Data analytics, artificial intelligence and other audit technology

A supermarket chain records 40 million sales lines a year. A sample of 60 cannot show whether someone has been cutting sales just below an approval limit. A program that reads every line can, in minutes. Another firm pays its suppliers through a blockchain. A third runs a robot that matches invoices to orders all night. The audit must now work with systems like these.

Technology does not remove the auditor's judgement, but it changes what evidence is available and how it is gathered.

This topic covers the technologies that affect auditing, the use of data analytics and audit software on whole populations, statistical analysis to find outliers, why and how the auditor interrogates the client's accounting and enterprise resource planning (ERP) systems, artificial intelligence (AI), robotic process automation (RPA) and blockchain in the audit. The previous topics covered IS audits, and the next topic starts forensic accounting.

Key terms in plain English

Syllabus check

This topic is in syllabus area F, technology in audit, assurance and forensics (5% of marks). It covers:

• the application of technology in audit, assurance and forensics
• big data analytics and audit of electronic transactions
• artificial intelligence, robotics and blockchain

CAMA 2020 and audit technology

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

How technology affects the audit

Technologies likely to affect the auditing process include cloud-based accounting systems, big data and analytics, social media, blockchain and artificial intelligence and robotics. Some professions will disappear, some will grow and new ones will appear. The effect on each stage of the audit is:

Big data analytics and the audit of electronic transactions

Big data is large volumes of data gathered from many sources, including social networks, videos, digital images, sensors and sales transaction records. Big data analytics analyses it to find patterns and connections that might otherwise be invisible, giving insight that can help firms make better decisions. For auditors, analytics offers these advantages:

• testing transactions at source, in the system where they are created;
• testing the complete data set, a 100% check;
• predictive analytics, to help in risk assessment;
• evaluating programmed controls; and
• avoiding analysis paralysis, by focusing on the exceptions that matter.

Analytics changes the traditional sample-based approach into a data-driven one, in which the whole population is tested with automated algorithms instead of a sample, which improves audit quality.

Typical tests are:

• finding duplicate invoices or payments
• sequence gaps in documents
• transactions at weekends, holidays or odd hours
• entries just below approval limits
• round-sum entries
• journal entries posted by unusual users or to unusual accounts
• payments to suppliers with the same bank account as an employee
• receivables ageing and credit limit breaches
• comparison of price and quantity to master data

The auditor still has to decide what each exception means, investigate it and document the follow-up. Data must also be tested for completeness and accuracy before it is used: the totals extracted should agree to the ledger and trial balance.

Statistical analysis to find outliers in sales records

When the auditors suspect manipulation of sales figures, as in the Channel Retail case, statistical analysis helps to find the unusual transactions:

• Descriptive statistics. Calculate the mean, median and standard deviation of sales per store, per day and per product. Records that lie many standard deviations from the mean, say more than three, are outliers. A z-score is (value minus mean) divided by the standard deviation.
• Distribution analysis. Plot the frequency of sale values. Sudden spikes at a value just below an approval limit, or many identical amounts, suggest manipulation.
• Benford's law. In many naturally occurring sets of numbers, the first digit is 1 about 30% of the time, 2 about 18%, and so on down to 9 at under 5%. Large departures from the expected pattern suggest invented or manipulated figures.
• Trend and ratio analysis. Compare sales by month and store to prior years and to budget. Compare sales with stock movements, cash banked and payment-method splits. A store with sales growth far above the others or a margin that does not fit may be manipulated.
• Correlation and regression. Test the relationship between sales and drivers such as footfall, floor area, the number of transactions and staffing. Large residuals show unexplained sales.
• Stratification. Group the transactions by size, time, cashier or till and look at each group. Voided sales, refunds and manual overrides by a particular cashier may stand out.

The outliers are not proof of error. They are a list of items to examine, by agreeing them to documents, tills, bank deposits and cash.

Why the auditor interrogates the client's accounting software

• The processing is invisible. Computer processing is electronic, so the auditor has to get inside the system to check the completeness and accuracy of the processing.
• The audit trail may not exist on paper. Evidence may exist only in files and logs.
• Whole populations can be tested. With software, every transaction can be examined, which is more reliable than a sample.
• Programmed controls can only be tested by looking at the system, for example automatic credit limit checks and three-way matching.
• Efficiency and accuracy. Large volumes can be analysed faster and with fewer errors than by hand.
• Fraud detection. Manipulated entries, unusual journals and duplicates can be found.
• Reliability of information produced by the entity. The auditor must test the reports that the system produces before using them as evidence.

Audit procedures for interrogating an ERP system

An ERP system joins sales, purchases, inventory, payroll and finance in one database. The auditor must understand its configuration and then test it. Procedures include:

1. Understand the modules in use, how they are linked, the data flows and the interfaces to other systems, and obtain the system documentation.
2. Review the configuration of key controls, such as approval limits, credit limit blocks, three-way match tolerances and automatic postings.
3. Review user access and segregation of duties: who can create masters, post journals, approve payments. Look for conflicts, shared accounts and leavers' access.
4. Review change management: how changes to the system and to the configuration are authorised, tested and moved into live use.
5. Obtain data extracts or run queries under the auditor's control, and reconcile the extracted data to the ledger and trial balance for completeness.
6. Run analytics for the audit tests, such as duplicates, gaps, journals and ageing.
7. Test the output reports used as evidence by recalculating and tracing a sample to source documents.
8. Where there is no specialist skill in the audit team, use an IT specialist.

Artificial intelligence, machine learning and robotic process automation

Robots and artificial intelligence are already helping to do tasks that humans do. The expected benefits of robotic process automation (RPA) and AI are:

• significant cost reduction
• shorter time for tasks
• better quality by removing human error
• scalability, unlike human teams
• integration with existing accounting ERP systems
• local competence and control

AI will probably reduce the demand for repetitive accounting roles and increase advisory roles.

It will improve audit quality by letting auditors ask many more questions, and efficiency by giving insight. Software may in future interview client personnel and collect more information for analysis.

Effect on the audit approach. If the client uses software robots in key processes, the auditor needs comfort over the reliability of the processing the robot does, and so must understand the technology well enough to assess the robot software: what rules it applies, who maintains it, what controls exist over changes and exceptions, and how its output is checked.

For AI used by the auditor, the firm must consider data confidentiality, bias and errors, the explainability of results, and the need for human review. AI tools should support and not replace professional judgement and scepticism, and results should be checked before use as evidence.

In Channel Retail, the auditors considering AI and RPA could use them for matching documents, extracting data from invoices and contracts, scanning journals for unusual patterns and drafting routine working papers. The risks are poor data, over-reliance on the tool and ethical issues in handling client data.

Blockchain

A blockchain is a shared ledger in which transactions are recorded in linked blocks that, once confirmed by the network, are very hard to change.

Where a company records supplier payments on a blockchain, the audit involves:

• understanding the type of chain (public or permissioned) and who runs the nodes
• testing the controls over who can initiate and approve transactions and who holds the keys
• checking that the entries on the chain agree to the company's own ledger and to bank records
• confirming balances and transactions directly from the chain, which may give strong external evidence
• testing smart contracts, which run automatically, to see that the code does what the agreement says
• assessing risks of lost keys, fraud at the point of entry and legal uncertainty

Records on the chain are tamper-resistant, but they are only as good as the data put in, so controls at the point of entry still matter.

Cloud, social media and other technology

Cloud-based systems move the accounting records to a provider, so the auditor asks for independent assurance reports on the provider's controls, checks access and back-up arrangements and considers where the data is held and under which law. Social media can give evidence about a client's reputation, products and complaints, and can be a source of risk, such as false statements by staff.

Drones and sensors may be used to inspect inventory in large yards or tanks, where counting is hard. In each case, the auditor must be sure that the evidence is sufficient and appropriate and must document the procedures.

Worked examples

1. The clustering just below the approval limit suggests splitting of orders to avoid approval.
2. The auditor investigates the suppliers, approvers and goods received.

1. The z-score is (2.9 − 2.0) ÷ 0.2 = 4.5, a strong outlier.
2. The auditor checks that day's tills, bank deposit and any special event.

1. The extract is incomplete by ₦15 million.
2. The auditor finds out why before running any analysis.

1. An entry in the ledger without a matching record on the chain is an exception.
2. It may be an error, a fictitious payment or a delay, so the auditor investigates it.

How to score full marks

• Link each technology to a stage of the audit.
• Explain why whole-population testing improves quality.
• Give two or three statistical tests with one-line purposes.
• Mention the need to test the completeness of extracted data and the controls over robots.

Common mistakes in the exam

• Saying technology replaces auditor judgement.
• Using analytics on data that has not been reconciled.
• Naming tools without saying what they test.
• Ignoring the need to understand the client's robots and ERP configuration.

Quick revision

• Technology affects planning, risk, controls, substantive tests and reporting.
• Big data: source, 100% testing, prediction, programmed controls.
• Outliers: z-scores, Benford's law, trends, regression, stratification.
• ERP: configuration, access, change, extracts, reports.
• AI, RPA and blockchain: understand, test controls, keep judgement.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.