Contributor: Sam Halaby, Risk Data & Analytics Lead, Risk & Accounting Advisory Services
We are launching a new series in our Risk & Accounting Advisory podcast, called Risk In Review, where we cover risk topics in a five-question format. Episodes will include topics like Sarbanes-Oxley compliance, IT, Enterprise Risk Management, Financial Services Consulting and more.
We begin this episode’s conversation by defining what is risk analytics, before tackling how organizations can increase value to certain departmental functions and discover its importance in driving better decision making, monitoring internal controls, gaining insights into transaction behavior, and increasing test coverage.
We also explore costs associated with integrating risk analytics into business processes, as well as drawing alignment with available resources, tools, and skillsets to help achieve results.
Finally, this Risk In Review podcast covers a success story that explains how good risk analytics shapes a company, providing strategies for more streamlined operations and powerful, timely decision-making.
Cherry Bekaert’s Risk Advisory practice is focused on helping our clients protect value, power performance, and build resilience with mature internal controls. We do this by leveraging technology to mitigate financial, operational, and compliance risks using purpose-built risk management solutions that cost effectively diagnose, mitigate, and monitor risk.
View All Risk & Cybersecurity Podcasts
HOST: NEAL BEGGAN: Welcome to the Risk and Accounting Advisory Podcast. My name is Neal Beggan. I'm a principal and firm leader of the Cherry Bekaert Risk Advisory Practice.
HOST: NEAL BEGGAN: Today, on our first Risk and Review Podcast series, we are going to dive into data and risk analytics and what it means for your organization. Joining me today is Sam Halaby, Cherry Bekaert Data and Risk Analytics Leader. Sam, thank you for joining me.
SAM HALABY: Happy to be here and happy to talk about risk, data, and analytics. It's been a sweet spot for me for a long time. I can't wait to unpack some of that.
HOST: NEAL BEGGAN: Let me back up and introduce the series a bit further. The name of this series is the Risk and Review Series. It will be structured around five key questions on trending topics, and our Cherry Bekaert subject matter experts will provide guidance on each topic's importance for faster, more effective decision making and for connecting to business operations and systems integration.
HOST: NEAL BEGGAN: Sam, the bar has been set. You'll set it here in the next 10 or so minutes. So let's talk about what risk analytics is and how data and risk analytics increase value to certain client functions.
SAM HALABY: Risk and data have been in our vernacular for a long time. It is a broad topic that ranges from using analytics to recommend your next movie on Netflix to placing trades or improving market and product performance insights. Each application of analytics brings its own risk.
SAM HALABY: For example, if Netflix gives a flawed recommendation, you may have wasted an hour or two. But if trade analytics give bad investment advice or market insights are flawed, the consequences are costlier. For our clients, the goal is simpler. Most are just starting, and we provide a right-sized approach to solve specific problems.
SAM HALABY: We keep these problems within the context of risk recognition and mitigation. The idea is to holistically help clients identify risk and target mitigation. Our approach is to curate data, apply risk rules codified in our library, and present findings through visual perspectives and presentations that tell the story.
SAM HALABY: It's not about putting tabular data on a page. It's about business intelligence, recognizing patterns, and explaining those patterns.
HOST: NEAL BEGGAN: How does Cherry Bekaert apply data and risk analytics for our clients specifically?
SAM HALABY: Given our client base, many requests are about increasing internal audit test coverage. Organizations often sample a few dozen transactions from thousands, which does not provide reliable insight. If clients are digitized, we can get to 100 percent test coverage, which elevates confidence in audit outcomes.
SAM HALABY: Clients ask us to audit reported figures and verify how those reports correlate to the underlying data. We also monitor internal controls to ensure they remain effective without waiting for periodic exams. Monitoring frequency depends on the client's maturity and their ability to provide data points.
SAM HALABY: We analyze transactions in the procure-to-pay environment, learning from masses of rows of data to identify patterns, such as who is spending more or less. We also help clients shadow regulatory calculations, such as those from the IRS or Department of Labor. Their calculation methods are public, so we can codify and apply them to a client's transactions to validate regulatory assessments.
SAM HALABY: This lets clients respond to regulators with greater confidence instead of acquiescing to concerns without verification.
HOST: NEAL BEGGAN: The increase in data and analytics in internal audit and the broader auditing world has been significant, but changes are often associated with cost. What overhead and costs are associated with integrating data and risk analytics into those functions?
SAM HALABY: It depends on where you want to be. You can buy an expensive solution or pursue a cost-effective route. Our approach helps clients find the balance.
SAM HALABY: We treat it as a shared effort. We bring methodologies and industry insights, and the client brings institutional knowledge. We recommend starting with an analytics sandbox: tools and skill sets that allow experimentation, which is essential in analytics.
SAM HALABY: Building an analytics toolbox does not require the most expensive vendors. We prefer open-source or widely supported tools such as Python, SQL, R, and Tableau. These tools have large communities and many practitioners, so clients are not locked into a few developers.
SAM HALABY: We create focused use cases and start small. We use an agile approach with quick iterations to build a proof of concept. After delivery, we work with the client to tune, adjust, and sustain the solution before productionalizing it.
SAM HALABY: Production options include on-premises operation, a managed service that Cherry Bekaert provides, hosted solutions with Amazon or Microsoft, or a hybrid model. There are many options for operationalizing and sustaining solutions.
HOST: NEAL BEGGAN: Can you provide a quick success story on how we've helped clients implement integrated risk analytics to streamline operations and improve decision making?
SAM HALABY: After the pandemic, many organizations experienced increases in transaction volumes and changes in spending behavior. Remote work drove changes in purchasing and invoice submission, and organizations issued many more corporate cards.
SAM HALABY: Internal audit teams faced millions of transactions and could not rely on traditional sampling. We provided a tool that consolidated spending transactions, corporate cards, vendor payments, expense reimbursements, and other payouts, and layered the data for empirical analysis.
SAM HALABY: We discovered spending habits and benchmarks, such as average spend by function and outliers. For example, an organization with an average transaction of $2,000 might show transactions of $40,000. Visuals surfaced those anomalies for auditors to investigate.
SAM HALABY: We start holistically at the organizational level and then learn to delineate by function. For example, a county's public works spending will differ from police, fire, or education spending. Over time, we learn what "good" looks like for each group and set thresholds to flag exceptions.
SAM HALABY: Internal audit iterates through the process, improving targeting and sustaining analytics as part of their audit program.
HOST: NEAL BEGGAN: Where does the data and risk analytics journey start, and where can it go?
SAM HALABY: We work hand in hand with clients so knowledge transition is continuous. The goal is for clients to operate independently. We coalesce around the proof of concept, iterate, and learn what works and what does not. This is a data science approach.
SAM HALABY: Clients begin with simple lookbacks to understand what happened and why. From there, they can become forward looking and predictive to determine what is likely to happen and what to do next. We call this progression the analytics ladder.
SAM HALABY: Feedback loops, or digital exhaust, are critical. Outcomes feed back into analytics to improve accuracy. As you refine models, targeting for audits becomes more accurate.
SAM HALABY: Fail fast when necessary. Do not throw good money after bad. Salvage learnings and reapply them into the feedback loop.
SAM HALABY: Treat analytics as an application. It requires application controls and is sensitive to changes in data, business rules, people, and technology. Because it is data heavy, it also needs data governance, data management, and data quality components.
SAM HALABY: Ethical use of data should be considered, even if it is not yet front of mind for many clients. Analytics produce quantitative outputs that should be rationalized with qualitative judgment before driving actions. The five points outlined provide a start-to-end framework for the journey.
HOST: NEAL BEGGAN: Thank you, Sam. This is the first podcast in the Risk and Review Series, and you set the bar high. I appreciate your time today.
SAM HALABY: Thanks for having me, Neal.
HOST: NEAL BEGGAN: Thank you to our audience for listening. Stay tuned for more risk topics in this series, including Sarbanes-Oxley compliance, IT compliance and auditing, enterprise risk management, financial services consulting, and more.
HOST: NEAL BEGGAN: For more information on risk analytics or how your business can begin its data and risk analytics journey, please visit cbh.com/risk. Please like, share, and subscribe to the Risk and Accounting Advisory Podcast.
