Information technology and data analytics
This domain tests how systems capture transactions, how controls over those systems work, and how auditors and managers use data analytics to test populations rather than samples.
Core concepts
- System types: transaction processing systems capture daily transactions; MIS summarises; DSS and EIS support decisions. ERP integrates modules on one database - the benefit is a single source of truth; the risk is that a failed implementation or a single access-control flaw corrupts everything.
- IT general controls (ITGCs): access management, change management, backup and recovery, and operations. Application controls: input (field checks, validity, sequence), processing (control totals, run-to-run reconciliation) and output (distribution and reconciliation). ITGCs support reliance on application controls.
- Analytics: descriptive, diagnostic, predictive and prescriptive. Big data is described by volume, velocity, variety, veracity and value.
- Data quality: completeness, accuracy, validity, consistency, timeliness and uniqueness - poor input data defeats sophisticated models.
- Audit analytics and CAATs: test data, parallel simulation, embedded audit modules, journal-entry testing, duplicate-payment testing, full-population recalculation.
- Security: least privilege, multi-factor authentication, encryption, phishing and ransomware awareness, cloud shared-responsibility models.
Worked example
An auditor suspects cut-off manipulation. Using the journal extract, filter entries where the document date falls before year-end but the posting date falls after it, and test for duplicates with a GROUP BY invoice number HAVING COUNT(*) > 1 query. A concentration of manual postings to revenue after the close indicates cut-off risk. The recommendation is a period-close lock and a review of manual journals above a threshold, not a larger sample of the same population.
Traps that cost marks
Confusing ITGCs with application controls; treating sample results as proof about the population without projecting errors; assuming an ERP removes control risk; equating high data volume with high value.