Guide to Data Analytics

155 Pages·2018·8.2 MB·English

by  AICPA

Guide to Audit
Data Analytics
23723-349
Copyright © 2017 by
American Institute of Certified Public Accountants, Inc.
New York, NY 10036-8775
All rights reserved. For information about the procedure for requesting permission to
make copies of any part of this work, please e-mail [email protected] with your
request. Otherwise, requests should be written and mailed to the Permissions
Department, AICPA, 220 Leigh Farm Road, Durham, NC 27707-8110.
1 2 3 4 5 6 7 8 9 0 AAP 1 9 8 7
ISBN 978-1-94549-864-0
iii
Preface
Notice to Readers
AICPA Guide to Audit Data Analytics has been developed by the AICPA Au-
ditDataAnalyticsWorkingGrouptoprovideanintroductionandoverviewof
dataanalytictechniquestoassistfinancialstatementauditorsinapplyingsuch
techniquesinperformingtheirauditengagements.
ThispublicationisanotherauditingpublicationasdefinedinAU-Csection200,
OverallObjectivesoftheIndependentAuditorandtheConductofanAuditin
AccordanceWithGenerallyAcceptedAuditingStandards(AICPA,Professional
Standards).Otherauditingpublicationshavenoauthoritativestatus;however,
theymayhelptheauditorunderstandandapplygenerallyacceptedauditing
standards.
In applying the auditing guidance included in an other auditing publication,
theauditorshould,usingprofessionaljudgment,assesstherelevanceandap-
propriatenessofsuchguidancetothecircumstancesoftheaudit.Theauditing
guidanceinthisdocumenthasbeenreviewedbytheAICPAAuditandAttest
StandardsstaffandpublishedbytheAICPAandispresumedtobeappropri-
ate.Thisdocumenthasnotbeenapproved,disapproved,orotherwiseactedon
byaseniortechnicalcommitteeoftheAICPA.
Potential Benefits of Increased Use of ADAs
Audit data analytics (ADA or ADAs) are defined as "...the science and art of
discoveringandanalyzingpatterns,identifyinganomalies,andextractingother
useful information in data underlying or related to the subject matter of an
auditthroughanalysis,modeling,andvisualizationforthepurposeofplanning
orperformingtheaudit."1
Inshort,ADAsaretechniquesthatcanbeusedtoperformvariousauditpro-
cedures,including elements of risk assessment,tests of controls,substantive
procedures (that is, tests of details or substantive analytical procedures), or
concludingauditprocedures.ADAsandanalyticalproceduresareinterrelated,
butnotallADAsareanalyticalprocedures.Analyticalproceduresrequiredby
generallyacceptedauditingstandards(GAAS)areaddressedinAU-Csection
520,AnalyticalProcedures(AICPA,ProfessionalStandards),andinAICPAAu-
ditGuideAnalyticalProcedures.(NotethatAuditGuideAnalyticalProcedures
isaninterpretivepublicationasdefinedinAU-Csection200andisauthorita-
tive.)However,GAASdoesnotrequireorreferencetheapplicationofADAs.
Akeyobjectiveofthispublicationistointroduceauditorswhoarenotfamiliar
withADAstobasicconceptsunderlyingtheiruseandprovideexamplesofhow
they might be used in practice. Future editions of this publication, or other
guidance,willlikelybepublishedtoreflectongoingdevelopmentsintheuseof
dataanalyticsinfinancialstatementaudits.
1 Byrnes,Paul;Criste,Tom;Stewart,Trevor;andVasarhelyi,Miklos."ReimaginingAuditingin
aWiredWorld."AccessedApril30,2017,www.aicpa.org/interestareas/frc/assuranceadvisoryservices/
downloadabledocuments/whitepaper_blue_sky_scenario-pinkbook.pdf.
©2017, AICPA DATA
iv
Audits of the financial statements of entities of all types and sizes are now
beingperformedinanenvironmentwherethereispervasiveuseofinformation
technology.Inthiscontext,increaseduseofADAsislikelytobeimportantto
maintainingandenhancingtherelevanceandvalueofthefinancialstatement
audit.BenefitsofmakingmoreuseofADAsincludethefollowing:
(cid:2)
Improvedunderstandingofanentity'soperationsandassociated
risks,including the risk of fraud.The use of ADAs can help au-
ditors obtain a deeper understanding of the entity under audit.
A better understanding of the entity can help the auditor iden-
tify either previously unidentified risks or areas where the risk
ishigherthaninitiallyassessed,therebyenablingtheauditorto
better focus the audit procedures accordingly. Through a better
understandingofanentity'soperations,theauditorisalsobetter
(cid:2) equippedtoidentifywhereorhowfraudmaybeperpetrated.
Increasedpotentialfordetectingmaterialmisstatements.Auditors
often use sampling for tests of controls and substantive proce-
dures. ADAs may be used to efficiently and effectively examine
aspectsof100percentofitemsinapopulationofrelevantdataat
variouslevelsofaggregation.Thismayenableauditorstoreduce
the use of sampling and thereby more effectively manage sam-
plingrisk(thatis,theriskthattheauditor'sconclusionbasedon
asamplemaybedifferentfromtheconclusioniftheentirepopu-
lationweresubjectedtothesameauditprocedure).2 Inaddition,
use of ADAs, in some cases, may enable the auditor to more ef-
fectivelyandefficientlyconsidervariousaspectsofthereliability
of data.However,sampling would still remain as a useful audit
(cid:2) techniqueinmanycircumstances.
Improvedcommunicationswiththosechargedwithgovernanceof
audited entities. As a result of the matters noted in the preced-
ingbulletpoints,anauditor'suseofADAsmayprovideagreater
breadth and depth of useful insights into matters of concern to
those charged with governance.3 When using ADAs,auditors of-
tenmaybeabletomoreefficientlyandeffectivelydescribematters
identifiedbytheaudit,forexample,byusinggraphicsdeveloped
inperformingtheADAs.Discussionswiththosechargedwithgov-
ernancecanthenfocusmoreproductivelyonthereasonswhycer-
tain matters occurred and the possible implications for control,
financialreporting,orgovernanceprocesses.
Recognition
TheAICPAgratefullyacknowledgesthefollowingmembersoftheAICPAAudit
DataAnalyticsTaskForceandotherswhoreviewedorotherwisecontributed
tothedevelopmentofthispublication.
2 Thisdefinitionofsamplingriskissetoutinparagraph.05ofAU-Csection530,AuditSampling
(AICPA,ProfessionalStandards).
3 Paragraph.16ofAU-Csection260,TheAuditor'sCommunicationWithThoseChargedWith
Governance(AICPA,ProfessionalStandards),requirestheauditortocommunicatewiththosecharged
withgovernanceregardingspecificmattersand,aswell,"othermatters,ifanyarisingfromtheaudit
that,intheauditor'sprofessionaljudgment,aresignificanttotheoversightofthefinancialreporting
process."
DATA ©2017, AICPA
v
AuditDataAnalyticsWorkingGroup(2015–2017)
BrianP.Collins,Chair
EfrimBoritz
EricE.Cohen
EvanDeFord
NicoleDeschamps
BrianFoster
KatieGreehan
JasonGuthrie
KristineHasenstab
DanielHevia
QiLiu
KevinMacfee
BrianMiller
NicoleOberst
TrevorStewart
MiklosA.Vasarhelyi
BrianWolohan
MichaelYates
Juli-annGorgi,Observer
KaylynnPippo,Observer
TheAICPAalsothanksGregoryP.Shieldsforhisinvaluableassistanceinau-
thoringthispublicationandTrevorStewartforthedevelopmentoftheregres-
sionanalysisexample.ThanksalsotothoseASBmembersandtheirfirmswho
readthedraftpublicationandprovidedvaluableinputonhowtomakethisa
betterpublication.
AICPAStaff
CharlesE.Landes
VicePresident
ProfessionalStandardsTeam
AmyPawlicki
VicePresident
AssuranceandAdvisoryInnovation
AmiBeers
Director
Assurance&AdvisoryServices—CorporateReporting
AhavaGoldman
AssociateDirector
Audit&AttestStandards
DorothyMcQuilken
SeniorManager
AuditDataAnalytics&ERM
AICPA.org Website
The AICPA encourages you to visit the website at www.aicpa.org and the Fi-
nancialReportingCenteratwww.aicpa.org/frc.TheFinancialReportingCenter
supportsmembersintheexecutionofhigh-qualityfinancialreporting.Whether
youareafinancialstatementprepareroramemberinpublicpractice,thiscen-
terprovidesexclusivemember-onlyresourcesfortheentirefinancialreporting
©2017, AICPA DATA
vi
process and provides timely and relevant news,guidance,and examples sup-
portingthefinancialreportingprocess.AnotherimportantfocusoftheFinan-
cialReportingCenteriskeepingthoseinpublicpracticeuptodateonissues
pertaining to preparation, compilation, review, audit, attestation, assurance,
andadvisoryengagements.CertaincontentontheAICPA'swebsitesreferenced
inthispublicationmayberestrictedtoAICPAmembersonly.
DATA ©2017, AICPA
TableofContents vii
TABLE OF CONTENTS
Chapter Paragraph
1 Introduction .01-.56
ObjectivesofThisGuide ..................................... 01-.02
Structure,Form,andContentofThisGuide ................... .03-.11
ConsiderationsRegardingExamplesinThisGuideand
OtherMatters ............................................. .12-.13
RelationshipBetweenADAs,CAATs,andAnalytical
Procedures ................................................ .14-.16
ExercisingProfessionalJudgmentandMaintaining
ProfessionalSkepticism .................................... .17
ConsiderationsinDeterminingWhichADAtoUsetoMeet
theObjectiveoftheAuditProcedure ...................... .18-.19
UsingGraphicsandTables(Visualization) .................... .20-.28
GraphicsOftenLinkedWithParticularADAs ............... .24
MatterstoConsiderRegardingGraphicDesign ............ .25-.28
AccessingandPreparingDataforPurposesofanADA ....... .29-.37
AccessingDatainaFormattheAuditorCanUse ........... .31-.33
MaintainingDataSecurity,Confidentiality,andIntegrity .... .34-.35
PreparingtheDataforUse ................................. .36-.37
RelevanceandReliabilityofData ............................. .38-.45
DataCharacteristicsThatMayAffectRelevanceand
ReliabilityofData ...................................... .39
RelevanceofData ......................................... .40-.41
ReliabilityofData ......................................... .42-.44
PossibleSequenceofProceduresRegardingData
RelevanceandReliability ............................... .45
AddressingCircumstancesinWhichanADAIdentifies
aLargeNumberofItemsforFurtherConsideration ......... .46-.47
DocumentingtheProcedures ................................. .48-.56
GAASRequirementsRegardingDocumentation ............. .48-.52
ScreenshotsofGraphics ................................... .53
DocumentingProcesstoAddressaLargeNumberof
ItemsWarrantingFurtherConsideration ................. .54-.56
2 UsingADAsinPerformingRiskAssessmentProceduresand
inProcedurestoAssistWhenForminganOverallConclusion .01-.29
MattersCoveredinThisChapter ............................. .01-.03
SpecificGenerallyAcceptedAuditingStandardsRelevant
toUseofADAsinPerformingRiskAssessmentProcedures .. .04-.07
DefinitionofRiskAssessmentProcedures ................... .04-.07
ApplyingFiveBasicStepsforanADA ........................ .08-.09
PlantheADA ................................................ .10-.12
DeterminetheSpecificObjectivesoftheADA(Withinthe
ContextofItsOverallPurpose) .......................... .10-.12
©2017, AICPA Contents
viii TableofContents
Chapter Paragraph
2 UsingADAsinPerformingRiskAssessmentProceduresand
inProcedurestoAssistWhenForminganOverall
Conclusion—continued
ConsidertheRelevanceandReliabilityoftheDataUsed ...... .13
PerformtheADA ............................................. .14-.26
IdentifyingandAddressingNotableItems .................. .14-.25
AddressingRisksofMaterialMisstatementforRemaining
PopulationItems ........................................ .26
UsingADAsinPerformingProcedurestoAssistWhen
ForminganOverallConclusion ............................ .27-.29
AppendixA ExamplesofADAsUsedinPerformingRiskAssessmentProcedures
3 UsingADAsinPerformingSubstantiveAnalyticalProcedures .01-.63
MattersCoveredinThisChapter ............................. .01-.02
DefinitionofAnalyticalProcedures ............................ .03
NatureandObjectivesofSubstantiveAnalyticalProcedures ... .04-.05
StepsanAuditorMightFollowinPlanning,Performing,
andEvaluatingaSubstantiveAnalyticalProcedure ......... .06-.11
Auditor’sExpectations ..................................... .08
Precision .................................................. .09-.10
LevelofAssurance ......................................... .11
PlausibilityandPredictabilityofRelevantRelationships ........ .12-.15
LevelofDisaggregationofData .............................. .16-.18
AmountofAcceptableDifferenceofRecordedAmountsFrom
ExpectedValues .......................................... .19-.22
InvestigationofaSignificantDifference ....................... .23-.29
EffectivenessofMethodUsedtoDeveloptheAuditor’s
Expectation ............................................... .30-.62
TrendAnalysis ............................................. .32-.38
RatioAnalysis ............................................. .39-.45
Non-StatisticalPredictiveModeling ......................... .46-.54
RegressionAnalysis ........................................ .55-.62
Documentation ............................................... .63
AppendixB ExamplesofADAsUsedinPerformingSubstantiveAnalytical
Procedures
4 UsingADAsinPerformingTestsofDetails .01-.19
MattersCoveredinThisChapter ............................. .01-.03
CertainGAASRelevanttotheUseofADAsinPerforming
TestsofDetails ............................................ .04-.07
NatureandExtentofSubstantiveProcedures ............... .04-.06
EvaluationofMisstatements ................................ .07
Contents ©2017, AICPA