Digital Auditing & Assurance: formula sheet

Key formulas

Core principle

Digital tool + SA requirements + professional judgment = reliable audit conclusion

Technology supports the audit. It never replaces the auditor's responsibility under the SAs.

Traditional vs digital audit

Sample-based, after year-end, paper records → Population-based, continuous or periodic, electronic data

Use this as the comparison frame. Mention that the objective of the audit stays the same.

Two roles of technology

Technology as audit tool + Technology as audit subject

Always address both: tools used by the auditor and IT systems of the entity.

Evidence rule

Electronic information used as evidence must be relevant and reliable (accurate, complete)

Test the source data and the system producing it before relying on analytics output.

Four types of analytics

Descriptive (what) → Diagnostic (why) → Predictive (what next) → Prescriptive (what to do)

Use this order in answers. Give one audit example for each type.

Stages of an analytics-driven audit

Objective and planning → Data acquisition → Data validation (completeness, accuracy) → Analysis → Investigate exceptions → Conclude and document

Wording of stages varies by source. Keep the logic: plan, get data, validate, analyse, follow up, document.

Reliability rule for data

Reliability of analytics result ≤ reliability of source data and extraction

Link to information produced by the entity: you must test its accuracy and completeness before relying on it.

Exceptions are not misstatements

Exception flagged → investigate → conclude (misstatement or not)

A flagged item is only a lead. Evaluate it before treating it as an error.

Audit risk model

Audit risk = Risk of material misstatement × Detection risk

Risk of material misstatement = inherent risk combined with control risk. Audit risk is set at an acceptably low level. Technology can change the assessed inherent and control risk, and detection risk is then set in response to the assessed risk of material misstatement. Technology does not change detection risk by itself.

RPA vs ML

RPA = rule-based, repeats a script; ML = data-based, learns patterns

Use this one-line contrast in any comparison question.

Answer structure for technology questions

Technology → Risk → Effect on RMM → Audit response → Benefit

A memory chain to keep the answer complete and in order.

Core relationship

Reliable ITGCs → application controls can be relied on consistently → possible reduction in substantive testing

If ITGCs are ineffective, application controls cannot be assumed to operate consistently. Consider other evidence or more substantive work.

Categories of ITGCs

Access security + Program change management + Program development/acquisition + IT operations

Use this as a checklist when an answer asks you to list or evaluate general controls.

Categories of application controls

Input controls + Processing controls + Output controls (+ master data controls)

Each aims at completeness, accuracy and validity of transactions.

Risk assessment link

Understand IT environment → identify IT risks → identify related controls → assess RMM → design responses

This is the SA 315 flow for IT. Always tie a risk to an assertion and a response.

Testing automated controls

Test once (design and implementation) + test relevant ITGCs = evidence for the period

Applies when the control is truly automated and ITGCs over change and access are effective. Exceptions arise if the program has changed.

CAAT categories

CAATs = Audit software (tests data) + Test data / ITF / Parallel simulation (tests programs and controls)

Use this split to classify any tool in a question.

Test data vs ITF

Test data: dummy transactions in a separate controlled run | ITF: dummy entity processed in live run with real data

ITF risks contaminating live records, so reversal or exclusion of test entries is essential.

Continuous auditing vs continuous monitoring

Continuous auditing = auditor's frequent or real-time testing | Continuous monitoring = management's ongoing control tracking

Do not interchange the owner of each.

Reliance on data

Reliability of tool output depends on completeness and accuracy of input data and on the logic of the tool

Reconcile extracted data to the ledger or trial balance before testing.

Documentation content

Source + Extraction method + Tests and parameters + Results and exceptions + Follow-up + Conclusion + Who/when

This is the checklist for documenting digital evidence.

Quick revision

• Digital audit means using technology and data to perform audit work and to audit technology-driven entities.
• IT risk is assessed as part of understanding the entity and its internal control.
• General IT controls support the continued working of applications; examples are access, change management and operations controls.
• Application controls work within a specific process, such as input validation or automated calculations.
• Weak general controls reduce the reliance you can place on automated controls.
• Data analytics can test whole populations, not only samples, and highlight unusual items.
• Analytics output is still audit evidence and must be checked for completeness and reliability of the data used.
• Each emerging technology brings a new risk, so the audit response must change accordingly.
• Cloud and outsourced services raise questions about control over the service provider.
• Tools do not replace judgment; the auditor remains responsible for conclusions.
• Document the data source, procedure performed, results and conclusion for every digital procedure.
• In case questions, link fact, risk, control or procedure, and conclusion.

Common mistakes

• Saying digital audit has different objectives from a traditional audit. Fix: State that the objective and the SAs remain the same. Only the method, evidence form and risks change.
• Treating analytics output as automatically reliable evidence. Fix: Say that you must check the completeness and accuracy of the source data and the logic of the tool before relying on it.
• Treating analytics as a replacement for audit judgment or for audit evidence standards. Fix: State that analytics is a method of performing procedures. The auditor still evaluates evidence and exercises professional skepticism.
• Skipping data validation. Fix: Always say you will check completeness and accuracy of the data and the extraction before relying on results.
• Saying RPA and machine learning are the same thing. Fix: Say RPA follows fixed rules and does not learn. ML learns from data and its outputs can change as it learns.
• Writing that technology reduces the auditor's responsibility or removes the need for judgment. Fix: State that responsibility for the opinion stays with the auditor. Outputs from AI tools or system reports must be validated before they are used as evidence.
• Treating general controls and application controls as the same thing. Fix: Ask: does the control protect the whole IT environment (general) or one transaction type inside one application (application)? Access to the server is general. A mandatory field on an invoice screen is application.
• Relying on an automated control after testing it once, without looking at ITGCs. Fix: State that consistency holds only if the program is not changed and access is controlled. Test change management and access controls, or retest.
• Treating test data and ITF as the same technique. Fix: Remember that test data runs in a separate controlled run, while ITF embeds a dummy entity in the live system and runs with real transactions.
• Assuming CAAT output is reliable without checking the input data. Fix: First reconcile extracted data to the trial balance and check completeness and accuracy, and say so in your answer.

Exam tips

• Open every answer with what changed in the entity's technology, then link it to risk. Examiners reward case linkage.
• In MCQs, options that say technology replaces judgment, the SAs or auditor responsibility are almost always wrong.
• Keep the traditional vs digital comparison to four or five crisp points: sampling, timing, data form, tools, risks.
• Always mention reliability of electronic evidence and documentation of the work done.
• For written answers, use the provision-facts-conclusion form: principle, case facts, conclusion.
• In case scenarios, first spot the phase of audit and the assertion, then name the technique. Marks follow this logic.
• Always mention data completeness and accuracy before analysis. Examiners look for it.
• For theory questions, give each type of analytics with a one-line audit example.