Glossary/IT and data

Audit data analytics

Audit data analytics is the use of automated tools and techniques to analyze whole populations of data for risk assessment, testing and anomaly detection, rather than relying only on samples.

CORAA TeamUpdated November 5, 2026

Definition

Audit data analytics (ADA) means using automated tools and techniques, such as scripts, spreadsheets or specialized software, to analyze large sets of entity data for audit purposes. Uses include risk assessment, testing complete populations of journal entries or invoices, finding duplicates or gaps, recalculating balances and spotting outliers.

Why it matters in an audit or review

ADA can test a whole population where sampling would test a small part of it, and it can target unusual items rather than random ones. It does not replace judgment: the auditor still has to define criteria, investigate each exception, and conclude. The data itself must be reliable, so the auditor tests completeness and accuracy of the extract and the source before relying on the output. Results and logic are kept in the working papers so a reviewer can reproduce them.

Example

The auditor imports the full year's AP disbursements (illustrative: 18,400 payments) and runs three tests: duplicate vendor, invoice number and amount; payments just under the approval limit; and payments to vendors created in the last 30 days. Fourteen items are flagged. The team traces each to support, finds two duplicates totaling $11,000, and proposes a correction.

Common mistakes

Running analytics on an extract the client gave without checking that it ties to the trial balance.

Sources

  • AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (journal entry testing)
  • AICPA, AU-C Section 500, Audit Evidence (reliability of information used)
  • AICPA, AU-C Section 530, Audit Sampling
  • AICPA, Guide: Audit Data Analytics (non-authoritative)

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AU-C 240AU-C 500

Related terms

  • Information produced by the entity
    Information produced by the entity (IPE) is data or reports the entity generates, such as aging reports, listings or system exports, that the auditor uses as audit evidence. Its completeness and accuracy must be evaluated.
  • Management override of controls
    Management override of controls is the risk that management bypasses controls that otherwise work, by posting false entries or biasing estimates, and AU-C 240 treats it as present in every audit.
  • Risk of material misstatement
    The risk of material misstatement is the risk that financial statements are materially misstated before the audit. It exists at the statement and assertion levels and has inherent risk and control risk components.
  • Professional skepticism
    Professional skepticism is an attitude that includes a questioning mind, alertness to conditions that may indicate misstatement, and a critical assessment of audit evidence, kept up throughout the whole engagement.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required