Information Systems, Data Analytics and Emerging Technology
Information Systems, Data Analytics and Emerging Technology tests IT governance, controls, audit analytics and the risks of emerging tools. Questions link technology to financial reporting risk and audit evidence.
Core rules
- COBIT 2019: governance and management objectives; align IT with strategy; risk and resource optimisation.
- ITGCs: access, change management, operations and backup; application controls: input, processing and output.
- CAAT and analytics: completeness and accuracy of data must be tested before reliance; population analytics can replace sampling for some tests.
- Analytics types: descriptive, diagnostic, predictive and prescriptive; Benford's law, regression, clustering and exception testing.
- Emerging tech: RPA, AI/ML, blockchain and cloud; risks include bias, explainability, data privacy and third-party dependence.
- Nigerian context: Nigeria Data Protection Act 2023, CBN cybersecurity framework and SEC rules on digital assets.
Worked example: An auditor runs Benford's law on 200,000 journal entries. Digit 1 appears 42% of the time against an expected 30.1%, and the excess is concentrated in manual entries near period end. This is a risk indicator, not proof of fraud; the auditor traces the flagged entries to supporting documents and tests the journal approval control. If the extract is incomplete, the analytics result is unreliable.
Traps: relying on analytics without testing data integrity; treating Benford exceptions as fraud; ignoring ITGCs while testing application controls; assuming blockchain eliminates audit risk; overlooking third-party cloud assurance reports.