Information Systems Auditing Process · Topic 4 of 5
Audit Evidence and Data Analytics
Sufficient and reliable audit evidence, collection techniques such as reperformance, CAATs, continuous auditing techniques and audit data analytics.
- 3 min
- Evidence must be sufficient and appropriate (relevant and reliable).
- External and auditor-obtained evidence beats auditee-provided and oral evidence.
- Interviews are assertions; corroborate them.
What it is
Audit evidence is the information the auditor uses to reach a conclusion. It must be sufficient (enough of it) and appropriate (relevant and reliable). Audit data analytics uses software to examine whole populations of data, find patterns and exceptions, and test controls far faster than manual sampling.
How it works
What makes evidence reliable
| More reliable | Less reliable |
|---|---|
| Obtained from an independent source outside the auditee | Provided by the auditee |
| Obtained directly by the auditor | Obtained indirectly or second-hand |
| Documentary or system-generated, with good controls | Oral statements |
| Provided by a qualified, objective person | From someone with a stake in the result |
An interview answer is an assertion. It guides the audit but must be corroborated, for example by inspecting the system setting the person described.
Collection techniques
| Technique | What the auditor does |
|---|---|
| Inquiry and interviews | Asks staff how processes work |
| Observation | Watches a process being performed |
| Inspection | Examines documents, records, configurations |
| Reperformance | Independently carries out a control to see if it gives the right result |
| Recalculation | Checks the mathematical accuracy of data |
| Walkthrough | Follows one transaction end to end to confirm understanding |
| Confirmation | Obtains written confirmation from a third party |
Reperformance by the auditor is strong evidence because it does not depend on the auditee's word.
Computer-assisted audit techniques (CAATs)
CAATs are tools the auditor uses to extract and analyze data independently: generalized audit software, queries and scripts, and utility software. They let the auditor test 100 percent of a population, for example every payment for duplicates. The auditor should obtain data directly or verify its integrity, such as by reconciling record counts and control totals to the source.
Continuous auditing techniques
| Technique | How it works |
|---|---|
| Systems control audit review file (SCARF) with embedded audit modules | Audit code inside the application records transactions meeting set criteria |
| Snapshot | Captures images of a transaction at points along its processing path |
| Integrated test facility (ITF) | Dummy entity in the live system; test transactions are processed alongside real ones |
| Continuous and intermittent simulation (CIS) | Simulates processing of transactions that meet criteria and flags differences |
| Audit hooks | Embedded flags that alert the auditor to suspicious transactions |
ITF needs care: test transactions must be removed or isolated so they do not affect real results.
Audit data analytics
Analytics can match data across systems, find duplicates and gaps, apply rules such as payments over a limit without a second approval, and spot unusual patterns. The value comes from a clear question, complete and accurate data, and follow-up of exceptions.
When an option offers testing the full population with analytics instead of a small manual sample, it often gives better evidence, provided data completeness is verified.
How the exam asks about this
- "Which evidence is MOST reliable?" Evidence the auditor obtains directly from an independent source, or reperforms.
- "A manager says a control works." Corroborate before relying on it.
- "Test every transaction for duplicate payments." Use CAATs or data analytics.
What to remember for the exam
- Evidence must be sufficient and appropriate (relevant and reliable).
- External and auditor-obtained evidence beats auditee-provided and oral evidence.
- Interviews are assertions; corroborate them.
- CAATs test whole populations; verify data integrity first.
- Know SCARF/EAM, snapshot, ITF, CIS and audit hooks.
Analyzing data the auditee extracted and handed over, without checking completeness, can lead to a confident but wrong conclusion.
Common mistakes
Relying on management representations alone. They are among the weakest forms of evidence.
Forgetting to verify the data before analytics. Check record counts and control totals.
Leaving ITF test data in live results. It must be isolated or reversed.
Check yourself
Why is reperformance strong evidence?
The auditor independently carries out the control rather than relying on what the auditee says.
Which continuous audit technique uses a dummy entity in the live system?
The integrated test facility (ITF).
What should the auditor do before analyzing data extracted for the audit?
Verify its completeness and integrity, for example by reconciling record counts and control totals to the source.
Topic 4 of 5 in Information Systems Auditing Process
Test yourself on Information Systems Auditing Process
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.