Technology, AI and Digital Audit

Introduction and context

Digital technologies have changed both the systems that generate financial information and the methods auditors use to obtain assurance. Transactions may be initiated through cloud applications, processed by enterprise resource planning (ERP) systems, enriched by artificial intelligence (AI), and recorded across interconnected platforms. Audit evidence is therefore increasingly electronic, continuous, automated and dependent on information technology controls.

The auditor’s fundamental objective remains unchanged: to obtain sufficient appropriate audit evidence and express a conclusion based on professional judgement. Technology changes the nature, timing and scale of procedures, but it does not remove the auditor’s responsibility for risk assessment, scepticism, evidence evaluation or ethical conduct.

A digital audit is not simply a conventional audit performed with software. It is an audit in which technology is embedded in understanding the entity, identifying risks, testing controls, analysing populations, investigating anomalies and documenting conclusions.

Learning objectives

After studying this chapter, readers should be able to:

• evaluate cloud platforms and ERP environments from an audit perspective;
• distinguish automated, general IT and application controls;
• assess robotic process automation (RPA), blockchain and cybersecurity risks;
• explain continuous auditing and data-analytic audit methods;
• evaluate AI-assisted audit tools with attention to explainability, bias, privacy and model risk;
• assess the reliability, completeness and relevance of digital evidence;
• design appropriate human oversight and governance arrangements; and
• apply these concepts to a complex audit scenario.

1. The digital audit environment

An entity’s information environment normally contains several layers:

1. Infrastructure: servers, networks, devices, storage and identity services.
2. Platforms: cloud services, databases and operating systems.
3. Applications: ERP, payroll, sales, procurement and consolidation systems.
4. Interfaces: application programming interfaces (APIs), file transfers and middleware.
5. Data and analytics: master data, transaction data, logs, dashboards and models.
6. Governance: policies, access rights, change management, incident response and oversight.

A financial statement audit must consider how these layers affect assertions such as occurrence, completeness, accuracy, cut-off, valuation, rights and obligations, and presentation. For example, an automated three-way match may support the accuracy and occurrence of purchases, but only if supplier master data, configuration, interfaces and override permissions are properly controlled.

Technology risk is not identical to cybersecurity risk. Cybersecurity concerns unauthorised access, disruption, manipulation, disclosure and destruction. Technology risk is broader and includes failed implementations, poor data migration, erroneous configurations, inadequate change management and unreliable interfaces.

2. Cloud platforms and ERP systems

Cloud service models

Cloud services are commonly classified as:

Cloud arrangements usually operate under a shared-responsibility model. The provider may secure the physical infrastructure and core platform, while the customer remains responsible for user provisioning, data classification, configuration, interfaces and business processes. Responsibility must be established contractually and technically rather than assumed from the phrase “cloud secure”.

Important audit procedures include:

• understanding the architecture, regions and data flows;
• inspecting contracts, service-level agreements and right-to-audit provisions;
• evaluating independent assurance reports on the service provider;
• testing customer-entity controls identified in those reports;
• examining access management, privileged accounts and multifactor authentication;
• reviewing backups, resilience, incident reporting and disaster recovery;
• testing configuration and change-management controls; and
• assessing whether data retention and deletion meet legal and business requirements.

A provider assurance report is useful evidence but is not a substitute for evaluating the relevance, period, scope and exceptions of the report. A report may cover only selected controls, a different period or a different service from the one used by the audit client.

ERP systems

ERP systems integrate general ledger, purchasing, inventory, sales, payroll and reporting. Integration creates efficiency but also concentration risk: a single incorrect configuration may affect many transactions. Auditors should understand:

• the chart of accounts and posting logic;
• automated approval workflows;
• segregation of duties;
• interfaces and rejected-transaction queues;
• master-data controls;
• journal-entry functionality;
• system-generated reports; and
• migration and implementation controls.

ERP testing should combine process walkthroughs, configuration inspection, reperformance, access analysis, interface reconciliation and substantive data analysis. A control is not effective merely because it is configured. The auditor must determine whether it operated during the relevant period and whether users could bypass it.

3. Control architecture in digital systems

Digital controls can be grouped into three categories.

General IT controls

General IT controls support the reliable operation of applications. They include:

• user access administration;
• privileged-access monitoring;
• program development and change management;
• backup and recovery;
• job scheduling and operations;
• incident management; and
• system acquisition and implementation controls.

Weak general IT controls may undermine reliance on many application controls. For example, an automated credit-limit control has limited evidential value if unauthorised users can change its configuration.

Application controls

Application controls operate within a particular process. Examples include automated validation of invoice fields, duplicate-invoice detection, three-way matching, tolerance checks, sequential numbering, automated depreciation and exception reporting.

Application controls may be preventive, detective or corrective. Their effectiveness depends on the correctness of the underlying rules, data, interfaces and access rights.

Automated controls and audit evidence

An automated control can be tested by evaluating its design, configuration and operation. Where the control has not changed and relevant general IT controls are effective, prior-period testing may sometimes be useful, subject to professional standards and the auditor’s assessment of risk. Evidence must nevertheless cover the period for which reliance is proposed.

The auditor should retain evidence of the control logic, relevant parameters, test data or observed operation, access rights, change history and exception resolution. Screenshots alone are often weak evidence because they may not establish who generated them, when they were generated or whether they represent the complete population.

4. Robotic process automation

RPA uses software bots to execute structured, repetitive tasks through predefined rules. Typical uses include extracting data, reconciling accounts, preparing reports and transferring information between applications.

RPA can improve consistency and reduce manual error, but it creates distinctive risks:

• bots may use outdated credentials;
• scripts may fail after interface changes;
• exceptions may be suppressed or routed incorrectly;
• bot activity may not be adequately logged;
• developers may have excessive production access; and
• responsibility for reviewing outputs may be unclear.

An auditor should inspect bot inventories, ownership, code or workflow logic, change approvals, credentials, schedules, logs, exception reports and reconciliations. The key question is not whether a bot ran successfully, but whether it produced complete and accurate results from authorised inputs.

5. Blockchain and distributed ledger technology

A blockchain or distributed ledger records transactions across a network using cryptographic techniques and a consensus mechanism. Its characteristics may support traceability and resistance to unauthorised alteration, but they do not guarantee that recorded information is true.

The audit implications depend on whether the ledger is public or permissioned, who validates transactions, how private keys are controlled, and how off-chain information enters the ledger. Important risks include:

• erroneous or fraudulent data entered initially;
• compromised private keys;
• flawed smart-contract code;
• uncertain legal ownership;
• inappropriate consensus arrangements;
• incomplete links between on-chain and off-chain records; and
• valuation or existence risks for digital assets.

“Immutable” means that alteration is difficult or detectable within the protocol; it does not mean that the original transaction was valid. Auditors must test the reliability of interfaces, oracles, smart contracts, wallets and management’s valuation assumptions. Blockchain data may provide strong evidence of what was recorded, but separate evidence may be required for rights, obligations, occurrence and valuation.

6. Cybersecurity and audit risk

Cyber incidents can create direct financial misstatement and indirect effects such as business interruption, litigation, regulatory sanctions and reputational damage. The auditor should consider risks involving confidentiality, integrity and availability.

A practical cybersecurity assessment considers:

• governance and risk ownership;
• identity and access management;
• network segmentation and endpoint protection;
• vulnerability and patch management;
• security monitoring and anomaly detection;
• incident response and forensic preservation;
• backup resilience and recovery testing; and
• third-party and supply-chain exposure.

Cybersecurity specialists may assist with penetration testing, incident analysis and technical control evaluation. The financial auditor remains responsible for connecting technical findings to financial statement assertions. For example, a ransomware incident may require consideration of impairment, provisions, revenue disruption, inventory records, data restoration and subsequent events.

7. Data analytics and continuous auditing

Traditional audits often select samples at periodic intervals. Digital audit tools can analyse entire populations, identify unusual patterns and test relationships across systems. Techniques include duplicate testing, Benford-style analysis used cautiously, gap detection, stratification, outlier analysis, journal-entry testing and matching independent data sources.

Analytics do not automatically create audit evidence. The auditor must establish data completeness and accuracy, define the population, validate transformation rules, assess false positives and document how results affected risk assessment or substantive procedures.

Continuous auditing uses automated procedures performed at frequent or near-real-time intervals. Continuous monitoring is management’s activity; continuous auditing is an independent assurance activity. A continuous audit programme may monitor unusual journal entries, dormant vendors, rapid changes to bank details, unusual access and transactions outside approved tolerances.

The frequency of testing should reflect risk, transaction volume, system capability and the cost of investigation. More frequent testing is not necessarily better if alerts are poorly designed and investigators cannot resolve them.

8. AI-assisted audit tools

AI-assisted tools may include machine-learning classification, natural-language processing, anomaly detection, document extraction, forecasting and generative systems. They can help auditors search contracts, compare ledger entries with source documents, identify unusual transactions and summarise evidence.

AI should support, not replace, professional judgement. A tool’s output is an audit input requiring evaluation. The auditor should understand the tool’s purpose, training or reference data, inputs, output meaning, limitations and validation status.

Explainability

Explainability concerns whether a user can understand why a model produced an output. A complex model may have high predictive performance but offer limited transparency. In audit, explainability is important because the auditor must justify procedures and conclusions to reviewers, regulators and possibly courts.

Useful documentation includes the model objective, variables, decision thresholds, version, validation results, known limitations and examples of representative outputs. A post-hoc explanation is not always equivalent to understanding the model’s actual decision process.

Bias and fairness

Bias may arise from unrepresentative training data, historical practices, missing values, proxy variables or unequal error rates. For example, a fraud model trained on historical investigations may reproduce earlier targeting patterns rather than identify fraud objectively.

Auditors should assess whether the data and model are appropriate for the client, whether error rates differ across relevant groups, and whether human review is required for high-impact decisions. Bias assessment is context-dependent and should be documented rather than treated as a one-time certification.

Privacy and confidentiality

Audit data may include payroll, health, customer and financial information. Uploading such data to an external AI service can create confidentiality, transfer, retention and access risks. Controls should address data minimisation, lawful processing, encryption, segregation, retention, vendor terms and prohibition of unauthorised training use.

Where possible, auditors should use masked or pseudonymised data, approved enterprise environments and access controls. Privacy protection does not eliminate the need to retain sufficient evidence for review.

Model risk

Model risk is the possibility that a model produces an incorrect or misleading result because of inappropriate design, data, implementation, use or change. Governance should include:

• documented purpose and ownership;
• independent validation proportionate to risk;
• version control and change approval;
• performance and drift monitoring;
• access restrictions;
• exception handling; and
• retirement criteria.

Generative AI creates additional risks, including fabricated citations, plausible but incorrect summaries, leakage of confidential information and inconsistent outputs. It should not be treated as an authoritative source without verification against original evidence.

Human oversight

Human oversight should be meaningful rather than ceremonial. The reviewer must be competent to challenge the system, have access to underlying evidence and be able to override or reject outputs. High-risk conclusions should require corroboration and explicit approval. Audit documentation should distinguish machine-generated suggestions from procedures actually performed and conclusions reached by the engagement team.

9. Reliability of digital evidence

Digital evidence is evaluated using the same fundamental principles of relevance, reliability, sufficiency and appropriateness, adapted to technical circumstances. Reliability is influenced by source independence, control over creation and alteration, completeness, accuracy, reproducibility and the competence of the person or system producing it.

An auditor should ask:

• What system generated the evidence?
• Is the system authorised and properly controlled?
• Can the population be shown to be complete?
• Can records be altered without detection?
• Are timestamps reliable and synchronised?
• Can the result be reproduced?
• Is the evidence directly relevant to the assertion?

A report exported from an ERP may be persuasive for one purpose but unreliable for another if parameters are unknown or data can be excluded. Hashes, digital signatures and audit logs can support integrity, but they do not establish the truth of the underlying business event.

10. An integrated digital-audit methodology

A robust methodology can be organised as follows:

1. Map the environment: identify systems, providers, interfaces, data owners and critical processes.
2. Identify assertion-level risks: connect technology risks to possible misstatements.
3. Evaluate controls: test general IT controls, application controls and governance.
4. Validate data: establish completeness, accuracy, extraction logic and transformation integrity.
5. Select procedures: combine automated testing, inspection, observation, reperformance, confirmation and substantive analysis.
6. Investigate exceptions: distinguish genuine risk from data-quality or rule-design problems.
7. Evaluate evidence: consider reliability, contradiction and corroboration.
8. Document judgement: record assumptions, tool versions, thresholds, results and conclusions.
9. Review and govern: apply independent review, security controls and retention requirements.

This approach avoids “technology optimism”, the mistaken belief that sophisticated tools necessarily produce better assurance.

Applied case: illustrative scenario—Orion Retail Group

Background

Orion Retail Group operates 240 stores and an online platform. Its finance function uses a cloud ERP system integrated with a warehouse system, payment gateway and RPA bots. Management has introduced an AI tool that identifies unusual refunds and prepares draft explanations for audit committees.

Problem

The audit team plans to rely on automated revenue controls and use the AI tool to reduce substantive testing. During planning, it discovers that the cloud provider’s assurance report excludes the warehouse interface, two bots share a service account, and the refund model was trained on two years of historical investigations.

Analysis

The excluded warehouse interface creates a completeness and cut-off risk for inventory and cost of sales. Shared bot credentials weaken accountability and may permit unauthorised changes. Historical training data may encode investigators’ previous selection bias. Draft AI explanations may also contain unsupported statements.

The team therefore cannot rely solely on the provider report or the AI output. It obtains system architecture documentation, tests interface reconciliations, reviews bot logs, examines privileged access, validates refund-data extraction and performs independent substantive procedures over revenue and inventory.

Approach and solution

The team recommends individual bot identities, multifactor authentication, formal bot ownership, code review and daily exception reconciliation. It tests a complete refund population, investigates high-risk outliers, and compares model outputs with random selections to assess false negatives. AI-generated explanations are treated as preliminary leads and verified against source documents. Management is asked to document the model’s purpose, variables, version and monitoring process.

Outcome

The audit identifies several legitimate refunds that the model failed to flag and one interface timing problem that understated inventory receipts at month-end. The financial statements are corrected. The audit team concludes that selected automated controls can be relied upon only after compensating procedures and improved access controls are implemented.

Learning points

The case demonstrates that cloud assurance is not comprehensive by default, automation requires accountable ownership, AI outputs are not evidence without validation, and digital risks must be translated into financial statement assertions.

Challenges, governance and professional implications

Digital auditing creates several strategic challenges. Skills must combine accounting, audit methodology, data analysis, cybersecurity and systems understanding. Firms must control the use of external tools and preserve confidentiality. Regulators and audit committees increasingly expect evidence that automated methods are validated and reviewable.

Governance should assign responsibility to management, technology owners, internal audit, risk functions and the external auditor. Policies should cover approved tools, data classification, model validation, incident escalation, human review, documentation and retention.

Professional judgement remains central. Auditors should avoid automation bias—the tendency to accept a system output because it appears objective or sophisticated—and should also avoid algorithm aversion, the unjustified rejection of useful tools. A balanced approach evaluates evidence, limitations and corroboration.

Contemporary developments and best practices

Current developments include privacy-enhancing analytics, secure multiparty computation, confidential computing, synthetic data, process mining, intelligent document processing and increasingly integrated audit platforms. These developments may improve scale and speed but also increase dependence on vendors, models and complex supply chains.

Best practices include:

• begin with assertions and risks, not with fashionable tools;
• maintain an inventory of systems, interfaces, bots and models;
• validate data before analysing it;
• separate development, testing and production access;
• preserve reproducible audit trails;
• assess model performance and drift;
• minimise and protect personal data;
• corroborate high-impact AI outputs;
• retain competent human oversight; and
• communicate technology limitations clearly to those charged with governance.

Chapter Summary

Technology changes the audit environment, but not the auditor’s fundamental responsibility to obtain sufficient appropriate evidence and exercise professional judgement. Cloud platforms require analysis of shared responsibility, provider assurance and customer controls. ERP systems concentrate processing and configuration risk. General IT controls support reliance on automated application controls, while RPA introduces risks involving credentials, changes, logs and exceptions.

Blockchain can strengthen traceability but does not prove that recorded information is valid. Cybersecurity risks must be connected to financial statement assertions and may require specialist assistance. Data analytics and continuous auditing expand coverage, but depend on complete, accurate and well-defined populations.

AI-assisted tools can improve audit efficiency, yet explainability, bias, privacy, model risk, confidentiality and human oversight are essential. Digital evidence must be evaluated for relevance, reliability, completeness, accuracy and reproducibility. The most effective digital audit is risk-led, technically informed, sceptical and properly governed.

Key Terms

Cloud computing: Delivery of computing services through remote, provider-managed infrastructure.

Shared responsibility: Division of security and control responsibilities between a cloud provider and its customer.

ERP system: Integrated application supporting multiple organisational processes and records.

General IT control: Control supporting the reliable operation of information systems.

Application control: Control embedded within a specific business application or process.

RPA: Software automation that performs rule-based, repetitive tasks.

Blockchain: Distributed ledger using cryptographic and consensus mechanisms to record transactions.

Smart contract: Code that executes agreed rules on a distributed ledger.

Cybersecurity: Protection of information systems and data from unauthorised or harmful activity.

Continuous auditing: Independent assurance performed using frequent or near-real-time procedures.

Continuous monitoring: Management’s ongoing observation of controls, risks or transactions.

Data completeness: Whether the analysed population contains all relevant records.

Explainability: The extent to which a model’s output and reasoning can be understood.

Bias: Systematic distortion that may produce unfair or inaccurate results.

Privacy: Protection and lawful handling of information relating to identifiable persons.

Model risk: Risk of an incorrect or misleading model output or use.

Automation bias: Undue reliance on an automated system’s recommendation.

Digital evidence: Electronic information used to support an audit conclusion.

Human oversight: Competent human review, challenge and control over automated outputs.

Interface: Technical connection through which data moves between systems.

Review Questions

Short Answer Questions

1. What is meant by the shared-responsibility model in cloud computing?
2. Why can weak general IT controls undermine reliance on automated application controls?
3. Identify two audit risks associated with RPA.
4. Why does blockchain immutability not prove that a transaction is valid?
5. What is the difference between continuous auditing and continuous monitoring?

Long Answer Questions

1. Explain how an auditor should evaluate a cloud-based ERP environment.
2. Discuss the reliability and limitations of blockchain evidence in a financial statement audit.
3. Explain the principal governance requirements for AI-assisted audit tools.
4. Evaluate the relationship between cybersecurity incidents and financial statement assertions.
5. Discuss how data analytics can improve audit quality while creating new evidence risks.

Analytical / Application Questions

1. An auditor receives an AI-generated list of unusual journal entries but cannot obtain the model version or training-data description. Should the list be used as audit evidence? Analyse the appropriate response.
2. A company’s RPA bot posts supplier payments using a shared service account, and its exception log is incomplete. Identify the control deficiencies and design an audit response.
3. A cloud provider’s assurance report covers the application but excludes a critical interface to the client’s warehouse system. Assess the implications for reliance and propose further procedures.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the cloud shared-responsibility model?

A. The provider is responsible for every security and data-control activity.

B. The customer is responsible for the physical data centre and network hardware.

C. Responsibilities are divided between provider controls and customer controls.

D. No party has responsibility once data is placed in the cloud.

Correct Answer: C. Responsibilities are divided between provider controls and customer controls.

Question 2

Which control most directly supports reliance on an automated credit-limit application control?

A. A marketing approval policy

B. Control over unauthorised changes to system configuration

C. A manual cash count

D. A staff satisfaction survey

Correct Answer: B. Control over unauthorised changes to system configuration

Question 3

What is a principal risk of using shared credentials for RPA bots?

A. Improved individual accountability

B. Inability to determine which user or process performed an action

C. Guaranteed prevention of unauthorised access

D. Automatic validation of bot outputs

Correct Answer: B. Inability to determine which user or process performed an action

Question 4

What does blockchain immutability primarily indicate?

A. Every recorded transaction is economically valid

B. Recorded data cannot have been entered fraudulently

C. Alteration of recorded data is difficult or detectable within the protocol

D. Valuation assumptions are automatically correct

Correct Answer: C. Alteration of recorded data is difficult or detectable within the protocol

Question 5

Which statement correctly distinguishes continuous auditing from continuous monitoring?

A. Continuous auditing is management’s activity, while monitoring is independent assurance.

B. Continuous auditing is independent assurance; continuous monitoring is generally management’s activity.

C. They are identical terms with no practical distinction.

D. Neither activity can use automated procedures.

Correct Answer: B. Continuous auditing is independent assurance; continuous monitoring is generally management’s activity.

Question 6

Why should an auditor validate the completeness of an analytics population?

A. To ensure that conclusions are not based on omitted relevant records

B. To guarantee that every transaction is fraudulent

C. To eliminate the need for professional judgement

D. To prove that the client’s controls are effective

Correct Answer: A. To ensure that conclusions are not based on omitted relevant records

Question 7

Which issue is most closely associated with explainability in AI-assisted auditing?

A. Whether the model’s output can be understood and justified

B. Whether the office has sufficient paper storage

C. Whether all transactions are processed manually

D. Whether the audit period contains twelve months

Correct Answer: A. Whether the model’s output can be understood and justified

Question 8

What is model risk?

A. The risk that a model produces an incorrect or misleading result because of design, data, implementation or use

B. The risk that a financial statement has no estimates

C. The risk that a cloud provider offers too much storage

D. The risk that an auditor uses sampling rather than a census

Correct Answer: A. The risk that a model produces an incorrect or misleading result because of design, data, implementation or use

Question 9

Which practice best protects confidential audit data when using AI tools?

A. Uploading identifiable data to any publicly available chatbot

B. Using approved environments with access controls and data minimisation

C. Removing all audit documentation after obtaining an output

D. Allowing the tool provider to reuse data without review

Correct Answer: B. Using approved environments with access controls and data minimisation

Question 10

Why are screenshots alone often weak digital audit evidence?

A. They can never contain financial information

B. They may not establish who generated them, when they were generated or whether they are complete

C. They are always digitally signed by the auditor

D. They automatically prove that a control operated throughout the period

Correct Answer: B. They may not establish who generated them, when they were generated or whether they are complete