Audit Technology, Analytics, AI and Quality Management

Introduction and context

Audit has always depended on information technology, but technology is now more than a tool for storing accounting records. Financial transactions may be created, processed and reported by integrated enterprise systems, cloud platforms, application programming interfaces (APIs), robotic process automation and artificial-intelligence systems. Consequently, auditors must understand how data is generated, how controls operate within digital environments, and how analytical tools can improve audit evidence.

Technology does not remove the auditor’s responsibility to exercise professional judgment. An attractive dashboard, an algorithmic risk score or a large data set is not automatically reliable audit evidence. The auditor must establish whether the data is complete, accurate, relevant, sufficiently precise and appropriately protected.

This chapter introduces audit analytics, visualisation and computer-assisted audit techniques; continuous auditing; cloud systems, cybersecurity and blockchain; AI-assisted risk detection; data-quality, privacy and bias issues; and engagement quality, supervision and continuous improvement.

Learning objectives

By the end of this chapter, a student should be able to:

1. Explain the purpose and basic methods of audit analytics and computer-assisted audit techniques.
2. Use simple analytical procedures, exception tests and visualisations to identify audit risks.
3. Distinguish continuous auditing from periodic auditing and explain its practical limitations.
4. Describe audit implications of cloud systems, cybersecurity and blockchain.
5. Explain how AI can assist risk detection and why human oversight remains necessary.
6. Evaluate data quality, privacy, algorithmic bias and security risks.
7. Apply principles of engagement quality, supervision, review and continuous improvement.

1. Audit analytics and computer-assisted techniques

1.1 Meaning and purpose

Audit analytics is the systematic analysis of audit-relevant data to identify patterns, relationships, unusual items and evidence relevant to an audit conclusion. It can be applied to a complete population rather than only to a sample. However, analysing all records does not guarantee that the records themselves are complete or reliable.

Computer-assisted audit techniques (CAATs) are software-based methods used to obtain, examine and evaluate electronic audit evidence. Common examples include:

• extracting the general ledger and subledgers;
• recalculating invoices, depreciation or interest;
• matching purchase orders, goods-received notes and invoices;
• searching for duplicate payments;
• testing transactions posted outside normal working hours;
• stratifying accounts receivable by age or value; and
• selecting samples using random, systematic or risk-based methods.

CAATs may be simple spreadsheet procedures, specialist audit software, database queries or scripts. Their value lies in repeatability, coverage and the ability to reveal relationships that manual inspection may miss.

1.2 A basic analytics workflow

A reliable workflow normally contains six stages:

1. Define the audit question. For example, “Are there unusual sales returns near year-end?”
2. Obtain and understand the data. Identify systems, fields, periods, currencies, populations and owners.
3. Validate the data. Reconcile totals to the ledger and investigate missing, duplicated or inconsistent records.
4. Transform and analyse. Standardise dates, remove justified duplicates, calculate measures and apply tests.
5. Investigate exceptions. An exception is an item meeting a test condition; it is not automatically an error or fraud.
6. Document and conclude. Record procedures, parameters, results, follow-up work and the effect on audit risk.

An auditor should preserve the original extracted data, document transformations and restrict access to working files. Reproducibility is important: another competent auditor should be able to understand how the result was produced.

1.3 Descriptive measures and simple formulas

Audit analytics often begins with descriptive statistics. For observations x₁, x₂, …, xₙ, the arithmetic mean is:

Here x̄ is the mean, xᵢ is an observation and n is the number of observations. The measure is appropriate for numerical data, but extreme values can distort it. The median, the middle value after sorting, may better represent transaction size where the population is highly skewed.

A simple exception rate is:

The denominator must be clearly defined. If 48 of 12,000 invoices fail a duplicate-number test, the exception rate is 48 ÷ 12,000 × 100% = 0.4%. This rate does not by itself establish a material misstatement; the auditor must investigate the exceptions and consider their value, nature and distribution.

A useful duplicate test may compare a combination of supplier identifier, invoice number, invoice date and amount. Matching only invoice numbers can produce false results because different suppliers may use the same number, while matching only amounts may identify many legitimate transactions.

Benford’s law is sometimes used to identify unusual distributions of leading digits. It is not a fraud test and should not be applied mechanically. The expected probability that the first digit is d, where d is 1 through 9, is:

The method assumes a suitable naturally occurring population spanning several magnitudes. It is generally inappropriate for assigned numbers, prices constrained by law, small homogeneous populations or data deliberately rounded to fixed amounts. A deviation is a prompt for investigation, not evidence of wrongdoing.

1.4 Visualisation

Visualisation converts data into charts or tables that support professional judgment. Appropriate forms include:

A good visualisation has a clear title, labelled axes, consistent units and an explanation of unusual observations. It should not exaggerate differences through misleading scales or three-dimensional effects. The auditor should retain the underlying data and the logic used to create the chart.

1.5 Computer-assisted substantive and control testing

CAATs can support tests of controls and substantive procedures. For example, a script can identify journal entries posted by users without posting authority, while a recalculation can test whether invoice extensions equal quantity multiplied by unit price. These tests require an understanding of the system’s fields and processing rules.

When a system automatically applies a control, the auditor may test the control’s design and operating effectiveness, including relevant information-technology general controls. These commonly include access management, change management, backup and recovery, and operations controls. Weak IT general controls may reduce confidence in automated application controls and system-generated reports.

2. Continuous auditing and technology-enabled evidence

Continuous auditing is an approach in which audit procedures or monitoring activities operate at frequent or near-real-time intervals, rather than only during an annual audit. A continuous audit system may use automated rules to flag unusual payments, access changes or transactions exceeding thresholds.

Continuous auditing differs from continuous monitoring. Continuous monitoring is usually management’s responsibility: management monitors its own controls and operations. Continuous auditing is performed by, or under the responsibility of, the internal or external auditor to obtain evidence and assess risk. The two activities may share data feeds but have different responsibilities.

A continuous-audit cycle can be represented in prose as:

Data feed → validation → rule or model → exception queue → human investigation → audit response → revised risk assessment.

Benefits include earlier detection, more timely risk assessment and the possibility of testing high-volume transactions. Limitations include cost, system integration, false positives, delayed data feeds, model maintenance and the risk that an automated test becomes outdated when business processes change. Continuous testing also does not mean that every assertion is continuously audited. The auditor must define the population, period, assertion and evidence obtained.

3. Cloud systems and cybersecurity

3.1 Cloud systems

Cloud computing provides computing resources, applications or storage through a network. In a software-as-a-service arrangement, the client uses a provider’s application; in infrastructure-as-a-service, the provider supplies computing infrastructure; and in platform-as-a-service, the provider supplies an environment for developing or running applications.

Cloud systems create a shared-responsibility issue. The provider may be responsible for physical facilities, underlying infrastructure and certain platform controls, while the client remains responsible for user access, data classification, configuration, input accuracy and appropriate use. Responsibility must be established contractually and technically; it cannot be assumed merely because a provider is reputable.

Audit considerations include:

• where data is stored and whether cross-border restrictions apply;
• user provisioning, privileged access and multi-factor authentication;
• interfaces between the cloud application and the client’s ledger;
• provider changes, incident reporting and service availability;
• data retention, backup and secure deletion; and
• independent assurance reports and complementary user-entity controls.

A provider assurance report may describe the provider’s controls, but the auditor must determine the report’s period, scope, control objectives and exceptions. Controls that the client must operate remain the client’s responsibility.

3.2 Cybersecurity

Cybersecurity is the protection of information systems and data against unauthorised access, alteration, disclosure, disruption or destruction. Its core objectives are often described as confidentiality, integrity and availability.

Cybersecurity is relevant to audit because a successful attack may alter accounting records, interrupt processing, expose personal information or create uncertainty about the completeness and accuracy of evidence. Auditors should understand significant cyber risks, incidents, response procedures and controls relevant to financial reporting.

Important safeguards include least-privilege access, segregation of duties, strong authentication, encryption, secure configuration, patch management, logging, independent backups, vulnerability management and tested incident-response plans. The auditor should not assume that the absence of a reported breach proves that systems are secure. Evidence may include access logs, change records, security assessments, incident reports and tests of relevant controls.

4. Blockchain and distributed-ledger systems

A blockchain is a type of distributed ledger in which transactions are recorded in linked blocks and validated through an agreed protocol. Cryptographic methods help detect unauthorised alteration of recorded data. A smart contract is code that executes specified actions when programmed conditions are met.

Blockchain may improve traceability and reduce the need for certain reconciliations, but it does not guarantee that the original input was true. The principle “garbage in, garbage out” still applies. A validly recorded transaction could represent a fictitious sale if the underlying event never occurred.

Audit considerations include:

• the reliability of the consensus mechanism and network governance;
• the creation and protection of private keys;
• identity of participants and rights to initiate transactions;
• smart-contract design, testing and change controls;
• valuation and existence of digital assets;
• privacy and legal enforceability; and
• interfaces between the distributed ledger and off-chain accounting systems.

The auditor may use the ledger’s history as evidence of recording and sequence, but must obtain additional evidence about existence, rights, valuation, completeness and occurrence. Blockchain changes how evidence may be obtained; it does not eliminate the need to evaluate assertions.

5. Artificial intelligence and risk detection

Artificial intelligence (AI) refers broadly to systems that perform tasks normally requiring human cognitive activity, such as classification, prediction, language processing or pattern recognition. Machine learning systems learn relationships from data. Supervised learning uses labelled examples, unsupervised learning identifies structure without predetermined labels, and generative AI produces new text, code or other outputs from learned patterns.

In audit, AI may assist with:

• classifying journal entries by risk;
• identifying unusual combinations of amount, user, time and account;
• extracting clauses from contracts;
• comparing invoices with purchase orders;
• summarising large document populations; and
• prioritising transactions for human investigation.

A risk score may combine several indicators. For example, a simple non-production model could use:

Here z₁ through zₖ are standardised risk indicators, w₁ through wₖ are selected weights, and k is the number of indicators. The score is useful only if the indicators, weights, data and decision threshold are justified and validated. A score is not a probability unless it has been calibrated against suitable outcomes.

AI-assisted procedures require controls over training data, model changes, access, explainability, performance and output review. Generative AI may produce plausible but inaccurate statements, invented citations or confidential-data leakage. Audit firms should prohibit uploading client information to unapproved tools and should require verification of all material outputs.

Human oversight is essential. The auditor remains responsible for deciding whether an exception is relevant, obtaining corroborating evidence, evaluating contradictory information and reaching the conclusion. Automation may support professional judgment but cannot replace accountability.

6. Data quality, privacy and bias

6.1 Data quality

Data quality is fitness for a defined purpose. Important dimensions include:

• accuracy: values represent the underlying events;
• completeness: required records and fields are not missing;
• validity: values conform to permitted formats and rules;
• consistency: related systems do not conflict without explanation;
• timeliness: data is available for the relevant period; and
• uniqueness: records are not unintentionally duplicated.

The auditor should reconcile extracted totals to authoritative reports, test record counts, inspect field definitions, investigate null values and document transformations. If data quality is poor, the auditor may need alternative procedures, a narrower conclusion or additional substantive testing.

6.2 Privacy and confidentiality

Audit data may include names, identification numbers, salaries, bank details and health information. Privacy principles generally require a lawful purpose, data minimisation, restricted access, appropriate retention and protection against unauthorised disclosure. Exact legal requirements vary by jurisdiction, so auditors must comply with applicable privacy and professional rules.

Practical safeguards include encryption in transit and at rest, role-based access, secure file transfer, pseudonymisation where possible, retention schedules and deletion of unnecessary copies. Using personal data for an unrelated analytics project may be inappropriate even if the data was obtained lawfully for audit.

6.3 Bias and fairness

Bias may arise from unrepresentative training data, historically biased decisions, incomplete variables, proxy variables or unequal error rates. For example, a model trained only on previously detected fraud may learn the organisation’s past investigative practices rather than the true causes of fraud.

Auditors should ask who is disadvantaged by errors, whether important groups are absent, whether variables are defensible, and whether model performance is stable across relevant populations. Statistical fairness measures can be useful, but no single measure resolves all ethical questions. A high-risk score should trigger investigation, not automatic adverse action.

7. Engagement quality, supervision and continuous improvement

Technology improves quality only when embedded in a sound engagement system. Engagement quality includes compliance with professional standards, sufficient appropriate evidence, independence, ethical conduct, competent personnel, effective supervision and an appropriate conclusion.

7.1 Planning and risk-based use of technology

The engagement team should determine what technology is needed, who has the competence to use it, what evidence it can produce and what limitations apply. The audit plan should link analytical procedures to assertions and risks. A sophisticated tool that does not address a significant risk is not a substitute for relevant audit work.

7.2 Supervision and review

Supervision involves directing assistants, monitoring progress, addressing difficult matters and ensuring that work supports the audit conclusion. Review involves evaluating whether procedures were properly performed, evidence is sufficient and conclusions are reasonable. Review intensity should reflect the complexity and risk of the work.

For analytics, review should include the objective, population, extraction method, transformations, code or query logic, exception handling and conclusion. Reviewers should challenge unexplained assumptions rather than merely checking whether a dashboard looks complete.

7.3 Engagement quality review

Where required by applicable standards or firm policy, an engagement quality reviewer performs an objective evaluation of significant judgments and conclusions before the report is released. The reviewer should have appropriate competence, authority and independence from the engagement decisions being reviewed. An engagement quality review is not a second audit of every transaction; it is a focused evaluation of significant matters, risks, judgments and the proposed report.

7.4 Continuous improvement

A firm should learn from inspection findings, restatements, complaints, security incidents, near misses and post-engagement reviews. A practical improvement cycle is:

1. identify a deficiency or opportunity;
2. analyse its root cause;
3. design a corrective action;
4. assign responsibility and a timetable;
5. implement the action; and
6. test whether the action was effective.

For example, if analysts repeatedly fail to document data transformations, the root cause may be unclear templates or insufficient training. The response might combine a standard workpaper, peer review and periodic inspection. Counting completed training sessions is weaker than testing whether documentation quality improved.

Applied case: illustrative cloud analytics engagement

Background

Northstar Components Ltd, an illustrative manufacturing company, moved its purchasing and accounts-payable system to a cloud platform. The external auditor planned to use a complete-population analysis of 85,000 payments.

Problem

The audit team identified three risks: duplicate payments, unauthorised supplier changes and payments posted immediately before year-end. The client supplied a spreadsheet export, but the total payments did not agree with the general ledger.

Analysis

The team preserved the original file and reconciled record counts, dates and total amounts. They discovered that one payment batch was excluded from the export and that credit notes were presented with negative amounts in one system and positive adjustment fields in another. After obtaining a corrected extract, the team tested:

• duplicate combinations of supplier, invoice number and amount;
• supplier-bank changes followed by payments within seven days;
• payments posted in the final three days of the year; and
• user IDs against the authorised access list.

The analysis identified 31 apparent duplicates, 12 supplier-bank changes followed by payments, and 146 year-end transactions. Investigation showed that 25 apparent duplicates were legitimate recurring charges with different service periods. Six required recovery or adjustment. Two bank changes lacked evidence of independent approval, and one was a genuine fraud incident. Year-end testing identified a cut-off error that understated an accrual.

Approach and outcome

The auditor obtained third-party confirmation of relevant cloud controls, tested the client’s complementary access controls, inspected approval evidence and performed additional substantive procedures. The client recovered the fraudulent payment, corrected the accrual and improved bank-change verification. The auditor documented the data reconciliation, analytic logic, exceptions and conclusions.

Learning points

The case demonstrates that complete-population analytics depends on a complete and correctly interpreted population. Exceptions require investigation rather than automatic conclusions. Cloud-provider controls do not replace client controls. Finally, technology helped focus audit effort, but human evaluation and corroborating evidence produced the final conclusions.

Challenges and limitations

Technology-enabled auditing has several limitations. Data extraction may be incomplete; systems may use inconsistent definitions; models may generate false positives or false negatives; and staff may overtrust automated outputs. Cyber incidents can compromise evidence, while rapid software changes can invalidate previously tested routines. Costs, licensing, specialist skills and vendor dependence may also be significant.

Auditors should therefore use proportionality. A simple, well-understood test may be more reliable than an opaque model. They should retain non-technical explanations of procedures, maintain fallback procedures, test changes and communicate significant technology risks to those charged with governance.

Chapter Summary

Audit technology includes CAATs, data extraction, recalculation, matching, exception testing and visualisation. A disciplined workflow begins with a clear audit question, validates the population, analyses relevant data, investigates exceptions and documents the conclusion. Descriptive measures and tools such as leading-digit analysis can identify areas for attention but do not independently prove misstatement or fraud.

Continuous auditing provides frequent or near-real-time procedures, while continuous monitoring remains primarily a management activity. Cloud systems require attention to shared responsibilities, access, data location, interfaces and provider assurance. Cybersecurity affects confidentiality, integrity and availability of audit-relevant information. Blockchain can strengthen traceability, but it cannot validate false inputs or replace assertion-based evidence.

AI can classify, predict and prioritise risks, but its outputs depend on data, design and validation. Data quality, privacy, bias and cybersecurity must be managed throughout the analytics lifecycle. Human oversight remains essential for interpretation, corroboration and accountability. Finally, engagement quality depends on competent planning, supervision, review, independence, engagement quality review where applicable and a tested cycle of continuous improvement.

Key Terms

Audit analytics: Systematic analysis of audit-relevant data to support risk assessment and evidence.

CAATs: Computer-assisted audit techniques used to obtain, test and evaluate electronic information.

Exception: A record or condition that meets a defined test criterion and requires evaluation.

Visualisation: Graphical or tabular presentation of data to support understanding and analysis.

Continuous auditing: Frequent or near-real-time audit procedures or monitoring activities.

Continuous monitoring: Management’s ongoing observation of operations and controls.

Cloud computing: Delivery of computing resources or applications through a network.

Shared responsibility: Division of technology and control responsibilities between provider and client.

Cybersecurity: Protection of systems and data from unauthorised access, alteration, disclosure or disruption.

Blockchain: A distributed ledger using linked records and a validation protocol.

Smart contract: Code that performs programmed actions when specified conditions occur.

Artificial intelligence: Systems performing tasks associated with human cognitive activity.

Machine learning: Methods that learn patterns from data for classification or prediction.

Data quality: Fitness of data for a defined purpose.

Data minimisation: Collection and retention of only data necessary for a legitimate purpose.

Algorithmic bias: Systematic distortion in automated outputs affecting groups or decisions.

Human oversight: Competent human evaluation and control of automated outputs.

Engagement quality review: Objective review of significant judgments and conclusions before report release where required.

Continuous improvement: Structured identification, correction and verification of improvements in audit processes.

Review Questions

Short Answer Questions

1. What is the difference between audit analytics and CAATs?
2. Why does an exception rate not automatically establish a misstatement?
3. Distinguish continuous auditing from continuous monitoring.
4. State two audit considerations arising from cloud computing.
5. Why is human oversight necessary when AI is used in an audit?

Long Answer Questions

1. Explain a six-stage workflow for conducting reliable audit analytics.
2. Discuss how cybersecurity risks can affect the reliability of audit evidence.
3. Explain the audit implications of blockchain, including why blockchain does not prove that an underlying transaction occurred.
4. Discuss data quality, privacy and bias risks in AI-assisted audit procedures.
5. Explain how supervision, engagement quality review and continuous improvement contribute to audit quality.

Analytical / Application Questions

1. An auditor identifies 60 unusual payments from a population of 20,000. Calculate the exception rate and explain what further work is required before drawing a conclusion.
2. A cloud system produces a report of all supplier payments, but the report total does not reconcile to the general ledger. Design an appropriate audit response.
3. An AI model assigns high-risk scores mainly to transactions involving one geographic region. Explain possible causes, investigations and safeguards before the scores are used in audit testing.

Multiple Choice Questions with Answers

Question 1

Which procedure is most directly an example of a CAAT?

A. Discussing business strategy with the chief executive

B. Matching purchase orders, receipts and invoices electronically

C. Reading the auditor’s ethical code

D. Observing a board meeting

Correct Answer: B. Matching purchase orders, receipts and invoices electronically

Question 2

If 48 of 12,000 invoices are exceptions, what is the exception rate?

A. 0.04%

B. 0.4%

C. 4%

D. 40%

Correct Answer: B. 0.4%

Question 3

Which statement best distinguishes continuous auditing from continuous monitoring?

A. Continuous auditing is always performed by management

B. Continuous monitoring is an external-audit opinion

C. Continuous monitoring is generally management’s activity, while continuous auditing is an audit activity

D. There is no difference between them

Correct Answer: C. Continuous monitoring is generally management’s activity, while continuous auditing is an audit activity

Question 4

Under a cloud shared-responsibility model, which control commonly remains the client’s responsibility?

A. Physical security of the provider’s data centre

B. Maintenance of the provider’s power supply

C. User access and client-side configuration

D. Design of the provider’s network hardware

Correct Answer: C. User access and client-side configuration

Question 5

What is a principal limitation of blockchain evidence?

A. It cannot record transaction sequence

B. It proves that every input transaction is economically genuine

C. It may reliably preserve a record without proving that the original input was true

D. It cannot use cryptographic techniques

Correct Answer: C. It may reliably preserve a record without proving that the original input was true

Question 6

Which statement about an AI risk score is correct?

A. A risk score automatically proves fraud

B. A score is a probability even without calibration

C. A score should be evaluated, validated and followed by appropriate human investigation

D. A score removes the need for audit evidence

Correct Answer: C. A score should be evaluated, validated and followed by appropriate human investigation

Question 7

Which is a dimension of data quality?

A. Decorative appearance

B. Completeness

C. Popularity of the software vendor

D. Number of dashboard colours

Correct Answer: B. Completeness

Question 8

Which practice best protects confidential audit data used in analytics?

A. Uploading it to any free public AI tool

B. Sharing unrestricted copies by personal email

C. Using access controls, encryption and secure retention procedures

D. Removing all documentation of transformations

Correct Answer: C. Using access controls, encryption and secure retention procedures

Question 9

What is the appropriate interpretation of an unusual leading-digit distribution?

A. It conclusively proves fraud

B. It is a possible indicator requiring further investigation

C. It proves that the data is complete

D. It replaces substantive testing

Correct Answer: B. It is a possible indicator requiring further investigation

Question 10

What is the main purpose of an engagement quality review?

A. To reperform every transaction in the audit

B. To approve the client’s accounting system design

C. To objectively evaluate significant judgments and conclusions before report release where required

D. To replace supervision by the engagement partner

Correct Answer: C. To objectively evaluate significant judgments and conclusions before report release where required