Information Technology and Data Analytics: Controls, CAATs and Evidence
Information Technology and Data Analytics tests how auditors and managers obtain assurance from systems and use data to improve evidence quality.
Core rules
- IT general controls cover access, change management, IT operations and backup. Weak ITGCs undermine reliance on automated application controls.
- Application controls include input validation, sequence checks, matching, authorisation and exception reports.
- CAATs include data extraction, re-performance, duplicate testing, gap detection and recalculation.
- Data analytics is most useful when the population is complete and reliable. Reconcile record counts and control totals before testing.
- COBIT provides a governance framework for enterprise IT; COSO addresses internal control.
- The Nigeria Data Protection Act 2023 restricts processing of personal data; analytics must respect lawful basis, minimisation and security.
Worked example
To test duplicate payments, extract the full payments ledger for the period. Reconcile the record count and total value to the general ledger. Sort by vendor, invoice number and amount; flag exact matches and near-duplicates. Investigate each exception against supporting documents. If 43 duplicates totalling NGN 12m are found, quantify the misstatement, assess control failure and extend testing. The test is stronger than a sample because it covers the population, but only if the extracted data is complete.
Traps
Relying on a system report without testing ITGCs; ignoring incomplete populations; treating exceptions as fraud without investigation; using analytics only at year-end; and breaching privacy rules while extracting employee data.