ACCA AAA · Chapter 15
Automated tools and techniques
Your chapter at a glance. Open any section, or keep the whole map in view.
Traditional techniques and data analytics
Use technology purposefully data, tool and judgement
Automated tools and techniques
- Technology for risk assessment or audit evidence
- Include CAATs, data analytics and advanced tools
Audit programs
- Interrogate accounting records and select/stratify samples
- Find anomalies and recalculate amounts
- May examine entire population if data and tool are sound
Audit purpose
- Set criteria to match the assertion and possible misstatement
- Investigate unusual items, including small repeated frauds
Test data
- Process auditor-designed dummy transactions
- Include valid, unusual and extreme/invalid items
- Predict expected response and compare with actual output
- Use copy to protect live data; verify equivalent operation
Integrated test facility
- Fictitious records within live client system
- Process test transactions and compare outcomes
- Prevent test items affecting financial records
SCARF
- Copy transactions meeting auditor criteria for review
Access
- Restrict facility, criteria and audit files to authorised staff
Big data characteristics
- Volume, variety and velocity
- Veracity matters: bias, duplication and inconsistency
Audit data analytics
- Identify patterns, deviations and anomalies in audit data
- Analyse detailed or full-population data
- Assess data relevance, completeness, accuracy and reliability
Risk assessment
- Disaggregation may reveal trends or exceptional journals
- Results can corroborate or contradict other information
- Revise RoMM assessment as new information emerges
Important limit
- An anomaly is not necessarily a misstatement
Potential gains
- Broader coverage and consistent procedures
- Earlier detection of unusual patterns
- More time for areas requiring judgement
Potential harm
- Incomplete data or wrong criteria mislead analysis
- Configuration mistakes repeat across all records
- Overreliance weakens scepticism and investigation
Manage quality
- Approve, test and maintain tools; train users
- Verify data and configuration for audit purpose
- Investigate exceptions and corroborate results
- Protect confidentiality and retain human review
Evaluating results, AI and ethics
Supported conclusion AI output is information to evaluate
Purpose and extent
- Which risk/assertion and period were covered?
- Were relevant records or data fields excluded?
Data and tool
- Is data relevant, complete, accurate and reliable?
- Was tool correctly designed, configured and operated?
- Were users competent?
Results and response
- Investigate patterns, exceptions and anomalies
- Corroborate explanations and compare other evidence
- Address limitations and perform further procedures
Reliance
- Greater where purpose met, data/tool sound and evidence consistent
- Full-population testing may omit a relevant assertion
Watch for
- Management-controlled or inconsistent data
- Opaque criteria or unexplained operation
- Unexpectedly clean or contradictory results
- Anomalies without corroborated explanations
Respond
- Do not treat unflagged items as free of misstatement
- Challenge assumptions and investigate conflicting evidence
- Use further procedures when evidence is insufficient
Judgement
- Apparent precision of an output is not reliability
Generative and agentic AI
- Generative tools produce content from prompts
- Agentic tools plan, act and adapt across systems
- Outputs may be fabricated, biased or hard to explain
Human oversight
- Use approved systems and protect client information
- Test and monitor in line with autonomy and significance
- Engagement partner retains audit responsibility
Document ATT work
- Purpose, data, parameters, results and conclusions
- Record significant exceptions and resolution
- Explain judgements without retaining every output
Technology characteristics
- Complexity, opacity, autonomy, scale and data dependence
- Consider ability to explain or challenge outputs
Fundamental principles
- Integrity: disclose known limitations
- Objectivity: resist automation bias
- Competence and due care: understand and assess tool
- Confidentiality: control client data
- Professional behaviour: meet applicable requirements
Exam application
- Link development to audit quality and practical response
- Evaluate benefits and harms using the scenario
Want it on paper? Download the PDF, or print this page.