sample of 50 would've done, then don't do it. So once you've got the skills, then start to be choosy about where you apply them.

Okay, great stuff. Okay, well I've got a quick, quick, quick five minute, well, five question round to ask you. Well, we are an internal audit. Tell me what's one piece of technology you can't live without?

Oh, well it sounds like I'm on commission. So Alteryx or something similar but could be Python. What I would say is middleware the ability to join lots of data in lots of places and conform. It allows you to then perform fairly basic analysis on complex things. So get a really good of middleware once you've mastered the basics of visualization, A really good bit of middleware really helps.

And tell me, is there a book that you're reading right now,

Not relating to data or auditing? No, I got a birthday present. It's called Mr. B's book club and you fill in a questionnaire and they send you a different book every month. So I've got six books by six novelists I've never heard of. And the current one is some sort of sci-fi nonsense, but it's quite enjoyable having a nice

One. I thought you were going to tell me you were going to be reading the new Britney Spears there. No, I finished that already. I listeners a lot of diverse companies. Is there a company out there that you do admire a lot for any particular reason?

I think the ones who are doing this stuff at real speed blow my mind. So I know a guy who runs data warehousing at Gatwick and they're doing all the clever things that we do, except they're doing it every few seconds and there are planes in the air and luggage moving around conveyor belts and they need to know where everything is all the time. TFL was very similar but not quite as fast as that. So I said the companies that are living it in real time, like that hats off to them. That's clever stuff.

Sure, sure. What's the best thing about working, doing data analytics in internal wall debt?

I would say there's a real sense of being appreciated, really. It was definitely a bit of a pump to start with when they set this roll up, is this going to work for us? Let's try it and see. But it's now integral and I feel if you do a role like this, you will feel valued. You feel you'll contributing to what gets found and how it's acted on. So it is a rewarding job. It's good.

And tell me, if you wasn't going to be a day in data or internal, all because I have to put the two together, what job do you think that you would be doing

That's hard? Well, I could either find something else with problem solving, something Sy would be fun, or I could go to my other passion and just become like a baker and make nice bread all day. Either of those things would be very exciting.

Alright, well that's great. Well look, thank you very much for your time today. It has really been interesting to speak to you. My pleasure.

Thank you