08-Applications-of-Data-Analytics-in-Auditing.pptx

www.pwc.com
Applications of data
analytics in auditing
1

2
PwC | Applications of data analytics in auditing
Course contents
1. Overview
2. Key areas of application
- 2a Internal controls
- 2b Substantive testing
- 2c Risk assessment
3. Case study
4. Questions

3
Overview
The right mix of mind and machine can help reduce the impact of human bias and
yield more accurate answers, even for complex problems.
http://www.pwc.com/us/en/advisory-services/data-possibilities/big-decision-survey.html

4
Learning objectives
At the end of this section, students will be able to–
• Explain the role data analytics has in the external audit
• Outline the criteria used to gauge potential analytics candidates
• Identify common pitfalls that can undermine a successful audit

5
Advantages of data analytics in audit
How can data analytics create advantages for external audit
work?

6
Advantages of data analytics in audit
Customization
Tailor the analytics
solutions to support
client needs (e.g. journal
entry testing)
Predictability
Ability to replicate
processes across type
of work and client
engagements
Test Size
Provides ability to test
entire population instead
of a sample
Data Insight
Visualization and
analytics tools allow for
a better view of the data
and pinpoints areas of
interest for auditors
Efficiency
Performance of data
analytics maximizes
time spent structuring
data into information

7
Framework for selecting analytics–
enabled audit(s)
Data
availability &
complexity
Availability:
Is data available for the
process in an easy to
access and use format?
Start
Not a likely analytics
candidate
Potential analytics
candidate
Strong analytics
candidate
?

8
enabled audit(s) (continued)
Data
availability &
complexity
Availability:
Complexity:
Are there multiple
sources? Is the data
able to be validated
for consistency
and completeness?
No
Yes
Start
candidate
Potential analytics
candidate
Strong analytics
candidate
?
?

9
Data
availability &
complexity
Availability:
Familiarity:
Does the team have
knowledge of the
business process to
understand the risks
and data?
Complexity:
Are there multiple
for consistency
and completeness?
No
No
Yes
Yes
Start
candidate
Potential analytics
candidate
Strong analytics
candidate
Process and
data
knowledge
?
?
?

10
Data
availability &
complexity
Availability:
Repeatability:
Does the area represent
a common audit focus
areas that would repeat in
the future?
Familiarity:
Does the team have
knowledge of the
business process to
and data?
Complexity:
Are there multiple
for consistency
and completeness?
No
No
No
Yes
Yes
Start
candidate
Potential analytics
candidate
Strong analytics
candidate
Process and
data
knowledge
Ability to
leverage in
future
?
?
? ?
Yes

11
Data
availability &
complexity
Availability:
Repeatability:
the future?
Familiarity:
Does the team have
knowledge of the
business process to
and data?
Complexity:
Are there multiple
for consistency
and completeness?
Applicability:
Is the dataset or risk
area applicable to
other potential
audits or business
units?
No
No
No
No
Yes
Yes
Yes
Start
candidate
Potential analytics
candidate
Strong analytics
candidate
Process and
data
knowledge
Ability to
leverage in
future
?
?
? ?
?
Yes

12
Data
availability &
complexity
Availability:
Repeatability:
the future?
Risk/Impact:
Does the process
represent a high risk area
to the company and is
there a high perceived
impact of the audit?
Familiarity:
Does the team have
knowledge of the
business process to
and data?
Complexity:
Are there multiple
for consistency
and completeness?
Applicability:
area applicable to
other potential
audits or business
units?
No
No
No
No
No
Yes
Yes
Yes Yes
Start
candidate
Potential analytics
candidate
Strong analytics
candidate
Process and
data
knowledge
Ability to
leverage in
future
Benefits
and risk
mitigation
?
?
? ?
?
?
Yes

13
Data
availability &
complexity
Availability:
Repeatability:
the future?
Risk/Impact:
Does the process
represent a high risk area
to the company and is
there a high perceived
impact of the audit?
Familiarity:
Does the team have
knowledge of the
business process to
and data?
Complexity:
Are there multiple
for consistency
and completeness?
Applicability:
area applicable to
other potential
audits or business
units?
No
No
No
No
No
Yes
Yes
Yes
Yes
No
Yes
Start
candidate
Potential analytics
candidate
Strong analytics
candidate
Process and
data
knowledge
Ability to
leverage in
future
Benefits
and risk
mitigation
?
?
? ?
?
?
Yes

14
Barriers to success
Common pitfalls to avoid
• Failure to update the audit methodology to internal
control changes, such as modifications in key
calculation logic
• Structuring the analytics team in a silo, separate from
the external audit team, decreasing transparency when
trying to visualize the big picture behind the audit
• Lack of understanding of the data analytics process from
employees on the business side, making it difficult to
meet deadlines of external audits
• Embarking on a strategy that does not leverage
connection points within the organization (Process
Assurance, IT, compliance, operations, etc.)
Analytic
Mindset &
Usage
P
e
o
p
l
e
P
r
o
g
r
e
s
s
Technology

15
Recap–Key considerations
• Communicate data analytics process with all parties involved
to manage expectations and set realistic milestones
• Determine changes to internal controls from previous audit
period to properly update analytics methodology
• Assess whether the data received is structured in a format
that can be used for analytics
• Engage data analytics team with business side to better
understand sources of data
Making Progress
Illustrative Technologies
Identify audits based
on risk, not based on
historical audit plans.
Use the data to dictate
the areas that require
additional auditing.
Use the data to
understand the why
and the how behind the
what.

16
Check on learning – Scenario #1
XYZ Company is a first-year audit client, which handles a bulk of its financial reporting on
four core systems. Two of these systems were implemented in the middle of the fiscal year
to replace an older system that assisted in storing and reporting the company’s
transactional data in a structured format. As such, XYZ Company had to plan and execute
a data migration project to transfer the financial data from the old system to the new
systems before the start of the year-end audit.
Question 1: Is the client a potential analytics candidate? What factored into your
decision making?
Question 2: If the client was selected for an analytics-enabled audit, what are some
challenges that the audit team could face during the project?

17
Key areas of application
External audits focus on financial reporting and compliance with associated regulation. The purpose
of an external audit is to provide an unbiased and independent audit opinion of whether the
financial statements are presented in a fair and accurate view, without material misstatements.
This lecture will further explain how data analytics can enhance the following key components of
external audit:
Internal Controls
Process for assuring
achievement of
efficiency, reliable
financial reporting, and
compliance with laws,
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
potential risks that
may be involved in
a projected activity
or undertaking
03
Substantive Testing
Audit procedure that
examines the
financial statements
and supporting
documentation to see
if they
contain errors
02
https://www.aicpa.org/Research/Standards/AuditAttest/DownloadableDocuments/AU-C-00200.pdf

18
Learning objectives
At the end of this section, students will be able to:
• Define data quality checks and how they are utilized
• Recognize areas where data analytics is applied in external audit
• Describe specific internal control functions utilized in external audit
• Explain substantive testing and how it is utilized
• Discuss how risk assessment can support and enhance an external audit

19
Data quality checks in external audit
1. Completeness
2. Consistency
3. Accuracy
4. Precision
5. Data gaps
Data quality is the foundation of
data analytics. The checks that are
used to ensure the data is
complete & accurate drives the
external audit and final product.

20
Internal controls
Internal controls were established under Section 302 of the Sarbanes-Oxley Act of 2002
(SOX). The function of internal controls is to ensure the accuracy of financial
reporting. In order to remain compliant with SOX regulation standards, companies
must regularly assess and document the effectiveness of those internal controls.
What are some of the risks that internal controls address?
What are some of the benefits of using data analytics for internal controls?
https://www.sec.gov/rules/proposed/s74002/card941503.pdf
Internal Controls
achievement of
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
may be involved in
or undertaking
03
Substantive Testing
examines the financial
statements and
supporting
if they
contain errors
02

21
Internal controls (continued)
1. Material misstatements in the financial statements, transactions and account balances
2. Operations running ineffectively and/or not complying with laws and regulations
3. Users with conflicting roles that allow certain actions to go unmonitored
Internal Controls
achievement of
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
may be involved in
or undertaking
03
Substantive Testing
statements and
supporting
if they
contain errors
02

22
Internal controls (continued)
1. Material misstatements in the financial statements, transactions and account balances
2. Operations running ineffectively and/or not complying with laws and regulations
3. Users with conflicting roles that allow certain actions to go unmonitored
4. Control reliability can be tested more accurately by using entire population of
input data
5. Complex control logic can be replicated more effectively using data analytics tools
6. Underlying dataset can provide a richer picture of what controls are monitoring
Internal Controls
achievement of
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
may be involved in
or undertaking
03
Substantive Testing
statements and
supporting
if they
contain errors
02

23
Application of analytics for internal controls
The application of analytics for internal controls includes, but is not limited to the
following areas:
Interest expense allocation, amortization, initial direct costs,
unearned income
Key Calculations
Contract modifications, payroll and wire transfer disbursements, financial
disclosures, privileged access usage
Key Report
Testing
Application logical security, change management, database logical
security, revocation testing, segregation of duties
IT General
Controls
Internal
Controls

24
Examples of analytics in ITGC
SO
D
C
h
a
n
g
e
M
a
n
a
g
e
m
e
n
t
02
New User Testing
• Appropriate management needs to
approve access to all new users
• A brand new employee that is a telephone
operator should not get access to edit
financial data
04
Revocation Testing
• Appropriate management should revoke
access to users who no longer require
access to an application
• If an employee leaves a company, he or
she does not need access to any of the
company’s applications.
ITGC’s
03
Change Management
• Controls are put in place to prevent the
Segregation of Duties (SOD) risk, in which
user roles are clearly distinguished to
prevent an overlap of responsibilities.
• Developers and deployers should not be
the same person.
• Users who have the ability to post
financial data to systems should not have
the ability to also approve the
transactions.
• Appropriate management needs to approve
every change that is made to an application.
• This ITGC is used to prevent unnecessary or
harmful changes from being deployed to
the application
01
SOD
New
U
ser
Testing
R
e
v
o
c
a
t
i
o
n
T
e
s
t
i
n
g

25
Examples of analytics in key calculations/reports
• Companies rely on certain key calculations to assist in
financial reporting.
• Procedure of testing key calcs entails understanding the
underlying calculation, receiving and validating the input
data, and reperforming the calculation.
Key
calculations
Key reports
testing
• Key reports are systematically generated reports which show
the results of the key controls in an application.
• Companies test the completeness and accuracy of each
key report.
• Management makes critical business decisions based on the
results of these reports.

26
While looking at a ticketing tool for a financial institution, an auditor noticed that a staff
member approved a supervisor’s request for access to a certain application. The supervisor
needed access to the application in order to complete his work. The approval allowed the
supervisor to have access and to use the application freely.
Question 1: What type of internal control is in place to make sure that each user is
approved for a new application?
Question 2: Did the financial institution properly follow the internal controls that are
in place?
Question 3: If not, what did the financial institution do wrong?

27
Interactive exercise #1 – Segregation of duties
1. What information can be retrieved from the dashboard above to assist in the audit
testing?

28
Substantive testing
Substantive testing is an audit procedure that examines the balance sheets and
other financial documentation to see if they contain errors. These tests are
needed as evidence to support the assertion that the financial records of an entity are
complete, valid, and accurate.
What are some of the risks that substantive testing addresses?
What are some of the benefits of using data analytics for substantive testing?
http://www.accountingtools.com/questions-and-answers/what-is-substantive-testing.html
Internal Controls
achievement of
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
may be involved in
or undertaking
03
Substantive Testing
statements and
supporting
if they
contain errors
02

29
Substantive testing (continued)
1. Material misstatements in the financial statements, transactions and account balances.
2. Management override and financial statement fraud.
3. Material journal entries and other adjustments made during the preparation of the
financial statements to go unnoticed.
Internal Controls
achievement of
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
may be involved in
or undertaking
03
Substantive Testing
statements and
supporting
if they
contain errors
02

30
Substantive testing (continued)
1. Material misstatements in the financial statements, transactions and account balances.
2. Management override and financial statement fraud.
3. Material journal entries and other adjustments made during the preparation of the
4. Allows to effectively identify accounts that may contain material misstatements in a
timely manner.
5. Enables auditors to focus on a few key factors that affect the account balance.
6. Increases efficiency in performing understatement tests.
Internal Controls
achievement of
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
may be involved in
or undertaking
03
Substantive Testing
statements and
supporting
if they
contain errors
02

31
Application of analytics for substantive testing
The application of analytics for substantive testing includes, but is not limited to the
following areas:
Summary system reports to raw data comparison, reserve study
insurance triangles to source recon, multiple data source
reconciliation, completeness & occurrence check
Source, manual/automated, trending, users activity, unusual and
common entries
Paper contracts to visual dashboards and PDF invoice reconciliation to GL
Journal Entry
Testing
Unstructured Text
Analytics using
OCR
Reconciliation
Repeating system key calculation activities, validation or business
rules and testing client data process
Reperformance
Substantive
Testing

32
Examples of analytics in substantive testing
Journal Entry
Testing
High volumes of journals are utilized to identify the journals that might possess
fraudulent activity. Given the high risk of management override, a health check should
also be taken regarding the company’s audit procedures.
Reperformance
Evidence is obtained about client activities by repeating the activities and comparing the
result with the client’s result.
Reconciliation
Process of matching two independent sets of records. Client’s records against a third
party’s records. Serves the assertions of completeness and existence/occurrence.
Software that automatically analyzes printed text and converts it into a
structured format.
Unstructured Text
Analytics using
OCR
Please
Note
All examples mentioned above with the exception of Journal
Entry Testing pertain to substantive testing in internal
audit as well.

Example 1 – Journal entry visual analytics
33
Companies can have high volumes of journal entries so it can be difficult to identify the large and
unusual journals by looking at millions of rows. Using visualization techniques on journals makes it
easier to explore and visualise the data to identify high risk journals.
FSLI and User with highest GL activity

Example 2 – Journal entry – Duplicate journals
34
• This test identifies journals which are apparent duplicates of each other.
• A duplicate journal is defined as one having exactly the same net reporting amounts posted to
exactly the same GL accounts in at least one other journal.
• Each duplicate group will contain all the journals having a duplicate set of account net values.
Samples above show two possible combination of journals which could be a potential duplicate of each
other since they have exactly the same net reporting amounts posted to exactly same GL accounts,
representing a heightened risk of fraud/error.
Sample 1
Sample 2
Duplicate Journals with
same net impact to the
same GL Accounts

PwC |
Example 3 – OCR in lease accounting
35
Challenge Overview
Lease information is trapped within
physical documents or scanned contracts.
Content discovery is labor intensive, and
poor understanding of contractual
elements may lead to compliance or
financial issues.
The Solution
Using optical character recognition (OCR)
and natural language processing, convert
data within contracts into meaningful,
actionable insights.
Capabilities
• Add structure to unstructured sources
• Search for and evaluate key data points
within the appropriate context
Technology
• OCR
• Natural Language Processing
• Machine Learning
• Interactive Reporting
Data contained in
PDFs and images
Key Data Points &
Relationships Extracted:
• Common Phrases
• Locations
• Companies
• Names
Converted
text
Extracted content
for validation
Interactive reporting and
key metrics

Check on learning – Multiple choice #1
What are the risks that substantive testing addresses?
I. Material misstatements in the financial statements, transactions and
account balances.
II. Management override and financial statement fraud
III. Material journal entries and other adjustments made during the preparation of the
a) I only
b) II & III
c) I,II,III
d) I & III
36

Check on learning – Multiple choice #1 (Answer)
What are the risks that substantive testing addresses?
I. Material misstatements in the financial statements, transactions and
account balances.
II. Management override and financial statement fraud
III. Material journal entries and other adjustments made during the preparation of the
c) I,II,III
37

Company’s policy dictates that no employee is paid unless she has turned in a timesheet.
The client states that this rule is in use for 100 percent of all paychecks. You can test this
client assertion by taking a sample of payroll checks and matching them to the timesheets.
Which technique of substantive testing would you apply to test it?
I. Completeness
II. Reconciliation
III. Reperformance
IV. Journal Entry Testing
a) I
b) II
c) III
d) IV
38

Company’s policy dictates that no employee is paid unless she has turned in a timesheet.
The client states that this rule is in use for 100 percent of all paychecks. You can test this
client assertion by taking a sample of payroll checks and matching them to the timesheets.
Which technique of substantive testing would you apply to test it?
I. Completeness
II. Reconciliation
III. Reperformance
IV. Journal Entry Testing
c) III
39

Risk assessment
Risk assessments should identify, quantify and prioritize tasks against criteria
for risk acceptance and objectives relevant to the organization. The results
should guide and determine the appropriate management action, priorities for
managing information systems, and priorities for implementing controls selected to
protect against these risks.
40
What are some areas that risk assessment addresses?
What are some of the benefits of using data analytics for risk assessment?
CISA Review Manual 2014
Internal Controls
achievement of
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
may be involved in
or undertaking
03
Substantive Testing
statements and
supporting
if they
contain errors
02

Risk assessment
41
1. Customers fulfilling payment obligations late or not at all.
2. Improper financial reporting of divisions or segments within a company.
3. Incomplete integration or separation of IT infrastructure when buying or selling
business units.
Internal Controls
achievement of
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
may be involved in
or undertaking
03
Substantive Testing
statements and
supporting
if they
contain errors
02

Risk assessment
42
1. Customers fulfilling payment obligations late or not at all.
2. Improper financial reporting of divisions or segments within a company.
3. Incomplete integration or separation of IT infrastructure when buying or selling
business units.
1. Relate the cost-benefit analysis of the control to the known risk, allowing
practical choices.
2. It helps to identify and target the higher risk areas that are relevant to the auditor.
3. Reduces or avoids the independence and familiarity of threats from external auditors.
Internal Controls
achievement of
regulations and
policies.
01
Risk Assessment
A systematic
process of
evaluating the
may be involved in
or undertaking
03
Substantive Testing
statements and
supporting
if they
contain errors
02

Application of analytics for substantive testing
The application of analytics for substantive testing includes, but is not limited to the
following areas:
43
Summary system reports to raw data comparison, reserve study
insurance triangles to source recon, multiple data source
reconciliation, completeness & occurrence check
Source, manual/automated, trending, users activity, unusual and
common entries
Paper contracts to visual dashboards and PDF invoice reconciliation to GL
Journal Entry
Testing
Unstructured Text
Analytics using
OCR
Reconciliation
Repeating system key calculation activities, validation or business
rules and testing client data process
Reperformance
Substantive
Testing

Application of analytics for risk assessment
The application of analytics for risk assessment includes, but is not limited to the
following areas:
44
Duplicate vendor/payment, one-time payments, restricted vendors,
lost accounts
Accounts
Payable
Financial statement reporting, IT infrastructure separation, allocation of
assets and liabilities
Carve-out (Partial
Divestiture)
Asset misappropriation, financial statement fraud
Fraud, Waste,
& Abuse
Risk
Assessment

Example 1 – Accounts payable risk profiling
Accounts payable (AP) is prime example of analytics used in risk assessment. Identifying high risk
profile vendors enables auditors to effectively determine potential fraudulent activity
that can cause a material misstatement on financial statements. Such analysis can assist
management plan and implement appropriate controls to address these risks.
45

Example 1 – Accounts payable risk profiling
Accounts payable (AP) is prime example of analytics used in risk assessment. Identifying high risk
profile vendors enables auditors to effectively determine potential fraudulent activity
that can cause a material misstatement on financial statements. Such analysis can assist
management plan and implement appropriate controls to address these risks.
46
High risk profile vendors

Example 2 – Carve-out – Financial reporting
A carve-out is the process of divesting a struggling or non-core segment of the business from the
parent company. A carved-out segment must have it’s own complete, independent financial
statement reporting, as well as proper separation of the IT infrastructure.
The following is a process map of a carve-out financial reporting test:
47
Data Acquisition
1
Collect the data that is
necessary to ensure
appropriate financial
statement reporting at
more granular level
Preparation and
Loading
2
Assess whether data is
structured in a format
that can be stored easily
and load data into a
database management
system
Completeness
and Accuracy
3
Check whether the
loaded data is complete
and accurate prior to
proceeding with testing
Data
Manipulation
4
Extract the subset of
data that is associated
with the segment of the
firm that is being carved
out/sold off.
Reconciliation
5
Perform reconciliation of
the data subset to
identify if the financials
of the carve-out
segment are being
reported correctly
Results
6
Communicate the
results and determine if
any follow-ups are
required
https://www.aira.org/pdf/journal/december-january-2012.pdf

What is a benefit of using data analytics for risk assessment?
a) It helps to identify and target the higher risk areas that are relevant to the auditor.
b) Data analytics prove who should be charged with fraud
c) Data analytics are not specifically beneficial to risk assessment
48

What is a benefit of using data analytics for risk assessment?
a) It helps to identify and target the higher risk areas that are relevant to the auditor.
49

While looking at a ticketing tool for a financial institution, an auditor noticed that a staff
member approved a supervisor’s request for access to a certain application. The supervisor
needed access to the application in order to complete his work. The approval allowed the
supervisor to have access and to use the application freely.
Question 1: What type of internal control is in place to make sure that each user is
approved for a new application?
Question 2: Did the financial institution properly follow the internal controls that are
in place?
Question 3: If not, what did the financial institution do wrong?
50

Lyons & Lyons CPAs are in the midst of their audit of Main Street, Inc. and are concerned
about a transaction that appears to be fraudulent. How should Lyons & Lyons react?
a) They should maintain their planned approach to the audit.
b) They should plan inventory observations further in advance with the company.
c) They should reflect their concerns in the working papers and move on to
something else.
d) They should review adjusting entries in detail.
51
Auditor’s Response to the Fraud Risk Assessment,

Lyons & Lyons CPAs are in the midst of their audit of Main Street, Inc. and are concerned
about a transaction that appears to be fraudulent. How should Lyons & Lyons react?
d) They should review adjusting entries in detail.
52

Case study
Data analytics is the art and science of discovering and analyzing patterns, identifying
anomalies, and extracting other useful information in data underlying or related to the
subject matter of an audit through analysis, modeling, and visualization for the purpose of
planning or performing the audit
Reference hand-out
53
https://www.aicpa.org/InterestAreas/FRC/AssuranceAdvisoryServices/DownloadableDocuments/AuditAnalytics_Looking
TowardFuture.pdf

Learning objectives
At the end of this case study, students will be able to:
• Identify potential fraud and other risks through utilizing analytics tools
54

Questions?
55
55

Key points
• What are potential advantages of using analytics in an audit?
• What are considerations in selecting an opportunity to use analytics in an audit?
• What are major audit areas where analytics can be applied?
• What risks are addressed by substantive testing?
• What kinds of substantive testing can be performed with analytics?
56

© 2018 PwC. All rights reserved. PwC refers to the US member firm or one of its subsidiaries
or affiliates, and may sometimes refer to the PwC network. Each member firm is a separate
legal entity. Please see www.pwc.com/structure for further details

08-Applications-of-Data-Analytics-in-Auditing.pptx

More Related Content

Similar to 08-Applications-of-Data-Analytics-in-Auditing.pptx (20)

Recently uploaded (20)

08-Applications-of-Data-Analytics-in-Auditing.pptx

Editor's Notes