Information technology and audit data analytics
What this domain tests
Whether you can plan an audit around an IT-dependent reporting environment and use automated tools and techniques (ATT) without weakening evidence quality.
Core rules
- Distinguish general IT controls (access management, change management, IT operations, backup and recovery) from application controls (input validation, automated calculations, interface controls, exception reports). Reliable automated processing depends on both.
- ISA 315 (Revised 2019) requires you to identify risks from IT, including unauthorised access, inadequate program changes and inappropriate manual intervention - even in a small entity using an off-the-shelf package.
- Information produced by the entity (IPE) must be tested for completeness and accuracy before you rely on it; otherwise every analytic built on it is unsupported.
- ATT supports full-population testing (100% of journal entries, invoices, payroll lines) and exception identification, but results still need audit judgement: an exception is a question, not a conclusion.
- Segregation of duties in ERP systems is usually enforced through role design, so the role matrix and user access review are audit evidence.
- Documentation must let an experienced auditor understand the data extraction, transformation, parameters and reconciliation back to the ledger (ISA 230).
Worked example
The general ledger holds 2.3 million lines. You extract entries posted between 22:00 and 06:00, round amounts above CZK 500,000, manual postings to revenue, and postings by users without posting rights: 1,247 lines remain. Reconcile the extracted total to the trial balance (completeness), verify the period and the chart-of-accounts mapping, then sample 40 of the 1,247. Three show revenue recognised before delivery. Because these are identified, not projected, exceptions, you correct them individually and extend testing to the affected account rather than extrapolating.
Traps
Treating ATT output as audit evidence without testing the underlying data; relying on a client-generated report with no IPE testing; ignoring IT general controls because the system is "just an accounting package"; sampling when a full-population test is cheaper and better; forgetting data-protection duties when extracting personal data.