• United States




Overcoming the ghosts of data analytics past

Nov 01, 20164 mins
AnalyticsIT Leadership

Learning from past data analytic mistakes and changing behaviors can enable users to finally realize promised benefits.

ghosts 163679940
Credit: Thinkstock

We’ve all heard and read about how data analytics will be a big game changer for almost everything we do. For us “auditors” this is not necessarily a new idea or phenomenon. As early as the 1970’s (and in some circumstances even as far back as the Beatles era), auditors used data analytics to facilitate their engagements and help focus management attention on the key performance indicators needed to manage their business.

It was not uncommon for business management to be in awe of the information produced and requested that auditors turn over their programs to management so that the business could incorporate them into their service delivery strategies. These data analytical techniques were commonly referred to as computer audit assisted techniques or CAAT tools.

Some organizations and their professionals used and significantly benefitted from these tools. Process efficiencies, higher quality data, better decision making and automated monitoring were examples of benefits obtained. Unfortunately, many did not take advantage or ignored the data-derived benefits of these early “data analytical” tools. Whether audit, security or risk management professional, we’ve been hearing promises for over 35 years of how data analytics would change our world. Yet for the most part we have we not realized the promised benefits.

[ ALSO ON CSO: The CSO 2016 Security Data Analytics Survival Guide ]

I believe in data analytics and the cost benefits that it will provide for risk management professionals and their organizations. Yet, I am trying to understand why industry has been slow to adapt the data analytical tools that were available throughout the past 40 years. Can we learn from past challenges to make it happen this time? Or is this just a fad whose benefits will never be realized?

 We can achieve the promised benefits by learning from the mistakes or “ghosts” of data analytics past. Here are issues that that the “collective we” must learn from and overcome to achieve the benefits of this promising technology.

 1. Plan for the reality of corporate silos and the protection of executive “turf.” Division executives may be unwilling to give up control of data that can be used to manage their divisions or provide ammunition for internal competitors.

2. Respect the “Legitimate” data ownership concerns of certain businesses. Line management may be more attuned to the privacy issues that impact their division including unique regulatory requirements. A one size fits all approach for the entire organization may not be practical in these situations. Legitimate concerns over how these executives can ensure the continued protection of data entrusted to them should be appropriately considered and applicable risks managed to acceptable levels.

3. Appreciate that data analysis is not always a welcomed event for executives. Closet skeletons can provide much motivation that encourage “bad actors” to derail a worthy data analytic initiative.

4. Understand that executives do not get compensated based on their use of data analytics but rather the business results that they produce. Data analytics nor their associated business investments, although helpful, may not always be necessary to produce desired business results.

5. Don’t underestimate the skill and need of people who have the imagination and appreciation to leverage the analytic tools that are being made available. Investing significant amounts to identify issues that no one will understand how to use will result in disappointing initiative results.

6. Ensure the accuracy and completeness of the data that is being used. Bad source data will yield bad results negating the returns on any investments. Data that will be relied in to make strategic business decisions should be cleansed to the extent possible to minimize unintended results and wasted investments.

7. Verify the relevancy of the analysis to the specific challenge being analyzed. Results of analysis are a tool to support and not replace human judgment. Blindly following analytic results without properly challenging them could yield disastrous results. This would also include focusing efforts on getting the right answers to relevant questions.

[ RELATED: How to make security analytics work for your organization ]

The opportunities and potential benefits of data analytics are well documented. But the historical evidence also provides for the need for appropriate caution prior to making significant investments. By analyzing and understanding how data analytics have failed to meet promises in the past, we can hopefully leverage this tool and realize all the promised benefits that it can offer.


Joel Lanz is the founder and principal of Joel Lanz, CPA, P.C., a niche CPA practice focusing on information and technology governance, risk, compliance and auditing. Prior to starting his practice in 2001, Joel was a technology risk consulting partner at Arthur Andersen (1995-2001) and a manager at Price Waterhouse (1986-1991). He currently serves as a reference member of the American Cancer Society's audit committee. His industry experience includes a job as vice president and audit manager at The Chase Manhattan Bank (1991-1995) and senior IT auditor positions at two insurance companies (1981-1986).

Joel currently chairs the AICPA’s Information Management and Technology Assurance Executive Committee and previously chaired the AICPA's CITP credential committee (IT specialist certification for CPAs) and co-chaired the AICPA’s Top Technology Initiatives Task Force. Joel's prior contributions to professional organizations include serving as chairman of the New York State Society of CPAs Technology Assurance and Information Technology Committees.

Joel is a member of the editorial board of The CPA Journal. He frequently speaks at professional society and industry conferences, including the AICPA, NYSSCPA and IIA, and he is an adjunct professor at New York University’s Stern School of Business and at the State University of New York's College at Old Westbury.

Joel holds a BBA in accounting and an MBA with a focus on information systems from Pace University's Lubin School of Business Administration.

The opinions expressed in this blog are those of Joel Lanz and do not necessarily represent those of IDG Communications Inc., or its parent, subsidiary or affiliated companies.