A lean internal audit function has two options: accept that coverage is limited by headcount, or make the machine do the fieldwork. We chose the second. Here is what building a Python audit lab inside a listed FMCG company actually looks like.
The stack, in production
Six engines run against full data populations, not samples:
- SoD engine — segregation-of-duties analysis across the complete SAP authorisation landscape: every user, every role, every rule in the conflict matrix.
- JE analytics — the whole journal population, profiled for timing, round numbers, unusual account pairings and off-hours posting.
- Three-way match — PO to goods receipt to invoice across the full purchase population, surfacing exceptions no sample would find.
- TB trend — trial-balance movement diagnostics that flag anomalous accounts before fieldwork starts.
- FEFO monitor — first-expiry-first-out compliance for perishable inventory across the distribution network.
- R2R suite — record-to-report controls analytics with working papers generated to regulator grade.
Even the reporting layer is automated: board-deck PPTX files assemble themselves from the analytics output.
Three lessons from building it
Start where the data is ugliest. Our first engine targeted SoD because authorisation data is the most structured thing in SAP. Early wins bought credibility for the harder problems.
Working papers are the product, not the script. A finding no reviewer can re-perform is an opinion, not evidence. Every engine writes its own audit trail — inputs, parameters, exceptions, versions — to a standard a regulator can inspect.
Exceptions need triage logic, or you drown. Full-population testing finds everything, including ten thousand trivial mismatches. The intelligence is in the ranking: materiality weights, repeat-offender flags, and pattern grouping that turns raw exceptions into a fieldwork agenda.
The economics
The honest arithmetic: hundreds of hours of testing work now runs in minutes, monthly instead of annually. But the deeper return is different — auditors walk into interviews already knowing the answer distribution. The conversation stops being "show me how this works" and becomes "explain these forty-seven cases."
That shift — from discovery to confrontation with evidence — is what analytics actually buys an audit function. The time saving is just the receipt.