Choosing Analytical Techniques for Engagement Objectives (CIA Part 2)
Overview
Choosing analytical techniques is a core skill tested in CIA Part 2 (Practice of Internal Auditing), within the domain Information Gathering, Analysis and Evaluation. Internal auditors must decide which analytical approach will produce sufficient, reliable, relevant and useful evidence to meet a specific engagement objective. The technique has to fit the objective, the nature of the data, the risk involved and the cost of doing the work.
Why It Is Important
1. Conformance with the Standards: The IIA's Global Internal Audit Standards (formerly Standards 2310 and 2320) require auditors to identify, analyze and evaluate information that is sufficient, reliable, relevant and useful. Choosing the wrong technique produces weak evidence and unsupported conclusions.
2. Efficiency: The right technique focuses audit effort on high-risk areas and avoids wasted time.
3. Effectiveness: A technique matched to the objective is more likely to detect misstatements, control failures, fraud indicators or performance problems.
4. Credibility: Management and the board rely on conclusions drawn from sound analysis.
5. Risk-based auditing: Analytical procedures help identify unusual relationships that point to risk, which guides how the engagement is planned and scoped.
What It Is
Analytical techniques (also called analytical procedures) are methods of evaluating information. The auditor compares information with expectations that the auditor has developed or that come from outside sources. The goal is to identify consistencies, differences, unusual relationships and trends. They include both quantitative and qualitative methods.
Common Analytical Techniques
1. Ratio analysis: Compares relationships between financial or operating data. Examples are the current ratio, inventory turnover, gross margin and days sales outstanding. It is best for assessing financial health, efficiency and liquidity, and for spotting anomalies.
2. Trend analysis: Compares data over several periods to find patterns or departures from the pattern. It is useful in planning to spot unusual changes, for example a sudden rise in expenses.
3. Reasonableness tests: Build an expectation from operational or nonfinancial data and compare it with the recorded amount. For example, payroll can be estimated as headcount x average wage, or interest expense as average debt x rate. These tests are strong when the relationships are stable and predictable.
4. Regression analysis: A statistical technique that models how one variable depends on one or more others. Examples include sales versus advertising spend, or utility cost versus production volume. It gives the most precise expectations, but it needs reliable data and statistical skill.
5. Variance analysis: Compares actual results with budgets, standards or forecasts. It suits operational and performance audits.
6. Benchmarking: Compares processes or results with industry peers, best practices or other units in the organization. It suits performance, efficiency and value-for-money objectives.
7. Data analytics / CAATs: Use software to test entire populations (100% testing). Examples include duplicate payment detection, gap testing, Benford's Law digit analysis, joining vendor and employee master files, and stratification. These are best for fraud detection, high-volume transactions and continuous auditing.
8. Process mapping and flowcharting: Qualitative techniques to understand a process, identify control points and find inefficiencies or segregation-of-duties gaps.
9. Root cause analysis: Tools such as the 5 Whys and fishbone (Ishikawa) diagrams find the underlying cause of an issue. They are used when the objective is to recommend lasting corrective action.
10. Statistical and nonstatistical sampling: Attribute sampling tests control deviation rates. Variables sampling, including monetary unit sampling, estimates monetary amounts. Discovery sampling is used when even one occurrence matters, such as fraud.
11. Pareto analysis: Applies the 80/20 rule to identify the few causes that produce most problems.
12. Data mining and pattern recognition: Uncovers hidden relationships and anomalies in large data sets.
How It Works: The Selection Process
Step 1: Define the engagement objective. Ask what you are trying to conclude. Typical objectives are:
- Assessing whether controls operate effectively (compliance/controls testing)
- Verifying that account balances are reasonable (financial assurance)
- Evaluating efficiency and economy (operational/performance)
- Detecting fraud or irregularities
- Identifying causes of a problem (consulting/advisory)
Step 2: Consider the nature and source of the data.
- Is the data financial or nonfinancial?
- Is it structured (databases) or unstructured (documents, emails)?
- Is it internal or external? External, independent sources are generally more reliable.
- Is it reliable and complete? Analytical procedures are only as good as the underlying data.
Step 3: Evaluate how predictable the relationships are. Stable, predictable relationships, such as rent or interest expense, support precise analytical procedures. Volatile or discretionary items need more detailed substantive testing.
Step 4: Consider the required level of assurance and the risk.
- High-risk areas need more precise techniques, such as regression or full-population analytics, or direct detailed testing.
- Low-risk areas may be covered by simpler trend or ratio analysis.
Step 5: Consider the engagement phase.
- Planning: Use trend, ratio and benchmarking techniques to find risk areas and set the scope.
- Fieldwork: Use reasonableness tests, regression, sampling and data analytics as substantive or control evidence.
- Wrap-up/Reporting: Use overall analytical review to confirm that conclusions are consistent.
Step 6: Weigh costs, resources and skills. Sophisticated techniques need technical skills, tools and time. Under the Standards, the CAE must make sure the team has the competencies required. Where they are lacking, the CAE may use external service providers.
Step 7: Investigate significant differences. When the analysis shows unexpected results, the auditor must investigate. Typical steps are inquiring of management and corroborating the explanation with other evidence. Unexplained differences may indicate errors, fraud or control weaknesses and must be documented and reported as appropriate.
Matching Objectives to Techniques (Quick Reference)
- Detect duplicate payments or ghost employees: Data analytics/CAATs (duplicate tests, file matching)
- Identify risk areas during planning: Trend and ratio analysis
- Estimate the expected value of a stable account: Reasonableness test
- Model cost behavior with multiple drivers: Regression analysis
- Evaluate performance against peers: Benchmarking
- Evaluate performance against plans: Variance analysis
- Test control compliance rate: Attribute sampling
- Estimate misstatement in dollars: Variables or monetary unit sampling
- Find at least one fraudulent instance: Discovery sampling or 100% data analytics
- Test fabricated numbers: Benford's Law digit analysis
- Find the cause of recurring defects: Root cause analysis, fishbone diagram, Pareto
- Understand a process and its controls: Flowcharting/process mapping
- Detect missing documents in a numbered sequence: Gap testing
Limitations to Remember
- Analytical procedures provide indirect evidence. They indicate where to look but rarely prove a conclusion on their own.
- Their effectiveness depends on data reliability and the precision of the expectation.
- Management can manipulate data to make relationships look normal.
- Aggregated data can hide offsetting errors. Disaggregating by location, month or product improves precision.
Exam Tips: Answering Questions on Choosing Analytical Techniques for Engagement Objectives
1. Identify the objective first. Read the stem carefully and ask what the auditor is trying to accomplish. The correct answer is the technique that most directly and efficiently achieves that objective.
2. Look for keywords.
- 'Over time' or 'prior periods' points to trend analysis.
- 'Relationship between variables' or 'predict' points to regression.
- 'Peers' or 'best practice' points to benchmarking.
- 'Entire population' or 'large volume' points to data analytics/CAATs.
- 'Underlying cause' points to root cause analysis.
- 'Rate of deviation' points to attribute sampling.
3. Prefer the most precise and efficient option. If a question asks for the most effective technique for detecting duplicate invoices, 100% computerized matching beats manual sampling.
4. Remember the precision hierarchy. Regression is generally more precise than reasonableness tests, which are more precise than ratio and trend analysis. Choose higher precision when the risk is high.
5. Recognize the planning-stage answer. Questions about identifying areas of risk or focusing the audit usually point to overall analytical procedures, such as ratios and trends.
6. Know what to do with unexpected results. The best next step is usually to investigate: inquire of management and corroborate the response with evidence. Do not accept explanations without support, and do not immediately conclude fraud.
7. Watch for data reliability clues. If the data is unreliable or from an uncontrolled source, analytical procedures are less appropriate. The better answer may be to test the data's integrity first or use detailed testing.
8. Distinguish qualitative from quantitative techniques. Process understanding questions favor flowcharts or narratives. Measurement questions favor quantitative tools.
9. Eliminate distractors. Wrong answers are often valid techniques used for the wrong purpose, such as benchmarking to detect fraud or Benford's Law to evaluate efficiency.
10. Tie your choice back to the Standards. When in doubt, pick the answer that produces sufficient, reliable, relevant and useful information while considering cost-benefit.
11. Remember that analytics complement other evidence. If a choice suggests relying solely on analytical procedures for a high-risk area, be cautious. Detailed tests are often still needed.
12. Practice scenario questions. CIA questions are frequently situational. Practice translating each scenario into 'objective, data type, risk, best technique'.
Sample Question
An internal auditor wants to determine whether the reported utility expense for a manufacturing plant is reasonable, given that the expense varies with machine hours and outside temperature. Which technique provides the most precise expectation?
A. Trend analysis
B. Ratio analysis
C. Multiple regression analysis
D. Benchmarking
Answer: C. Multiple regression models the relationship between the expense and several independent variables, so it gives the most precise expectation.
Key Takeaway
Always start with the engagement objective. Then consider the data, risk, predictability, phase and resources. Select the technique that delivers the strongest evidence most efficiently. On the exam, match keywords to techniques, favor precision for high-risk areas, and remember that unexpected results must be investigated and corroborated.
