Information Technology and Data Analytics for Accountants
The Information Technology and Data Analytics for Accountants domain tests IT general controls, application controls, computer-assisted audit techniques and data analytics. The exam expects you to judge when technology-based evidence is reliable and how analytics supports risk assessment and substantive testing.
Core rules
- IT general controls (ITGCs): access management, change management, IT operations and backup/recovery. They underpin reliance on automated controls.
- Application controls: input, processing and output controls, such as edit checks, sequence checks, reconciliations and exception reports.
- CAATs: audit software, test data, parallel simulation and embedded audit modules. Extract the population, verify completeness and accuracy, then test.
- Data analytics: duplicate testing, gap detection, journal-entry testing, trend analysis and Benford's law. Analytics identifies anomalies; it does not by itself prove misstatement or fraud.
- Cybersecurity: confidentiality, integrity and availability; phishing, ransomware and access breaches; cloud arrangements create shared responsibility.
- Cambodian practice: GDT e-filing and digital records increase the need to test system-generated reports and data retention controls.
Worked example
An auditor tests 50,000 vendor payments for Benford's law. The expected first-digit frequency for '1' is about 30.1%, but the observed frequency is 45%. Before concluding fraud, the auditor checks that the data is complete and that the population is suitable: Benford applies to naturally occurring amounts spanning several orders of magnitude, not to fixed prices or assigned invoice numbers. The result is a risk indicator requiring further testing.
Traps
Using analytics without validating source data; treating a Benford deviation as proof of fraud; ignoring ITGCs when relying on automated controls; testing only a sample when the full population is available; and failing to document data extraction and parameters.