Information Technology and Data Analysis in Audit
IT in the audit
Candidates must understand how IT affects the entity's internal control and the auditor's approach. Know general IT controls (access management, change management, IT operations, backup) and application controls (input, processing, output). Understand the concepts of IT-dependent manual controls and the use of computer-assisted audit techniques (CAATs).
Data analysis
Modern audit uses data analytics: full-population testing, journal-entry testing, trend and anomaly detection, and visualization. Candidates must know that data analytics supports risk assessment and substantive testing but does not replace professional judgement. Data reliability (completeness, accuracy) must be established before conclusions are drawn.
Traps in questions
- Assuming automated controls need no testing - they can fail if general IT controls are weak.
- Treating data analytics output as audit evidence without validating data integrity.
- Confusing general IT controls with application controls.
- Believing CAATs eliminate the need for sampling judgement; they change the population but not the reasoning.
Rule of thumb
Before relying on any automated control or analytics, ask: are the underlying data complete and accurate, and are the general IT controls over the system effective? If either answer is uncertain, extend substantive testing.