4.7 Remote Auditing Techniques & Data Analytics Software

Remote Auditing Techniques & Data Analytics Software

ICAB Syllabus 2023 updated learning outcome 3(b) to require candidates to "identify the different methods of obtaining evidence, including remote auditing techniques, from the use of tests of control, substantive procedures, including analytical procedures and data analytics software." Both technologies are now explicitly examinable.

1. Remote auditing techniques

Remote auditing means performing audit procedures without the engagement team being physically present at the client's premises. The techniques include:

Advantages

• Coverage and cost. Multiple locations can be reached in a day — valuable for a Bangladeshi group with factories in Gazipur, Narayanganj and Chattogram.
• Timeliness. Evidence can be gathered continuously rather than in a fieldwork window.
• Access during disruption. Political disruption, flooding or public health restrictions do not halt the audit.
• Wider population access. Direct system access allows full-population extraction rather than manual sampling.

Reliability limitations

Remote work does not change the reliability hierarchy — it changes how easily you climb it. The key weaknesses:

• Authenticity of documents. A scanned copy is not an original. Alteration is easier to conceal and harder to detect than with a physical document. Photocopies and scans sit low in the reliability hierarchy for exactly this reason.
• Loss of direct auditor knowledge. Evidence obtained by the auditor directly is more reliable than evidence obtained indirectly. Watching a camera someone else is pointing is not the same as looking.
• Client control of the lens. In a remote inventory observation, the client chooses what the camera sees and in what order. The auditor must direct the count, select the items to be test-counted and require continuous unedited coverage.
• Loss of incidental observation. Physical attendance produces evidence nobody planned for: disorganised stores, obsolete stock in a corner, staff sharing passwords, an argument about an override. Remote work loses this.
• Impaired inquiry. Body language, hesitation and the willingness of junior staff to speak candidly all suffer on a monitored video call.
• Connectivity and IT risk. Interruptions break continuity, and granting the auditor system access itself raises confidentiality and access-control questions.

Physical presence remains necessary for procedures where the physical world is the subject matter: attendance at a material inventory count, counting cash, inspecting title to a physical asset, and observing whether segregation of duties actually operates on the floor.

2. Data analytics software

Audit data analytics is the extraction, validation and interrogation of the client's transaction data using software, to identify patterns, exceptions and relationships that inform risk assessment or provide substantive evidence.

The transformative feature is population coverage. Sampling tests a subset and accepts sampling risk. Analytics can test 100% of a population for a defined characteristic, eliminating sampling risk for that specific test.

What analytics is used for

Limitations and pitfalls

1. Garbage in, garbage out. Analytics conclusions are only as good as the extract. The auditor must establish the completeness and accuracy of the data extracted — for example by reconciling extracted totals and record counts back to the general ledger control account — before interpreting any output.
2. Exceptions are not misstatements. A routine that returns 4,000 exceptions has not found 4,000 errors. Each exception must be evaluated, and a poorly designed filter produces noise that consumes the time it was meant to save.
3. It does not test everything. Testing 100% of a population for one characteristic is not testing the population for all assertions. A completeness test on invoice sequences says nothing about valuation.
4. Internally generated data. Data extracted from the client's system is internal evidence. Its reliability depends on the general IT controls over the system that produced it — the same dependency that applies to automated application controls.
5. Competence. The engagement team needs the skills to design the routine and interpret the results, or must involve a specialist. Running a tool you do not understand is not evidence.

3. Where these methods sit in the evidence hierarchy

Technology does not create a new tier of reliability. Apply the ordinary rules:

• An electronic bank confirmation received directly through a secure platform is external, direct and documentary — highly reliable.
• A scan of a supplier invoice uploaded by the client is documentary but is a copy of an external document supplied by the entity — less reliable than the original received directly.
• Analytics output over client data is internally generated, so its reliability rests on general IT controls and on the auditor's verification of the extract.
• A remote video observation directed by the auditor is closer to direct auditor knowledge than a client-prepared count sheet, but weaker than physical attendance.

4. Exam approach

When a scenario proposes a remote or analytics procedure, answer in three parts: what evidence the procedure yields, which assertion it addresses, and what limitation or additional step is required to make it reliable. That structure earns marks in a way that praising or condemning the technology does not.