Audit Data Analytics (ADA) is the systematic application of quantitative and qualitative analysis techniques to complete or near-complete audit populations — rather than samples — to identify anomalies, test controls, detect fraud indicators, and generate audit evidence. An IS auditor using ADA extracts structured data from enterprise systems (ERP, databases, access logs), transforms it into an analyzable format, applies statistical and algorithmic techniques, and interprets exceptions as the basis for audit findings. ADA is not data science, machine learning model development, or business intelligence reporting — it is a disciplined audit evidence collection and control-testing methodology that uses computational tools. It is also not a replacement for professional judgment: analytics identifies exceptions that auditors must investigate, interpret, and conclude upon.
Where it stops · what it isn't
- —IS: A structured methodology for testing audit objectives against 100% of a data population using quantitative techniques — Benford's Law, duplicate detection, gap analysis, ratio analysis, outlier detection, and exception reporting.
- —IS: A core component of the IS auditing process used to collect audit evidence, test controls, and support audit conclusions in workpapers.
- —IS: Applicable to structured, machine-readable data from IT systems — ERP transactions, access logs, configuration data, and financial records.
- —IS NOT: General business intelligence or management reporting — ADA is purpose-built to answer specific audit objectives, not to produce operational dashboards.
- —IS NOT: A substitute for auditor judgment — analytics narrows focus to exceptions; the auditor investigates and concludes.
- —IS NOT: Statistical or judgmental sampling — ADA tests 100% of the population, which is a fundamental distinction from sampling methodologies.
- —IS NOT: AI/ML model development — auditors must interpret algorithmic outputs, but CISA does not require building ML models.
- —IS NOT: Directly applicable to unstructured data (email text, images, voice) without preprocessing tools outside standard ADA scope.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFInformation Systems Auditing Process (CISA Domain 1)
REQUIRESAudit Evidence Collection TechniquesRisk-Based Audit Planning
RELATED TOAudit Testing and Sampling MethodologyAudit Reporting and Communication Techniques
ENABLESContinuous Auditing and Monitoring (CAM)Fraud Detection and Investigation
CONSTRAINSData Governance and Data Quality Management