Building a data-led in-house internal audit team without hiring a data scientist.
Most companies with an in-house internal audit function have a team of two to six people trained in vouching and process reviews. The audit plan now asks for full-population analytics, IT controls and AI reviews. A note for CFOs and heads of internal audit on closing that gap with the people already on the payroll.
1. The gap inside the company.
A company crosses the threshold under section 138 of the Companies Act, 2013, or its audit committee asks for a permanent function, and an in-house internal audit team is formed. Typically it is small: a head of internal audit reporting to the audit committee, two to five staff drawn from finance or accounts, and an annual plan built around process reviews.
Within a few years the plan outgrows the team. The audit committee asks about vendor master integrity, duplicate payments, segregation of duties in the ERP, cyber controls and, increasingly, the AI tools management has started using. Each of these needs the auditor to work with full data populations rather than samples. The team was not hired for that, and the company's response is usually one of three: ask IT to run the queries, engage an outside firm for the analytics, or leave those areas on a three-year rotation and hope.
None of the three builds a function. The fourth option, building the skills inside the existing team, is more achievable than it looks, because the skills required are narrower than the phrase "data analytics" suggests.
2. What the team actually needs to know.
Five capabilities account for most of the value in an in-house function. None requires a technology hire.
Getting data out of the company's own systems. Knowing the difference between a formatted ERP report and the underlying table. Knowing which tables hold the vendor master, the payment run, the user access list, and how to ask IT for a full extract with a control total that reconciles to the trial balance. In-house teams have an advantage here: the systems do not change from one engagement to the next, so this is learned once.
Joining and filtering large datasets. Matching the vendor master to the employee master on bank account and PAN, matching payments to approvals, matching GSTR-2B to the purchase register. Learnable in a spreadsheet with lookups and pivot tables, then more robustly in a query tool.
Turning a control into a data question. "Vendor bank account changes need call-back verification" becomes "list every bank account change in the period with the user, the date and whether a verification record exists". This translation is the core skill, and finance-trained staff are good at it once shown.
Reading system logs and access lists. Understanding roles in the ERP, what the change log records, and how to test segregation of duties from actual activity rather than from the policy document. In an in-house team this becomes a standing quarterly test rather than a one-off.
Explaining results to the audit committee. Converting four hundred exception rows into three sentences and a number. Accountants do this better than technical specialists, and the head of internal audit should keep this role rather than outsource it.
Not on the list: machine learning, advanced statistics, programming as a discipline. Those are needed for a minority of reviews and can be bought in when they are.
The in-house team's advantage is that the data does not change. A test built once runs every quarter for as long as the ERP does.
3. How to build it inside the company.
Start with one real test on one live review. Give a team member the full payment file for the quarter and a day to build the duplicate-payment test in whatever tool they know. Review the output with them. Run it again next quarter. The first test takes a week; the tenth takes an hour.
Build a test library that belongs to the company, not to individuals. Each test on one page: purpose, data source and table, logic, thresholds, known false positives, owner. After a year the library covers procure-to-pay, payroll, revenue, masters and access. When a team member leaves, the library stays.
Pick two tools and stop. The spreadsheet the team already uses, and one step up: a query tool against a reporting copy of the database, or a scripting language with data libraries. Most companies already license something suitable. Five tools mean none is mastered.
Agree data access formally. The head of internal audit should hold standing read access to a reporting copy of the ERP, agreed with IT and minuted by the audit committee. Chasing extracts every quarter is where in-house analytics usually dies.
Pair, do not send people on courses. Half a day with one person who has run a test and one who has not, on real company data, transfers more than a two-day external course. Courses help with tools; pairing helps with judgement.
Use outside specialists to transfer capability, not just to deliver. Where a review needs skills the team lacks, for example an AI model review or a forensic reconstruction, engage a specialist on terms that require documented methods and a walkthrough with the team. The company pays once for the work and keeps some of the skill.
Retire the sample. Population testing replaces sampling; it is not an addition to it. A team that hand-vouches forty invoices and also runs a full-population duplicate test is doing the same work twice. Free the time and use it for root-cause work.
4. What the audit committee will notice.
Findings become quantified. "Weak control over vendor bank changes" becomes "37 changes in the quarter, 11 without verification, Rs 2.4 crore paid to unverified accounts". Management responds differently to the second sentence.
Coverage widens without headcount. Tests that run every quarter on every transaction give the committee assurance over the whole year, not over a sample from one visit.
Follow-up becomes verifiable. Whether a finding is closed is shown by re-running the test, not by reading the management response.
The function becomes harder to lose. A documented test library, standing data access and a quarterly cadence survive staff turnover. A function that lives in one person's head does not.
5. A note for the CFO.
The in-house internal audit team usually reports to the audit committee functionally and to the CFO administratively. The CFO controls the two things this programme depends on: time and data access. Protecting one day a week for the team to build and run tests, and signing off standing read access to the ERP, does more for the function than any tool purchase. The return arrives within two or three quarters, in the form of shorter reports with larger numbers in them.
This article is general in nature and does not constitute professional advice. Readers should seek specific advice before acting on any matter described here.
This website is meant for information purposes only. The contents are made available on a pull basis and are not intended to solicit work or advertise.
Frequently asked
Which tool should an in-house team start with?
The one the team already uses, which in most Indian companies is a spreadsheet. Lookups, pivot tables and power-query features cover the first year. When volumes exceed what a spreadsheet handles, a query tool against a reporting database or a scripting language with data libraries is the natural next step. Choosing one and using it every quarter matters more than the choice itself.
Should internal audit or IT own the analytics?
Internal audit owns the tests, the logic and the interpretation. IT provides access and a reporting copy of the data. Where IT runs the queries, the auditor is no longer independent of the process being tested, and that should be avoided for any test that touches IT's own controls.
How does this fit with the Standards on Internal Audit?
The Standards on Internal Audit issued by ICAI and the Institute of Internal Auditors' Global Internal Audit Standards both contemplate technology-assisted work and require that it be planned, documented and supervised. A test library with data lineage and review evidence produces that documentation as a by-product, and gives the audit committee something to review under its LODR responsibility for the adequacy of the internal audit function.
