The impact of information technology on audit, and audit tools

A company that runs on cloud software, mobile wallets and automated rules cannot be audited with a clipboard. The records the auditor needs are electronic, the controls are code, and some of the evidence sits on a public blockchain. At the same time, the auditor has new tools: software that reads every transaction, bots that collect prices from many sources and cloud platforms that let a team work from anywhere.

This topic covers the technologies that are changing audit, how information technology is used at each stage of an audit, and the tools an auditor can pick.

November 2025 Question 6 combined it all in one case, a digital payment and crypto-asset platform, and asked how the auditor would apply information technology (IT) in the audit and in an assurance report on proof of reserves, for 10 marks, and how blockchain affects audit, for 5 marks. The structure below answers both.

CAMA 2020 and computerised systems

CAMA 2020 does not need a separate section for technology, because the duties in Chapter 15 (Audit) apply to however the records are kept. The links are these. Note: this is an application of the sections, not a quotation. The wording of the sections is in the earlier topic on communication with those charged with governance.

The practical message for a scenario is that a company cannot avoid the audit of a system by calling it proprietary. The auditor’s right of access under s. 407(3) exists whatever the technology, and management’s duties under s. 405 cover the controls inside it.

Technologies that affect audit

Cloud computing

Some accounting software hosted in the cloud has an audit module for auditing and verifying transactions. An audit firm that subscribes to cloud-based audit software does not need physical servers and the costs of maintaining them. The auditor can work remotely from any device with an internet connection, serve clients from any location and at any time, and collaborate with colleagues and clients.

Big data analytics

Data is now crucial for business decisions, and includes unstructured data that automated tools can analyse. Data analytics software allows real-time monitoring of transactions and alerts the auditor to exceptions needing further work. Since everything leaves a digital footprint, there are new insights to be found. Audit firms can use analytics to offer more valuable advisory services.

The syllabus lists popular tools: MS Excel, ActiveData, Audit Command Language (ACL), Integrated Data Extraction and Analysis (IDEA) and TeamMate.

Artificial intelligence and robotics

Audit firms used to spend much effort on collecting and analysing data. Artificial intelligence and robotics make it easier to simplify and speed up these tasks. Robotic process automation software handles routine, repetitive parts of the auditor’s job, so auditors can spend more time giving insight on the client’s historical data. Machines can cut costs and errors.

Optical character recognition converts text to digital files using scanners and phone cameras, which speeds up manual entry.

Blockchain

Blockchain became popular through digital currency such as Bitcoin. Businesses use it to record financial and non-financial transactions in an open, secure and decentralised ledger. If the auditors are part of the transaction flow and have access to the data chain, they can see each transaction as it occurs and advise in real time. Blockchain supports smart contracts, protects and transfers ownership of assets and verifies identities and credentials.

Once it is widely adopted and regulatory challenges are overcome, it should cut costs, improve traceability and strengthen security. There is a fear that auditors may become unnecessary, because transactions are recorded in an open and distributed ledger where every party must consent for a record to be complete.

Social media

Social media platforms are useful for sharing information and for collaboration among practising firms and professional bodies. Firms use them to become more visible and attractive to clients. Some professions will disappear, some will grow and new ones will appear, so these systems will influence auditing.

IT in the audit process

The syllabus and the Pathfinder solution both set out the same five stages.

The syllabus’s list of repetitive audit tasks that technology can take over is:

• data preparation and entry
• integrating data from several files
• importing audit-relevant data into spreadsheets
• copying, pasting and sorting
• basic tests such as recomputation and analytical procedures
• inventory counts

Technology tools for the auditor

Gantt chart software

A Gantt chart is a project planning tool. It is a bar chart with a schedule of tasks and timelines. The vertical axis shows the activities to be completed and the horizontal axis shows time. Auditors use it to plan the engagement as a project. At a glance they can see:

1. the start date of the engagement;
2. the audit activities;
3. the team members and their tasks;
4. the start and finish date of each activity;
5. the links between activities;
6. engagement dependencies;
7. the end date of the engagement; and
8. the critical path.

With the software the auditor can create a work breakdown structure, assign activities to team members, track progress and change the plan in real time. The bars fill in automatically when activities, dates and dependencies are entered.

Risk analysis tools

Risk is present in every audit engagement and International Standard on Auditing (ISA) 315 explains business and audit risk. The risks, positive and negative, that auditors face must be anticipated, identified, evaluated, prioritised and addressed. Risk can be assessed qualitatively or quantitatively. Popular risk management tools include governance, risk and compliance (GRC) Cloud Resolver, SpiraPlan, Enablon, Checkit, Analytica, Risk Management Studio and A1 Tracker.

The most advanced audit software, such as ACL and CaseWare IDEA, has built-in risk management features, so an auditor who buys a top package might not need a separate tool.

The features of a good tool, which also serve as the criteria for choosing one, are:

• a web-based application with a good user interface;
• scalability and ease of integration with other solutions;
• a risk dashboard, a quick snapshot of risk issues in one view;
• built-in support for risk mitigation;
• a risk audit trail;
• support for electronic signatures;
• reports in Word, Excel, PDF, XML and HTML formats;
• printing and emailing of reports to stakeholders;
• import and export functions;
• automatic alerts on risk updates;
• support for both qualitative and quantitative assessment; and
• data entry by paper, browser and mobile app.

Applying IT to a crypto-asset platform

The November 2025 case was a payment and crypto-asset platform with custody of customer assets. The Pathfinder solution added points specific to this kind of client, which this topic restates in plain terms:

• Data analytics on revenue. Specialised software analyses the whole population of payment transactions behind the reported revenue, which had grown by 65%.
• Automated price feeds. Bots or scripts pull prices from several exchanges to judge the range of fair value of crypto holdings, where prices differ and some tokens trade rarely.
• System review. Test access controls over the mobile wallet and the encryption and security over customer data.
• Testing the logic. Test the programming logic of the stablecoin and the lending collateral mechanism, to make sure transactions are recorded accurately and completely under the programmed rules.
• Cryptographic verification. Use cryptographic tools to confirm the existence of customer assets in custody on the public blockchain.
• Private key attestation. Verify that the company controls the private keys needed to access and move the wallet balances.

How blockchain changes audit and assurance

The Pathfinder solution to Question 6(b) gives ten points, and any five earn the marks:

1. Blockchain changes how transactions are recorded, authenticated and secured.
2. If auditors have access to the data chain, they can see transactions as they occur and advise in real time.
3. It enables smart contracts, protecting and transferring ownership of assets and verifying identities.
4. When widely adopted, it should reduce costs, improve traceability and strengthen security.
5. There is a fear that auditors will no longer be useful, because every party’s consent is needed for a record.
6. A distributed ledger that cannot be changed by one party reduces risks to the completeness and accuracy of transactions.
7. The auditor’s focus moves from testing the historical record to verifying smart contracts and the integrity of the first data entry.
8. There is demand for new assurance services, such as auditing smart contract code and assurance over control of digital assets, as in proof of reserves.
9. A real-time ledger supports continuous auditing instead of year-end sampling.
10. The chain gives a full, verifiable record of who has owned an asset, which helps tracing.

The rules in more depth

Why CAATs are the only way to test IT controls

An automated control, such as a system that blocks payments above a limit, leaves no paper to inspect. The auditor has to run the control or test its code. Re-performing it with test data, or reading the configuration with software, are the usual ways.

Whole populations instead of samples

Software can test every transaction, for instance every journal posted after hours or every payment above the approval limit. This reduces the sampling risk but not the need for judgement, because the exceptions still have to be investigated.

New risks that come with the tools

Technology adds risks as well as speed. Cloud audit software puts working papers on another party’s servers, so confidentiality and the Nigeria Data Protection Regulation matter, which a later topic covers. A bot that pulls prices is only as good as its sources. Blockchain does not prove that the data at the point of entry was right.

Worked example: proof of reserves

Scenario. A platform reports customer crypto assets in custody of ₦600 billion and holds its own crypto assets of ₦120 billion. The auditor extracts the wallet addresses, confirms the balances on the public blockchain, and checks control of the private keys. The verified wallet balances total ₦585 billion for customers and ₦119 billion for the company. Prices from five exchanges value the company’s holding between ₦115 billion and ₦125 billion. Materiality is ₦3 billion.

Step 1: reserves against liabilities. Customer assets owed are ₦600 billion and verified wallets hold ₦585 billion. The shortfall is ₦600 billion − ₦585 billion = ₦15 billion, which is 2.5% of the liability and five times materiality. The auditor asks whether other wallets exist, whether assets are held off chain and whether timing explains it. If not explained, the assurance report cannot give an unmodified conclusion.

Step 2: valuation range. The company’s holding is recorded at ₦120 billion. The range of ₦115 billion to ₦125 billion is ₦5 billion either side, which is 4.2%. That is above materiality, so the auditor assesses which exchange prices represent the principal market and challenges management’s choice, and checks low-volume tokens separately.

Step 3: other tests. The auditor tests the revenue population with analytics, tests the logic of the lending collateral rules and checks access controls over the wallet. Each is done with software, and the findings are reported to the audit committee.

Step 4: the reports. The audit opinion considers the valuation and the custody disclosures. The separate proof of reserves report is an assurance engagement under International Standard on Assurance Engagements (ISAE) 3000, with the criteria agreed in advance.

How to score full marks

• Work through the five stages. Planning, risk assessment, controls, substantive testing and reporting, with a use of IT in each.
• Tie each point to the case. Name the revenue, the crypto holdings, the wallet or the stablecoin.
• Explain, do not just list. The marking guide gave half a mark for naming a point and one and a half for explaining it.
• For blockchain, give impacts on audit, not features. Say what changes for the auditor.
• Add the CAMA 2020 link where the scenario involves controls or access. Sections 404(7)(d), 405 and 407(3).

Common mistakes in the exam

• Describing what a technology is without saying how the auditor uses it.
• Saying that blockchain makes the audit unnecessary.
• Saying that CAATs replace judgement.
• Forgetting that IT controls can be tested only with software.
• Ignoring the risks of the tools, such as data protection.
• Listing tools by name with no use for each.

Quick revision

• Five technologies: cloud, big data analytics, artificial intelligence (AI) and robotics, blockchain, social media.
• Five stages: planning, risk assessment, controls (CAATs), substantive testing, reporting.
• Tools: Gantt charts for planning, risk analysis tools with twelve features.
• Blockchain: real-time view, completeness and accuracy, smart contracts, new assurance, continuous auditing, provenance.
• CAMA 2020: s. 404(7)(d) control review, s. 405 CEO and CFO certification, s. 407(3) right of access, s. 406 improper influence.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.