Technology, Information Systems and AI in Audit

Introduction and context

Auditing has moved from inspecting paper vouchers to evaluating technology-enabled systems that initiate, process, store and communicate financial information. Enterprise-resource-planning systems, application programming interfaces, cloud platforms, robotic process automation, electronic records and artificial intelligence now influence nearly every audit assertion. Technology may improve accuracy and audit coverage, but it also creates risks involving unauthorized access, defective programming, cyberattack, incomplete data, opaque algorithms and excessive reliance on automated outputs.

The auditor’s fundamental objective remains unchanged: to obtain sufficient appropriate audit evidence and express a conclusion based on professional judgment. Technology changes the evidence available, the controls that must be understood and the procedures used to obtain assurance. An auditor therefore needs both traditional auditing knowledge and a working understanding of information systems, data governance and responsible AI.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain how information systems affect financial reporting and audit risk.
2. Distinguish IT general controls from application controls.
3. Evaluate automated processes, cloud arrangements, cybersecurity and digital records.
4. Apply computer-assisted audit techniques (CAATs) appropriately.
5. Assess the use of AI in audit, including explainability, privacy, bias and overreliance.
6. Design proportionate responses to technology-related control deficiencies.

1. Information systems and the audit environment

An information system is an organized combination of people, procedures, data, software, hardware and communication networks used to collect, process, store and distribute information. In a modern business, the system may include an ERP platform, payroll application, banking interface, warehouse scanners, mobile devices, cloud databases and reporting tools.

The audit significance of an information system depends on how it affects the financial statements. Important questions include:

• Where is transaction data created and authorized?
• Which calculations are performed automatically?
• Can users change master data, such as supplier bank details or prices?
• What interfaces transfer data between applications?
• How are exceptions identified and resolved?
• Who can access, alter or delete records?
• How long are records retained, and can they be reproduced?

Technology affects the audit in two related ways. First, it may create inherent and control risks. For example, a single erroneous pricing rule can affect thousands of transactions. Secondly, technology can provide powerful audit evidence: complete-population testing, system logs, exception reports and analytical procedures.

The auditor should not assume that automated processing is reliable merely because it is consistent. A system can repeatedly produce an incorrect result. Reliability depends on authorized program changes, accurate input, appropriate configuration, secure access and effective monitoring.

2. Internal control in technology-enabled systems

A useful control model distinguishes preventive, detective and corrective controls.

Controls may also be manual, automated or IT-dependent manual. An IT-dependent manual control uses system-generated information but requires human review—for example, a finance manager reviewing an automated aged-receivables report. The auditor must test both the system’s production of the report and the reviewer’s evidence of investigation.

IT general controls

IT general controls (ITGCs) support the reliable operation of applications and technology infrastructure. Common categories are:

1. Logical access: user identification, authentication, authorization, privileged access and periodic access reviews.
2. Change management: authorization, testing, segregation of duties and controlled migration of changes into production.
3. IT operations: job scheduling, incident management, monitoring, backup and recovery.
4. System development and acquisition: requirements, testing, implementation approval and post-implementation review.
5. Physical and environmental security: protection of servers, network equipment and facilities.

A deficiency in an ITGC may have a broad effect. If developers can directly alter production code, or former employees retain administrator privileges, reliance on several applications may be inappropriate. The auditor then needs more substantive procedures or alternative controls.

Application controls

Application controls operate within a particular system or transaction cycle. Examples include:

• Input controls: format checks, validity checks, completeness checks, authorization and duplicate detection.
• Processing controls: programmed calculations, sequence checks, automated matching and tolerance limits.
• Output controls: report distribution, exception review and reconciliation to independent records.
• Master-data controls: approval of customer, supplier, employee and pricing records.
• Interface controls: reconciliations between systems and investigation of rejected or incomplete transactions.

Consider an automated three-way match. The purchasing system compares a purchase order, goods-received record and supplier invoice. If the match is correctly configured and protected by effective ITGCs, it can reduce the risk of unauthorized or inaccurate purchases. The auditor must nevertheless determine whether tolerances are reasonable, all relevant transactions pass through the control and overrides are logged and reviewed.

3. Auditing automated processes

An automated control is generally tested by understanding its design, identifying the relevant program or configuration, evaluating change controls and testing operation. Depending on risk, procedures may include inspection of configuration, reperformance using test data, review of system logs, observation of processing and comparison of programmed logic with documented requirements.

A key distinction is between testing the control and testing the data produced by the system. If an auditor relies on an exception report, the auditor should establish that:

• the report is complete and accurate;
• the report uses the correct period and population;
• relevant fields and filters are included;
• the report logic has not been changed without authorization; and
• management’s follow-up is timely and documented.

An automated control may be stable over time, but this cannot simply be presumed. The auditor should consider whether the application, database, configuration, interfaces or relevant access rights changed during the period.

4. Cloud computing and outsourced services

Cloud computing provides on-demand access to shared computing resources. Service models commonly include software as a service (SaaS), platform as a service (PaaS) and infrastructure as a service (IaaS). Responsibility for controls is shared between the service provider and the customer.

For example, a SaaS provider may operate the application, database and physical infrastructure, while the customer remains responsible for user access, transaction approval, master data and configuration. The auditor must identify this boundary rather than treating the provider as responsible for everything.

Relevant audit procedures include:

• understanding the contract, service commitments and data location;
• assessing independent controls assurance reports, such as a suitable service-organization report;
• evaluating complementary user-entity controls;
• reviewing availability, backup, incident and change-management arrangements;
• considering subcontractors and fourth-party dependencies; and
• assessing data portability, retention and secure deletion.

A service auditor’s report may provide evidence about provider controls, but it does not automatically prove that the customer’s data were processed correctly. The period covered, exceptions identified and complementary controls must be evaluated.

5. Cybersecurity and digital records

Cybersecurity concerns the confidentiality, integrity and availability of information and systems. Financial reporting risks may arise from ransomware, phishing, credential theft, malicious insiders, denial-of-service attacks and unauthorized data alteration.

The auditor is not normally engaged to provide a general cybersecurity certification. However, a cyber incident may affect valuation, provisions, revenue recognition, going concern, disclosure and the reliability of audit evidence. The auditor should understand the entity’s risk assessment, incident-response process, access controls, monitoring and recovery arrangements.

Digital records present evidential issues. Useful evidence may include database records, immutable logs, email metadata, electronic approvals, blockchain records and system-generated reports. Their evidential value depends on authenticity, completeness, integrity, relevance and accessibility. A digital record is not reliable merely because it is electronic.

Important safeguards include synchronized timestamps, retention policies, write-protected or immutable storage, documented chain of custody, access logs and independent reconciliation. When evidence is extracted from a live system, the auditor should document the extraction method, filters, population and any transformations.

6. Computer-assisted audit techniques

CAATs are methods that use computers to examine data or evaluate controls. They include generalized audit software, audit scripts, spreadsheet analysis, test data, integrated test facilities, parallel simulation and process mining.

Typical applications include:

• recalculating depreciation or interest;
• identifying duplicate payments;
• testing gaps in invoice sequences;
• stratifying receivables by age and value;
• matching payroll and employee-master data;
• searching journal entries posted at unusual times;
• comparing system logs with approved user lists; and
• testing every transaction against a defined rule.

A disciplined CAAT begins with a clearly defined population and objective. The auditor should preserve the original data, document extraction, validate fields, perform completeness checks and retain reproducible scripts. Results require interpretation: an exception is an item requiring investigation, not proof of misstatement or fraud.

For example, suppose an auditor tests 120,000 payments for exact duplicate invoice number, supplier and amount. The procedure identifies 18 matches. The auditor must determine whether they are genuine duplicates, legitimate recurring invoices, credit-note relationships or data-entry artifacts. The CAAT identifies risk; professional judgment determines the response.

Data-quality considerations

Data analytics can fail when records are incomplete, duplicated, inconsistently coded or extracted from the wrong period. The auditor should reconcile the extracted population to an independent control total where possible. If the ledger contains 2,450 sales transactions but the extracted file contains 2,390, the analysis cannot support a conclusion about the complete population until the difference is explained.

7. Artificial intelligence in audit

AI refers broadly to computational systems that perform tasks associated with human intelligence, such as classification, prediction, language processing and pattern recognition. In auditing, AI may assist with document extraction, contract review, anomaly detection, risk assessment, journal-entry analysis and drafting.

AI systems differ in important ways. Rule-based systems apply explicit instructions. Machine-learning systems infer patterns from data. Generative AI produces text, code or other content from prompts and learned statistical relationships. These categories create different risks and require different validation procedures.

A responsible audit use case should specify:

1. the audit objective and assertion;
2. the data used and its permitted purpose;
3. the model’s role and decision boundaries;
4. validation and performance criteria;
5. human review and escalation requirements; and
6. documentation sufficient for an experienced auditor to understand the work.

Explainability and reproducibility

Explainability means that the auditor can understand, to a reasonable degree, why a system produced an output. A complex model may be useful for ranking unusual transactions, but its output should not be treated as self-authenticating evidence. The auditor should document inputs, model version, prompt or parameters, output, date, reviewer and follow-up.

Reproducibility can be difficult when a hosted model changes over time. Organizations should control approved tools, retain relevant outputs and prohibit confidential client information from being entered into unapproved public services.

Privacy and confidentiality

Audit data often contain personal, payroll, health, banking and commercially sensitive information. Before using AI, the auditor should consider purpose limitation, data minimization, access restrictions, encryption, retention, cross-border transfer and contractual terms. Where possible, use masked, pseudonymized or synthetic data for development and testing. Confidentiality obligations continue after the audit engagement ends.

Bias and fairness

A model may reproduce historical bias or create disparate error rates across groups, locations or transaction types. Bias may arise from unrepresentative training data, proxy variables, missing data or labels based on past human decisions. Validation should consider relevant subgroups and false-positive and false-negative consequences. A model that flags small entities disproportionately may divert audit attention without improving risk detection.

Automation bias and professional skepticism

Automation bias is the tendency to accept a system’s recommendation because it appears objective or sophisticated. Conversely, an auditor may reject a reasonable system output without analysis. Neither response is acceptable. AI is generally an aid to professional judgment, not a substitute for it. High-impact conclusions require human review, corroborating evidence and a documented challenge process.

8. A technology-risk assessment framework

A practical assessment can follow six steps:

1. Map the system: identify applications, interfaces, data stores, users, providers and important reports.
2. Link technology to assertions: determine which systems affect existence, completeness, accuracy, valuation, rights and obligations, or presentation.
3. Identify risks: consider access, changes, processing logic, interfaces, cyber events, availability and data quality.
4. Evaluate controls: assess design, implementation and operating effectiveness of ITGCs and application controls.
5. Plan procedures: choose control testing, substantive analytics, inspection, reperformance or alternative evidence.
6. Conclude and communicate: evaluate deficiencies, revise the audit approach and communicate significant matters to those charged with governance.

The framework is risk-based. A low-risk spreadsheet used for an immaterial analysis does not require the same work as a cloud ERP that records all revenue and receivables.

Illustrative case: Northstar Retail’s automated revenue system

Background

Northstar Retail Ltd sells through stores, a website and third-party marketplaces. Revenue is recorded by an ERP system that receives daily sales files from point-of-sale terminals and external platforms. A machine-learning tool identifies unusual refunds for management review.

Problem

During the audit, the team learns that a former employee’s account remained active for two months. The team also finds that marketplace files are sometimes reprocessed after transmission failures. The refund model flags transactions but does not explain its scores.

Analysis

The inactive-account issue indicates a possible access-control deficiency. Reprocessing may create duplicate or omitted sales unless interface controls detect duplicates and reconcile totals. The refund tool may be useful for risk identification, but its unexplained output cannot by itself establish that refunds are improper.

The team obtains a population reconciliation between marketplace reports and ERP postings, tests duplicate transaction identifiers, reviews interface-error logs and inspects user-access reviews. It tests the configuration of refund thresholds and selects both flagged and unflagged refunds for substantive examination. The team documents the model version, input fields and management’s investigation of exceptions.

Approach and outcome

The reconciliation identifies a small number of transmission failures, all corrected before period end. Two unauthorized refunds are found, but the amount is not material. Because access termination was not timely and interface monitoring was incomplete, the auditor reports control deficiencies and expands substantive testing of marketplace revenue. The auditor does not rely on the AI score as audit evidence without corroboration.

Learning points

Technology risk is interconnected: access weaknesses can enable data manipulation; interface failures can affect completeness; and AI outputs require validation and human interpretation. A well-designed audit combines control evaluation, complete-population analysis and targeted substantive procedures.

Challenges, governance and professional implications

Technology changes rapidly, while audit evidence must remain understandable and defensible. Organizations should establish governance over data, models, vendors and system changes. Responsibilities should be assigned to management, information-security personnel, internal audit, external auditors and the board.

Good practice includes an inventory of critical systems; role-based access; multifactor authentication; segregation of development and production; tested backups; incident exercises; documented data lineage; model inventories; approval of AI use cases; bias and performance testing; retention of prompts and outputs; and periodic independent review.

Auditors should maintain competence in data analysis, systems controls and emerging technology. They should also recognize the limits of their competence and obtain specialist assistance when necessary. Efficient technology use does not reduce the need for skepticism, ethical conduct and accountability.

Chapter Summary

Technology affects how transactions are initiated, processed, stored and audited. IT general controls over access, changes, operations and development support the reliability of applications, while application controls address input, processing, output, master data and interfaces. Cloud services create shared responsibilities, and cybersecurity incidents may affect both financial statements and audit evidence. Digital records require attention to authenticity, completeness and integrity.

CAATs can provide broad and efficient testing, but auditors must validate populations, document procedures and investigate rather than automatically interpret exceptions. AI can support extraction, anomaly detection and risk assessment, yet explainability, privacy, bias, reproducibility and automation bias require strong governance. Responsible use places AI within a controlled process of human judgment, corroboration and professional skepticism.

Key Terms

Information system: People, procedures, technology and data used to produce information.

IT general control: A control supporting the reliable operation of systems and technology infrastructure.

Application control: A control embedded in a particular application or transaction process.

Logical access: Controls governing identification, authentication and authorization.

Change management: Procedures for authorizing, testing and implementing system changes.

Interface control: A control ensuring complete and accurate transfer between systems.

Master data: Relatively permanent data, such as supplier, customer or pricing records.

Cloud computing: On-demand access to shared computing resources over a network.

Complementary user-entity control: A control that the customer must operate for a provider control to function effectively.

Cybersecurity: Protection of information and systems’ confidentiality, integrity and availability.

Digital record: An electronic record maintained and processed by an information system.

CAAT: A computer-assisted audit technique used to examine data or controls.

Data lineage: The documented movement and transformation of data through systems.

Artificial intelligence: Computational capability associated with tasks such as prediction, classification or language processing.

Explainability: The ability to understand the basis of a model’s output.

Automation bias: Undue reliance on an automated recommendation.

Model drift: Change in model performance as data or circumstances change.

Pseudonymization: Replacing identifying information with coded references while retaining controlled re-identification capability.

Professional skepticism: A questioning mind and critical assessment of audit evidence.

Review Questions

Short Answer Questions

1. What is the difference between an IT general control and an application control?
2. Why must an auditor validate the completeness of data extracted for a CAAT?
3. What are complementary user-entity controls in a cloud arrangement?
4. Identify two risks associated with generative AI in audit.
5. Why is a digital record not automatically reliable evidence?

Long Answer Questions

1. Explain how access management, change management and IT operations controls affect reliance on financial applications.
2. Discuss the auditor’s responsibilities when evaluating a cloud service provider’s controls.
3. Explain how an auditor could test an automated three-way-match control.
4. Evaluate the benefits and limitations of AI-based anomaly detection in audit.
5. Describe a risk-based framework for auditing a technology-enabled revenue process.

Analytical / Application Questions

1. A company’s payroll application allows one administrator to create employees, approve payroll and change bank details. Analyze the risks and recommend controls.
2. An audit analytics file contains 98,000 sales records, while the system control total shows 100,000. Explain how the auditor should respond before relying on the analysis.
3. An AI tool flags refund transactions using an unexplained score. Design an appropriate audit response that addresses explainability, corroboration, privacy and overreliance.

Multiple Choice Questions with Answers

Question 1

Which control is an IT general control?

A. A duplicate-invoice check in the accounts-payable application

B. A review of administrator access rights

C. A three-way match of invoice, order and receipt

D. A validation that an invoice amount is numeric

Correct Answer: B. A review of administrator access rights

Question 2

What is the primary purpose of an interface control?

A. To ensure data transferred between systems are complete and accurate

B. To approve employee vacations

C. To encrypt every customer email

D. To calculate depreciation

Correct Answer: A. To ensure data transferred between systems are complete and accurate

Question 3

Which statement best describes automation bias?

A. Refusing to use any automated procedure

B. Changing a model’s source code without approval

C. Accepting an automated recommendation without adequate challenge

D. Encrypting data before analysis

Correct Answer: C. Accepting an automated recommendation without adequate challenge

Question 4

Which factor is most important when evaluating a cloud service provider’s assurance report?

A. The provider’s advertising materials

B. The report’s period, exceptions and complementary user controls

C. The number of provider employees

D. The color of the report cover

Correct Answer: B. The report’s period, exceptions and complementary user controls

Question 5

A CAAT identifies duplicate payments. What should the auditor do next?

A. Treat every match as fraud

B. Delete the matches from the population

C. Investigate whether matches are genuine duplicates or legitimate transactions

D. Conclude that all payments are misstated

Correct Answer: C. Investigate whether matches are genuine duplicates or legitimate transactions

Question 6

Which practice best supports reproducibility of an AI-assisted audit procedure?

A. Using an unapproved public tool without retaining outputs

B. Documenting the model version, inputs, parameters and results

C. Allowing the model to change its own objective

D. Relying only on a verbal description of the output

Correct Answer: B. Documenting the model version, inputs, parameters and results

Question 7

Why can a programming error create extensive audit risk?

A. It may consistently process a large population incorrectly

B. It affects only transactions selected for testing

C. It automatically improves segregation of duties

D. It prevents all system access

Correct Answer: A. It may consistently process a large population incorrectly

Question 8

Which measure most directly protects the confidentiality of audit data used with AI?

A. Data minimization and approved access controls

B. Increasing the number of model outputs

C. Removing all human review

D. Ignoring retention requirements

Correct Answer: A. Data minimization and approved access controls

Question 9

What does a reconciliation between extracted records and a system control total primarily address?

A. Completeness of the extracted population

B. The popularity of the accounting software

C. The visual design of a report

D. The age of the auditor

Correct Answer: A. Completeness of the extracted population

Question 10

Why should an unexplained AI score not be treated as sufficient audit evidence by itself?

A. All AI tools are prohibited in auditing

B. The score may identify risk but does not independently establish the underlying fact

C. AI cannot process numerical information

D. An auditor may never use analytical procedures

Correct Answer: B. The score may identify risk but does not independently establish the underlying fact