Technology: Analytics, Automation and Controls in Finance
What the exam tests in technology
Technology is tested through its effect on information quality, control and assurance. You need to evaluate data analytics, automation, cloud, cyber risk and emerging tools in the finance function, and explain how they change evidence and control.
Core rules and concepts
- Data quality dimensions: completeness, accuracy, validity, timeliness, consistency and uniqueness. Weak source data undermines any analytics.
- Analytics can be descriptive (what happened), diagnostic (why), predictive (what may happen) and prescriptive (what to do).
- RPA follows rules and structured data; AI can learn patterns but needs governance, bias testing and explainability.
- Cloud computing shifts some controls to the provider, but the client retains responsibility for data, access and configuration under the shared responsibility model.
- IT general controls include access management, change management, backup, incident management and segregation of duties.
- Blockchain provides an immutable transaction record, but it does not guarantee that the original data is valid.
- Cyber controls include multi-factor authentication, encryption, patching, monitoring and tested recovery plans.
Worked example
An auditor extracts the full general ledger for the year and tests journal entries for round amounts, postings outside normal hours, manual entries to unusual accounts and entries made by users without posting rights. The risk is management override of controls. Reasoning: the analytics tests the whole population rather than a sample, so it can identify outliers and patterns. Before relying on the output, the auditor checks that the extract is complete and reconciles to the trial balance, and that access logs are reliable. Findings are discussed with those charged with governance and may lead to further substantive testing.
Traps that cost marks
- Treating automated output as reliable without testing completeness and accuracy of the source data.
- Confusing RPA with AI; RPA does not learn or exercise judgement.
- Assuming cloud migration removes the need for client-side access reviews.
- Overstating blockchain assurance; immutability prevents later changes but not initial error or fraud.
- Ignoring IT general controls when relying on automated application controls.