Audit data analytics: from population to audit evidence
Turn a full-population analytic into usable audit evidence by validating data, defining the audit objective, and resolving every exception.
The decision that earns the point
Identify the engagement facts and governing framework
Audit data analytics is a technique for exploring or testing data in support of an audit objective; the output is not automatically sufficient appropriate evidence. The auditor defines the assertion and expected pattern, evaluates the relevance and reliability of the source data and transformation, investigates anomalies, and connects resolved exceptions to the risk assessment and audit conclusion.
Exam use
AUD can test whether an analytic is risk assessment or a substantive response, what makes an electronic population reliable, how a threshold affects exception selection, and what follow-up turns an unusual pattern into evidence rather than an unexplained dashboard result.
Your scratch-paper plan
Solve it in three moves
- 1
State the audit objective before the analytic
Name the account, assertion, population, expected relationship, and consequence of an exception before choosing a visualization or test.
AICPA Guide to Audit Data Analytics - 2
Validate the data path
Evaluate source-system completeness and accuracy, extraction criteria, transformations, reconciliations, and access controls relevant to reliance.
PCAOB AS 1105: Audit Evidence - 3
Resolve anomalies with audit work
Investigate exceptions, obtain corroborating evidence, reconsider risk and thresholds, and document why resolved items support the stated conclusion.
PCAOB AS 2301: The Auditor's Responses to the Risks of Material Misstatement
Worked problem
Work the facts before choosing the answer
For a PCAOB issuer, the auditor extracts all 48,200 revenue entries and flags manual weekend postings above $25,000. The analytic identifies 37 entries, including six credits posted by a senior accountant to dormant customer accounts during the final two days of the year.
CPAPass exam analysis using the stated assumptions
Show the work
The auditor reconciles the extracted total and record count to the general ledger, checks extraction filters and key fields, evaluates relevant system controls, inspects support for the 37 exceptions, confirms selected customer terms, and investigates why dormant accounts received year-end credits.
Rule source: AICPA Guide to Audit Data AnalyticsAnswer
The full-population scan narrows and sharpens testing, but the conclusion comes from validated data plus resolved exceptions. Unsupported credits change the fraud and cutoff risk assessment and require additional procedures rather than an attractive chart.
Rule source: AICPA Guide to Audit Data AnalyticsDo it now
Test the same decision with a fresh question
Start with free AUD practice. Create an account only when you want the 5-day no-card CPAPass trial and continued section practice.
The trap and the repair
Common trap
Calling a full-population test conclusive because it covered 100 percent of records ignores missing fields, flawed extraction logic, weak thresholds, and unresolved exceptions.
Repair
Document the data lineage and reconcile the population before treating the analytic as evidence, then close every material or risk-relevant anomaly.
Authority and scope boundary
The AICPA audit data analytics guide explains the technique. PCAOB AS 1105 and AS 2301 control relevance, reliability, and risk-responsive use in the issuer illustration. Current AU-C 500 and AU-C 330 control those audit-evidence decisions for a nonissuer. BAR data visualization and software selection are outside this AUD owner.
2026 Uniform CPA Examination Blueprints and AICPA Guide to Audit Data Analytics were reviewed on 2026-08-14. Check a newer authority when the effective date or facts change.
Population-to-evidence flow
Coverage is only one part of analytic quality
An analytic becomes useful audit evidence only when the population, logic, exception handling, and final conclusion can each be defended.
| Analytic stage | Control question | Audit output | Authority |
|---|---|---|---|
| Population | Does the extract include the complete in-scope period, entities, fields, and record types? | Reconciled record count and value tied to the ledger | PCAOB AS 1105: Audit Evidence |
| Logic | Does the rule actually detect the assertion-level condition and avoid an arbitrary threshold? | Documented query, field definitions, expectation, and sensitivity | AICPA Guide to Audit Data Analytics |
| Exceptions | Were unusual records traced to support and evaluated for risk implications? | Resolved exceptions, expanded procedures, or a revised risk assessment | PCAOB AS 2301: The Auditor's Responses to the Risks of Material Misstatement |
| Conclusion | Does the combined evidence support the specific assertion rather than a general claim that data was analyzed? | Assertion-level workpaper conclusion with limitations | PCAOB AS 1105: Audit Evidence |
After a miss
Repair an analytics-evidence miss
- 1
Write the account, assertion, complete population, expected pattern, and exception rule before reviewing the analytic result.
- 2
Rework the revenue scan after learning that voided entries were excluded from the extraction and explain how the reliability conclusion changes.
- 3
Answer a fresh AUD analytics question and record one population test, one anomaly procedure, and one evidence limitation.
Your exam workflow
- Step 1Identify the requirementName the account, assertion, population, expected relationship, and consequence of an exception before choosing a visualization or test.AICPA Guide to Audit Data Analytics
- Step 2Classify the factsEvaluate source-system completeness and accuracy, extraction criteria, transformations, reconciliations, and access controls relevant to reliance.PCAOB AS 1105: Audit Evidence
- Step 3Apply the authorityInvestigate exceptions, obtain corroborating evidence, reconsider risk and thresholds, and document why resolved items support the stated conclusion.PCAOB AS 2301: The Auditor's Responses to the Risks of Material Misstatement
- Step 4Check the outputThe full-population scan narrows and sharpens testing, but the conclusion comes from validated data plus resolved exceptions. Unsupported credits change the fraud and cutoff risk assessment and require additional procedures rather than an attractive chart.AICPA Guide to Audit Data Analytics
Keep the next step narrow
Quick questions
What is the key rule?
Audit data analytics is a technique for exploring or testing data in support of an audit objective; the output is not automatically sufficient appropriate evidence. The auditor defines the assertion and expected pattern, evaluates the relevance and reliability of the source data and transformation, investigates anomalies, and connects resolved exceptions to the risk assessment and audit conclusion.
How can this topic be tested on the CPA Exam?
AUD can test whether an analytic is risk assessment or a substantive response, what makes an electronic population reliable, how a threshold affects exception selection, and what follow-up turns an unusual pattern into evidence rather than an unexplained dashboard result.
What mistake most often changes the result?
Calling a full-population test conclusive because it covered 100 percent of records ignores missing fields, flawed extraction logic, weak thresholds, and unresolved exceptions. Document the data lineage and reconcile the population before treating the analytic as evidence, then close every material or risk-relevant anomaly.
Where should I practice the decision?
After the worked example, open the AUD free-practice link and work a fresh question that tests the same decision. If the miss depends on Audit evidence quality, review that handoff before trying another set.