Artificial Intelligence planned for NHS audits
By Professor Amir Michael - October 2020
NHS England and NHS Improvement formed the Accelerated Access Collaborative (AAC) to encourage innovations development and care transformation in the health service. The project involves the use of Artificial Intelligence (AI) technology to improve transparency, safety and privacy in an ethical manner, not just regarding efficient health care, but also better identification of resource requirements and improved allocation of funds according to robust internal control and accountability systems, leading to an efficient and sustainable service.
Audit procedures traditionally rely on samples and it is still not clear what the implications on the audit procedures will be when using full population continuous audit with AI. Audit normally relies on internal audit function and control systems when performing a conventional audit engagement. Will continuous audit using AI require changes to the internal audit function and internal control procedures to be able to adapt? It is not clear yet what the implications of continuous audit using AI will be on the audit time and budget. Continuous audit is a live real-time audit process, using Apple’s iCloud computer service, which raises issues about the different precautions needed to face any cyber-attacks.
The NHS in the UK has piloted two new internal audit systems. The first is Monitor’s Costing Transformation Programme (MCTP) and the other is Patient Level Information and Costing Systems (PLICS). There is a full survey for which hospitals have applied these systems and the level of application. These internal monitoring systems are generating massive sets of data about each service provided for each hospital and the variance from the expected costing systems with and without costing adjustments.
It is crucial to identify the impact of the different levels of application of these systems on the cost variance for each service. Assessment of internal control systems and how these systems can be improved is vital to ensure that they will fit the adaptation of continuous audit using AI and data analytics. This can be done using some advanced AI and data analytics technological tools. This assessment should provide the NHS with a robust analysis of the challenges of adopting continuous audit and how to address the different issues associated with its application.
The International Auditing and Assurance Standards Board (IAASB) in 2016 and the Financial Reporting Council (FRC) in 2017 called for a review into the use of data analytics by auditors to share good practice and continuous improvement of audit quality. I am expecting that using data analytics for voluntary and unregulated disclosures will not just improve audit quality, but will go further by expanding the scope of audit beyond statutory audit of financial statements to meet stakeholders’ needs and expectations. IAASB (2016) recommended that auditors need to capture better evidence to acquire broader and deeper understanding of the entity’s environment,risk and business operations. I believe that auditors need to get clear insights using unregulated disclosures to have better understanding of business sustainability.
There are some regulatory and legal challenges represented by the mandatory requirement to comply with the International Standards of Auditing (ISA), which are principle-based and do not reflect the new technology age and the utilisation of AI and data analytics in performing audit practices. Therefore, the challenge is how to adapt such technologies in alignment with the current standards, without asking for radical standards reform. This raises issues concerning different interpretations of the ISA in the light of AI applications.
One example, particularly relevant to the NHS, is how clients’ live operational systems data is accessed, acquired, protected and processed to perform continuous audit analytics in compliance with the General Data Protection Regulation. This will raise issues with regards to ethical aspects of the data processed without human judgement and whether it is accepted to be ‘considered’ in this process or not.
More broadly, there is an intellectual capital challenge which raises the question of whether we have the qualified and trained workforce to deal with AI-based continuous audit. Can we find the resources and investment required to re-train and re-skill the new generation of auditors to adapt with a new AI-led audit profession and the utilisation of a Robotic Process Automation (RPA)? There is a suggestion to develop International Accounting Education Standards (IAES) to fulfil the skills gap.
Stakeholders’ expectations being misled is another challenge, as there will be an impression that there will be 100% testing by applying continuous audit using AI and data analytics. There is also an emerging challenge in dealing with unstructured big non-financial data, such as videos, pictures, and text, and how to integrate this data with the traditional financial structured data. And when it comes to an audit rotation, how will auditors share different analytics tools among themselves, whether developed internally or by a third party?
With regards to audit risk, it is not clear how AI and data analytics are used in the risk assessment phase of audit engagements or how they will improve the effectiveness and efficiency of audit quality. There is always a question about the veracity and quality of data being processed through AI to perform continuous audit and how this affects the overall audit quality.
However, the benefits of resolving the challenges and integrating digital internal control systems in health services, especially in such an established and complex service as the NHS, will not just serve external transparency and credibility of information, but will have a significant impact on the internal decision-making and control for the service’s spending. Using algorithmic patterns to predict overspending and visualise these patterns in the form of dashboards, can ensure that financial decisions are well informed by sufficient and reliable real-time information on a continuous frequency.