5/9/2019 Examining Automation in Audit | IFAC

Strengthening Organizations, Advancing Economies

Audit & Assurance

Examining Automation in Audit

by Abigail Zhang, PhD Candidate, Accounting Information Systems, Rutgers Business School, Andrea M. Rozario, CPA,
CPA, PhD Candidate, Accounting Information Systems, Rutgers University and Dr. Miklos A. Vasarhelyi, Ph.D, KPMG
Distinguished Professor of Accounting Information Systems and Director of the Rutgers Accounting Research Center &
Continuous Auditing and Reporting Laboratory, Rutgers University | April 1, 2019 |

The accounting and audit professions have gradually been drawn into the usage of automation and benefited
from automation tools. Corporate accounting processes have progressively been integrated into large ERPs
(Enterprise Resource Planning systems) and accounting software. However, auditors have tended to use
technology with disparate sources of software performing verification, archiving, and extrapolating functions.
These functions often are very repetitive and labor intensive with variations from engagement to
engagement. A basic core of automatable functions has emerged which rely on a reengineering (Hammer
1990) of a largely customizable set of audit procedures that firms execute client to client and partner to
partner. Multiple audit related functions can be performed by robotic process automation (Moffitt et al., 2018)
processes that are emerging in the profession and have been progressively widely deployed in the corporate
world (McKinsey 2016).

What is Robotic Process Automation (RPA)?

Robotic Process Automation (RPA) is a software that runs other application software from the user interface
level (i.e., in the same way that a person works with that software) and it can be used to automate
predefined business processes. RPA is ideal for processes in which there are many interactions with different
application software. A survey from Deloitte shows that accounting and finance is the most common area
(54%) of RPA deployment, followed by operational processes (25%), human resources (8%), IT (6%), tax
(5%), and internal audit (2%) (Deloitte, 2018).

Rethink Audit Processes Assisted by RPA

Today's audit process can be somewhat customizable with the practice manuals, templated audit plans, and
ever-evolving supportive software (Rozario, Moffitt, and Vasarhelyi, 2018). Though audit automation started
almost half a century ago, today's audit automation is mainly about isolated audit task automation, for
example, digitizing working papers and their management using CASEWARE, using audit software (e.g. IDEA
and ACL) to perform specific audit testing, and using statistics software (e.g., STATA and R) to run
regressions (C. Zhang, 2018). However, to enhance efficiency and effectiveness, audit automation needs to
go beyond isolated task automation to achieve process automation. The audit procedures, in essence, are
processes which consist of a sequence of activities to transform inputs (i.e., information to be audited) into
outputs (i.e., audit opinions) to serve a meaningful purpose (i.e., provide useful information to financial
statement users) (C. Zhang, 2018). The advent of RPA provides new opportunities for auditors to rethink,
redesign, and reorganize the audit processes.

In addition, an RPA software license, which can be used to program several bots, can range from $5,000 to
$15,000 (Wall Street Journal 2016). Hence, RPA can be a cost-efficient way to automate tasks that do not
require judgment but that are important to the completion of the process.

Methodology/Framework of RPA in Audit

A framework for guidance is necessary to facilitate the implementation of RPA. A.M. Rozario proposes a
framework for redesigning the audit using RPA (“Redesigning the Audit Process: Towards Robotic Audit
Process Automation”, Rutgers Dissertation 2019) and recommends to 1) develop process objectives for
automation with RPA, 2) identify and subsequently understand the process, 3) standardize audit data, 4)
have RPA automatically execute audit tests, and 5) evaluate the RPA implementation.

www.ifac.org/global-knowledge-gateway/audit-assurance/discussion/examining-automation-audit?utm_medium=social&utm_source=facebook&utm_c… 1/5
 Understanding the process from beginning to end in order
5/9/2019 to break
Examining it down
Automation into| IFAC
in Audit small modules that can be
programmed as RPA software bots is emphasized as an important driver for successful RPA implementation.
In addition, to exploit the benefits of RPA to the maximum, the concept of audit data standardization, i.e. the
maintenance of audit information into a consistent format, is highlighted as the enabler of RPA across
multiple audit engagements. Then, RPA, as an overlay software, can be utilized to integrate otherwise
disintegrated audit activities. Finally, to measure the ROI on RPA, a method of formal evaluation is needed.
Measures for audit efficiency (e.g. number of hours spent performing the process) and effectiveness (e.g.
number of errors detected) under the traditional approach versus the new, RPA-based approach, can help
assess the success of RPA implementation.

RPA Projects: Lessons Learned

Auditors could apply RPA to all phases of the audit that require the performance of rules-based tasks that are
repetitive, and time consuming.

RPA Projects in the External Audit Case 1– Risk Assessment

In the first example, the usefulness of RPA in audit planning is explored. A firm provided a list of possible
tasks that could be automated with RPA. The RPA prototype was built based on the redesigned and further
standardized audit procedures, which generally include filling in a planning worksheet using information
generated from a series of simple analytical processes and auditor's professional judgment.

The first module was data standardization (Audit Data Standard – ADS, step 3 per the proposed framework),
in which a Python program was used to convert the original client data into a standardized and machine-
readable format. The second module consists of a series of rule-based analytical procedures interacted with
auditor's professional judgement. At the end of the second module, a summary spreadsheet in which what
needs to be filled in the planning worksheet was generated. In the third module, the RPA software is
programmed to take the results from the summary spreadsheet and fill them in the planning worksheet. All
the modules, including data standardization, analytical procedures, auditor's professional judgment, and
completing the planning worksheet, are connected by the RPA software.

RPA Projects in the External Audit Case 2– Test of Details

There is untapped opportunity to apply RPA for substantive testing as there are a plethora of audit steps that
consist of the matching of data fields from one source to the other. In case 2, RPA was applied to execute
test of details. RPA was utilized to conduct tests of details for the revenue account by first collecting audit
evidence from several files, compiling this evidence into a standardized format, importing it to the data
analytic software, and then executing audit tests that are preprogrammed to match the sales amount from
the invoice detail to the shipping, and sales order detail. The revenue case is one example, however, this
example can be generalized to the audits of other financial statement accounts or areas, such as cash,
pension plan assets, and internal control testing.

Figure 1: Robotic Audit Process Automation (Adapted from Rozario, 2019)

Despite the several benefits that RPA can bring to the audit, there are items that need to be considered to
increase the success of RPA implementation. First, data should be in a machine-readable format for RPA to
be able to process it. Many business reports, such as payroll reports, are in PDF file type formats, therefore,
if the data is not in a machine-readable format, the possibility of converting it into this format should be
considered. Second, RPA bot deployment and maintenance should be taken into account. For example,
should RPA be decentralized and deployed at each business segment, or should it be centralized at an RPA
Center of Excellence? In large public accounting firms the first option may be feasible while for the smaller
www.ifac.org/global-knowledge-gateway/audit-assurance/discussion/examining-automation-audit?utm_medium=social&utm_source=facebook&utm_c… 2/5
 firms the latter may make more sense. RPA bots, likeExamining
5/9/2019 any other software,
Automation would
in Audit require updates. How would
| IFAC
the maintenance and updates be handled? Ultimately, the success of RPA implementation would be in the
hands of management and their employees. Hence, if public accounting firm partners embrace RPA as a way
to improve the auditing process, is it likely that such attitude would be adopted by their employees.

Move from RPA to IPA

The characteristic of RPA is that it is used to automate standardized, rule-based, and structured processes.
Massive benefits can be harvested from RPA alone in such processes. However, many business processes and
audit processes are not standardized, not rule-based, or not structured, therefore, falling outside the scope
of RPA. To achieve process automation that is more scalable and flexible, we need Intelligent Process
Automation (IPA). IPA is an ecosystem of technologies that work together to make the process automation
flexible, scalable, and intelligent (C. Zhang, 2018). The IPA ecosystem, based on the state-of-art of
automation technologies, contains RPA, Artificial Intelligence, Cognitive Computing, and other technologies
such as drones, Internet-of-Things, and data analytics (Zhang, 2018). Unlike RPA that can only automate
pre-defined processes, IPA can learn and predict process patterns, and to interact with humans when needed
(Zhang, 2018). More detailed comparisons between RPA and IPA are extracted from Zhang (2018) and
listed below.

Figure 2: Comparison between RPA and IPA (excerpted from Zhang, 2018)

RPA IPA

Deal with definable, standardized, Yes Yes

structured, rule-based tasks

Deal with fuzzy and unstructured tasks No Yes

Complex data analysis No Yes

Exception processing No Yes

Predictive analysis No Yes

Adapt to changes No Yes

Learn through time No Yes

Impacts of RPA/IPA on the Audit Quality

RPA can increase audit efficiency as it can conduct work the same way as human auditors without getting
tired. For example, for the cases described above, RPA performed audit activities in 3 minutes or less. Hence,
RPA can perform audit activities in a fraction of the time that an auditor can. Accordingly, RPA can scale as it
can conduct audit work on a large number of audit clients in the same amount of time that it would take for
one auditor to conduct the work on one audit client. In addition, RPA can do this for many hours.

While process improvement using RPA can certainly increase the efficiency of the audit process, it may also
increase its effectiveness. RPA can reduce the number of errors that occur as a result of transferring data.
Importantly, by automatically processing data and executing audit tests on the full population of accounting
records, RPA can more efficiently detect accounting anomalies and offer auditors the opportunity to more
precisely measure the risk of material misstatement in a timely manner and for many audit clients.
Subsequently, audit effectiveness can be improved by having auditors spend their efforts on higher risk areas
such as the evaluation of audit test results.

Impacts of RPA/IPA on Auditor Skills

With the advent of RPA/IPA, the rule-based and repetitive tasks in accounting that require the application
and simple analytical skills are expected to be automated shortly. To be prepared for the future of the
accounting and audit profession, professional accountants need to be open-minded and start to focus on
building another set of skills. From a recent survey (Cooper, Holderness, Sorensen, and Wood, 2018), the Big
Four are attracting talent who have both accounting knowledge and other skills which the Ernst & Young call
"accounting plus skills." These "accounting plus skills" include advanced analytical skills (e.g. data

www.ifac.org/global-knowledge-gateway/audit-assurance/discussion/examining-automation-audit?utm_medium=social&utm_source=facebook&utm_c… 3/5
 visualization, programming logic, and analytic modeling),
5/9/2019 personal
Examining skills in(e.g.
Automation Auditresilience,
| IFAC communication, and
agility), open and critical mindsets, and the understanding and application of disruptive technologies (e.g.
RPA, AI, and Blockchain) (Zhang and Vasarhelyi, 2018).

Conclusion

This article discussed the second major wave of automation happening in the accounting and audit world that
entails overlay software integrating labor-rich repetitive applications. For that purpose, it reviewed two RPA
project learnings and drew conclusions. Current audit processes need to be reengineered to a certain degree
to homogenize the ways different engagements are conducted into data identification, audit data
standardization for that cycle/process, a common set of homogeneous pre-prepared audit activities, and
eventually a semi-automated conclusion (opinion) module. Currently, the repetitive and structured processes
could be automated while eventually IPA will try to automate some of the more complex decision processes.

References:

Internal Controls Over Financial Reporting Considerations for Developing and Implementing Bots, Deloitte,
2018

Cooper, L. A., Holderness, D. K., Sorensen, T., & Wood, D. A. (2018). Robotic Process Automation in Public
Accounting.

Hammer, M., 1990. Reengineering work: don't automate, obliterate. Harvard business review, 68(4), pp.104-
112.

Kevin C. Moffitt, Andrea M. Rozario, and Miklos A. Vasarhelyi (2018) Robotic Process Automation for Auditing.
Journal of Emerging Technologies in Accounting: Spring 2018, Vol. 15, No. 1, pp. 1-10.

Lacity, M., Willcocks, L., & Craig, A. 2015. Robotic Process Automation at Telefonica 02. The Outsourcing Unit,
pp. 1-19.

McKinsey. 2016. The next acronym you need to know about: RPA (robotic process automation). Retrieved
from: https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/the-next-acronym-you-
need-to-know-about-rpa

Rozario, A. M. 2019. Three Essays on Audit Innovation. Rutgers University Dissertation. Working Draft.

Wall Street Journal. 2016. Robotic Process Automation Slashes IT Costs, Alleviates Complexity. Retrieved
from: https://deloitte.wsj.com/cio/2016/07/06/robotic-process-automation-slashes-it-costs-alleviates-
complexity/

Zhang, C. (2018). Intelligent Process Automation in Audit. Working paper.

Zhang, C. (Abigail), & Vasarhelyi, M. (2018). The Impact of Disruptive Technologies on Accounting and
Auditing Education - The CPA Journal. CPA Journal. Retrieved from
https://www.cpajournal.com/2018/09/13/the-impact-of-disruptive-technologies-on-accounting-and-auditing-
education/

Abigail Zhang is a PhD candidate in the Accounting Information System department at Rutgers
Business School. Her research addresses the impacts of emerging technologies, especially
Robotic Process Automation (RPA), Artificial Intelligence (AI), and Intelligent Process Automation
(IPA), on auditing. She has been working with several medium sized public accounting firms to
build prototypes of implementing RPA in some of their audit procedures. In her working paper
“Intelligent Process Automation in Audit”, which has been presented in the Strategic and
Emerging Technologies (SET) workshop in the 2018 American Accounting Association (AAA) annual meeting,
three frameworks are constructed to guide the implementation of IPA in the future of audit. She recently
authored and instructed the AICPA course module Organizational Implications of RPA. Currently she is also a
part time lecturer at Rutgers Business School.

Andrea M. Rozario, CPA is a PhD Candidate in Accounting Information Systems at Rutgers, the
State University of New Jersey, USA. She is a licensed CPA in the state of New Jersey and has
worked for one of the “Big Four”, as well as a large healthcare company. Andrea has instructed
lectures on audit data analytics to the PCAOB. Her research focuses on using disruptive
technologies and social media information to enhance audit quality. She has written and
presented papers in the areas of Audit Analytics, Blockchain, Robotic Process Automation, and
Big Data.

Dr. Miklos A. Vasarhelyi is currently the KPMG Distinguished Professor of Accounting

Information Systems and Director of the Rutgers Accounting Research Center (RARC) &
Continuous Auditing and Reporting Laboratory (CARLAB) at Rutgers University. He has
published more than 200 journal articles,20 books, and directed over 45 PhD theses. He is the
editor of the Artificial Intelligence in Accounting and Auditing series and the Journal of Emerging
Technologies in Accounting. Professor Vasarhelyi has taught executive programs on electronic commerce to
many large international organizations including GE, J&J, Eli Lilly, Baxter, ADL, Volvo, Siemens, Chase Bank,
www.ifac.org/global-knowledge-gateway/audit-assurance/discussion/examining-automation-audit?utm_medium=social&utm_source=facebook&utm_c… 4/5
 and AT&T. Professor Vasarhelyi is credited with the original
5/9/2019 continuous
Examining Automationaudit application
in Audit | IFAC and as the leading
researcher in this field. The CAR Lab’s projects include among others AICPA’s Radar, Siemens, KPMG, P&G,
AICPA, CA Technologies, and Itau-Unibanco. Prof. Vasarhelyi has been awarded the Outstanding Educator of
the year by the AAA in 2014 and the Wasserman award by ISACA in 2013. [Ph.D in MIS (UCLA) MBA (MIT)
and BS in Economics and Electrical Engineering (the State University of Guanabara and Catholic University of
Rio de Janeiro)]

Like what you see here? Subscribe to The Latest, our customizable update sent every two weeks.

Do you have a perspective you'd like to share with the global profession? Email Gateway@ifac.org to inquire
about becoming a Gateway contributing author.

Join the Conversation

To leave a comment below, login or register with IFAC.org

www.ifac.org/global-knowledge-gateway/audit-assurance/discussion/examining-automation-audit?utm_medium=social&utm_source=facebook&utm_c… 5/5