F.9 Guidance on the Use of Data Analytics

  1. Data analytics (DA), also known as computer-assisted audit techniques (CAATs), can result in a more thorough and efficient audit. DA can be used throughout the entire audit cycle, from annual planning through audit execution to follow-up. This guidance deals with the use of DA within the audit execution stage.

  2. DA has the following objectives:

    • More comprehensive analysis of transactional data

    • Ability to review a higher volume of data or number of transactions

    • Ability to identify and monitor trends and identify problem areas

    • Reduced audit time and cost, particularly for large volumes of data

    • A greater level of assurance

  3. The use of DA should be considered when there is an opportunity to increase value or decrease the time and cost of the audit. This will usually be the case when:

    • the control is automated;

    • there is a significant volume of data; or

    • there is a high level of reliance on IT controls.

  4. The following are examples of DA techniques that can be applied. These are a small subset of the full range of DA opportunities, and are provided to stimulate thinking about how DA may be applied in an engagement.

  1. DA in control design
  • Review of incompatible access permissions in enterprise resource planning systems
  1. DA in control operation
  • Stratification of data to identify areas and trends of potential control weakness
  • Identification of outliers to identify control failures
  • Checksum of control totals to confirm their operation
  1. DA in control effectiveness
  • Automated reviews and exception reporting of 100 percent of transactions
  1. DA to identify fraud and/or error
  • Review of sequential transactions for missing numbers
  • Review for duplicate transactions
  • Data matching from different sources for common information, e.g., common names, addresses, and account numbers for different payees in different systems
  • Review of unusual data entry dates and times
  1. DA in root cause analysis
  • Analysis of exceptions to determine if there were any particular patterns to the timing of their occurrence
  • Analysis of exceptions to determine if there were any particular patterns or correlations between related or different data sets
Last modified:
2018-02-23