Analytical Procedures Under AU-C 520: Planning, Substantive Testing and the Final Review

Analytical procedures are evaluations of financial information through analysis of plausible relationships among financial and nonfinancial data. They include comparisons to prior periods, budgets and industry data, ratio analysis and reasonableness tests, and they involve investigating fluctuations or relationships that are inconsistent with other information. AU-C 520, Analytical Procedures, governs their use in the substantive stage and the overall review, and works with AU-C 315 for risk assessment.

Used well, analytics are an efficient source of audit evidence. Used badly, they produce a workpaper that says "revenue up 12%, explained by management, no further work." This guide explains the three stages, how to build an expectation, how to set a threshold, and what the file needs to show.

The three places analytics belong

1. Analytics in planning

AU-C 315 lists analytical procedures among the risk assessment procedures. The aim is to understand the entity and identify unusual transactions or events, and amounts, ratios and trends that may indicate matters relevant to the audit. Planning analytics are typically high-level and use data aggregated at a level that may not show material misstatements, so they provide only a broad initial indication.

Practical planning analytics:

• two- to three-year comparison of trial balance accounts with flux percentages
• gross margin and expense ratios by product, location or month
• working capital ratios: days sales outstanding, inventory turnover, days payable, current ratio. See the financial ratio calculator and current ratio calculator
• interest expense compared to average debt
• payroll expense compared to headcount and pay rates
• relationships to nonfinancial data such as units shipped, square footage or occupancy

In planning, the question is "where might this be wrong?" The results go straight into the risk assessment. An unexplained spike in gross margin may point to cutoff, inventory costing or revenue recognition. The planning analytic is a prompt to ask questions of management, and any answers should be corroborated when they bear on a risk. The output feeds the audit planning memo and the risk assessment worksheet.

A caution: planning analytics on preliminary, unadjusted trial balances can mislead. A client that has not finished its close may show swings that vanish after entries are booked.

2. Substantive analytical procedures

A substantive analytical procedure is a procedure designed to detect material misstatement at the assertion level. AU-C 520 asks the auditor, when designing and performing one, to:

1. Determine the suitability of the particular substantive analytical procedures for the given assertions, considering the assessed risks and any tests of details.
2. Evaluate the reliability of the data from which the expectation is developed, considering source, comparability, nature and relevance, and controls over preparation.
3. Develop an expectation of recorded amounts or ratios and evaluate whether the expectation is sufficiently precise to identify a misstatement that, individually or aggregated, may cause the financial statements to be materially misstated.
4. Determine the amount of any difference of recorded amounts from expected values that is acceptable without further investigation.

Then compare the recorded amounts to the expectation, and investigate any differences beyond the threshold.

Suitability

Analytics work best for large volumes of transactions that tend to be predictable over time: payroll, rent, interest, depreciation, commissions, utilities, insurance, and revenue where price times volume is knowable. They are less suited to areas driven by judgment, one-time events or manual entries. Higher assessed risk calls for more precise expectations or tests of details instead. For a significant risk, AU-C 330 requires that when the response consists only of substantive procedures, those procedures include tests of details, so an analytic alone is not enough.

Reliability of data

Where does the data come from? Data from the general ledger the client controls needs more support than audited prior-year numbers or independent external data. Consider:

• the source: independent external, or internal
• whether it was audited or tested in the current or prior period
• the controls over its preparation, especially reports produced by the client's systems
• whether the data are comparable, with the same definitions and basis

If the data come from client-produced reports, test completeness and accuracy of the report. The IPE testing worksheet is designed for it.

Building an expectation

A good expectation is independent of the recorded amount and based on relationships you have reason to believe exist. Compare:

• Weak: "Last year's rent expense plus 3%."
• Better: "Rent equals monthly rent per the lease schedule, with scheduled escalation, times months occupied, plus common area charges based on prior-year actual adjusted for square footage change."

Common expectation approaches:

• Predictive models: price times quantity (revenue, cost of goods), headcount times average pay (payroll), average debt balance times interest rate (interest), depreciable base times rate (depreciation).
• Ratio analysis: gross margin consistent with prior years given product mix.
• Trend analysis: applies to stable accounts when circumstances have not changed.
• Regression analysis: useful where there are multiple drivers and enough data.

Precision matters. The tighter the expectation, the smaller the difference you can accept without investigation. A trend expectation with a ten percent band cannot detect a five percent misstatement that is material.

Setting the threshold

AU-C 520 requires you to determine the amount of difference you can accept without further investigation. It does not set a percentage. In practice the threshold is tied to performance materiality set under AU-C 320 and reduced for the desired level of assurance from the analytic and for the aggregate of other procedures on the same account. The materiality calculator gives the starting point.

One approach is to set the threshold at a portion of performance materiality, smaller where the analytic is the only substantive procedure for the assertion and larger where it supplements tests of details. Whatever rule your methodology uses, document the amount and the reasoning for each analytic. Setting the threshold after seeing the difference is a recognizable red flag.

Investigating differences

When differences exceed the threshold, AU-C 520 requires you to investigate by inquiring of management and obtaining appropriate audit evidence relevant to management's responses, and by performing other audit procedures as necessary in the circumstances. The point of the second part is that an explanation is not evidence. "Sales were higher due to a new customer" needs corroboration: contracts, shipments, customer confirmations. If management cannot explain the difference or the explanation is not supported, treat it as a potential misstatement and extend procedures.

Example: payroll

1. Expectation: average headcount by month (from HR records tested for completeness) times average pay rate by job class (agreed to rate tables), plus bonuses per approved schedules, plus employer taxes at statutory rates.
2. Threshold: for example, a defined portion of performance materiality as set by methodology.
3. Compare to recorded payroll expense by quarter. Investigate unexpected differences, such as a month with higher overtime or a retroactive adjustment.
4. Conclusion: whether payroll expense is reasonable, supported by the corroborated explanations.

Example: interest expense

Average monthly debt balances from lender statements times contractual rates, adjusted for fees amortized. A difference may indicate unrecorded debt, an unrecorded rate change, or capitalized interest. See the debt guide.

3. The overall review near the end

AU-C 520 requires analytical procedures near the end of the audit that assist the auditor in forming an overall conclusion as to whether the financial statements are consistent with the auditor's understanding of the entity. This is a review of the final, adjusted financial statements, not a repeat of the planning analytic.

What to do:

• compare the final financial statements to prior year, budget and the understanding of the entity from planning
• recompute the planning ratios using adjusted balances
• read the financial statements and notes as a user would, looking for relationships that do not make sense: margin changes, balance sheet items that move inconsistently with activity, a note that does not match the numbers
• consider whether the results indicate a previously unrecognized risk of material misstatement, including fraud. If so, revise the risk assessment and perform additional procedures

The overall review is a good place to catch inconsistencies between cash flow, the income statement and balance sheet movement. See the statement of cash flows guide. It is also the last practical chance to catch an error before the report is signed, and the engagement partner and the engagement quality reviewer, where there is one, should see it.

Technology and data analytics

Analytics can be run on full populations: all journal entries, all payroll lines, all invoices. This can strengthen evidence, but the standard's logic applies: reliable data, a clear expectation or criteria, a defined threshold, investigation of exceptions, and documentation. The Benford's law analyzer is an example of a screening tool; exceptions it flags are leads, not conclusions. Journal entry analytics tie into journal entry testing.

Documentation

Under AU-C 230, the file for a substantive analytic should include:

• the assertion and the risk addressed
• the reason the analytic is suitable
• the expectation, how it was developed and the data used
• evidence on the reliability of the data
• the threshold and how it was determined
• the comparison and the differences
• investigation of differences with corroborating evidence
• the conclusion

For planning and the overall review, document the analytics performed, the unusual items identified, and how they changed the risk assessment or the procedures. A simple lead schedule with prior-year and current-year comparisons is often the working file.

Common mistakes

• Expectation built from the recorded number, so it cannot disagree.
• Prior year plus a percentage treated as an expectation for a changing business.
• Threshold chosen after the fact, or not documented.
• Unreliable data such as unaudited management reports used without testing.
• Management explanation accepted without corroboration.
• Analytics used as the only procedure on a significant risk.
• No final review, or a final review performed on unadjusted balances.
• Planning analytics never connected to the risk assessment.

FAQ

Are analytical procedures required in every audit?

Yes, at two points: as a risk assessment procedure in planning and in the overall review near the end. Substantive analytical procedures are a choice.

How do I set the threshold for investigating differences?

AU-C 520 requires the auditor to determine the acceptable difference but does not set a number. In practice it is a portion of performance materiality, smaller when the analytic is the main evidence. Document it before comparing.

Is management's explanation enough?

No. The auditor inquires of management and obtains appropriate audit evidence relevant to the responses, and performs other procedures as necessary.

Can analytics alone support a significant risk?

No, not as the only response. AU-C 330 requires that when the response to a significant risk consists only of substantive procedures, those procedures include tests of details. A precise analytic can supplement them. Higher risks need more persuasive evidence.

What is the difference between planning and final analytics?

Planning analytics use preliminary data to find risks. Final analytics use adjusted financial statements to confirm that the conclusions fit the understanding of the entity and that no new risks emerged.

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

Sources

• AICPA, AU-C Section 520, Analytical Procedures
• AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as revised by SAS No. 145)
• AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
• AICPA, AU-C Section 320, Materiality in Planning and Performing an Audit
• AICPA, AU-C Section 500, Audit Evidence (as revised by SAS No. 142)
• AICPA, AU-C Section 230, Audit Documentation

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error