EVALUATING SOFTWARE

Regardless of the approach, organizations should evaluate audit software based on their defined needs and requirements. In general, organizations must weigh their choices against a mix of criteria such as capabilities and features, ease-of-use, service needs, vendor record and expertise, and cost.
"You have to mix it all together and establish your own priorities about what needs to be done and at what cost," consultant Tongren says. "This comes out in questions related to risk management, which means that the process becomes more organizationally dependent."
Product features are a large concern, because they determine whether a particular tool will be able to perform the types of analyses that auditors need. In fact, respondents to the Internal Auditor survey cited features as their No. 1 criterion for audit-tool selection. One crucial feature is the software's ability to process and analyze the volume of data that auditors need. Another is its ability to extract data from the organization's databases and data warehouses.
According to Lanza, the majority of leading off-the-shelf audit packages share most of the same features and perform most of the same analyses. Here, ease-of-use--the second-highest concern among respondents to the survey--may be an important distinguishing factor to help auditors perform data tests and produce reports.
There are greater features differences among more specialized tools, Lanza says. This is particularly true of newer categories of tools like Sarbanes-Oxley products.
J.D. Edwards' Bigler is currently reviewing responses from a request for proposals for Sarbanes-Oxley compliance tools. In addition to requirements such as ease-of-use and database and operating system compatibility, Bigler's key criterion is that the software be Web-enabled, so that the company's various offices can document controls and provide financial reporting, operations, and compliance data online in real time and auditors can review the company's internal controls.
"There are so many people who need to contribute information," Bigler explains. "It's a lot easier if we can allow them to update their information over the Web, as opposed to trying to get input from other offices via e-mail or some other less effective/efficient method."
Tongren says vendor record, reputation, and expertise are key software-selection criteria. Internal auditors need to know what type of service they will receive from vendors, particularly for complex enterprise systems. They also need to know that the vendor is a viable company that will be around to provide service, updates, and upgrades in the future.
In addition, Tongren says internal audit departments need to work with vendors who understand the organization's particular requirements. The vendor's audit expertise is also important, because it shapes the analytical assumptions that are built into the software. This is particularly necessary for small organizations that are more reliant on the software and for products such as risk-management systems. "If you have very specific requirements, and they aren't understood by the vendor, you start out with a high potential for problems such as false assurance," Tongren says