Information Technology and Data Analytics in Audit
Information Technology and Data Analytics in Audit
This domain tests how auditors use IT controls and data analytics while preserving evidence reliability. Questions cover IT general controls, application controls, computer-assisted audit techniques, journal-entry testing and the limits of analytics.
Core rules
- IT general controls include access management, change management, IT operations and backup/recovery. Weak ITGCs undermine reliance on automated application controls.
- Application controls cover input, processing and output; examples are edit checks, sequence checks and reconciliation controls.
- Data analytics is effective for full-population testing, duplicate detection, trend analysis and journal-entry anomaly testing.
- Before relying on analytics, the auditor tests completeness and accuracy of the extracted population, for example by reconciling record counts and totals to the general ledger.
- An exception is a signal for further investigation, not proof of fraud or error.
Worked example
An auditor tests duplicate vendor payments by extracting all payment transactions and matching vendor, invoice number, amount and date. The extract is reconciled to the general ledger control total to confirm completeness. Exact matches are investigated; near-duplicates are reviewed for split invoices. Each exception is traced to supporting documents and management is asked for an explanation. The auditor does not conclude fraud from the analytics output alone; the conclusion depends on corroborating evidence.
Traps that cost marks
- Treating analytics exceptions as automatic misstatements.
- Testing only the visible fields and ignoring the completeness of the data extract.
- Relying on an automated control without testing the relevant ITGCs.
- Assuming audit software output is itself audit evidence.