4 Btw, what is an audit?
James Christopher Westland´s book, Audit Analytics - Data Science for the Accounting Profession (Westland 2020), is published in the Use R! series. The Use R! series contains books on R aimed at practitioners of various fields (e.g., epidemiology, econometrics, accounting). More importantly, ‘each book does not repeat basic material’. This is also the case for the Audit Analytics book of Westland. It does not repeat basic material on auditing and accounting. It assumes this knowledge because the book is aimed specifically at practitioners of auditing and accounting. In order to still make sense of the audit language used in the book, this chapter gives a brief overview of the most relevant audit concepts. The material below is inspired by the fantastic open material of Dr. Amanda White.
4.1 Who did it?
Do you know who the best-selling novelist of all time is? According to the website www.agathachristie.com, it’s Agatha Christie. Apparently, her 66 detective novels and 14 short story collections have sold billion of copies in all languages. I don’t know if this statement about the ‘best-selling novelist’ is true, but I do know that I enjoy her detective stories. Most of them start with a crime, then a detective comes to investigate and gather evidence to eventually find the criminal. There is always a wonderful sense of suspense in all her novels - all the way through the novel you wonder ‘who did it?’. Although in the majority of cases, auditing does not contain the same amount of suspense as an Agatha Christie novel, it does have the same premise: an auditor gives an opinion (e.g., who did the crime?) based on evidence. Admittedly, the way the auditor collects evidence for the audit is different than the way a detective collects evidence in a crime.
4.2 The audit process
How does an audit looks like, in broad strokes? I’ve made a diagram for the broad audit process in Figure 4.1 .
We see at the top of the diagram the end product of the audit, the audit opinion that is issued often in an audit report. For example, for Tesla’s financial statements of 2022, a snapshot of the auditor’s opinion, PwC in this case, is shown in figure Figure 4.2 .
If we continue to follow Figure 4.1, in order to reach an opinion as to whether the financial statements of a company are correct (aka., in accordance with accounting standards), the auditor needs to gather evidence. But how do we go about gathering this evidence? Like in a crime story, the detective does not interrogate everybody they know, rather she focuses on a list of suspects. Similarly, the auditor will follow a specific strategy for gathering evidence (e.g., a substantive approach or a controls approach) and this strategy is given by the audit risk model.
The audit risk model says that the risk of making a mistake in the audit (and saying, for example, that the financial statements are correct when actually they are not) is determined by the inherent risk of the company multiplied by the control risk of the company multiplied by the detection risk of the company. Similarly to how, in general, a stunt-double has a more risky profession than an accountant, some companies operate in more risky industries than others - they have more inherent risk (e.g., the pharmaceutical industry can be considered more risky than the professional audit service industry). The control risk of a company refers to how well the ‘umbrella’ of controls put in place by the company can protect the company from having unreliable information. For example, if the company does not take any steps in protecting its data (e.g., puts password controls in place), then anybody can key in data so we cannot trust the data we receive from the company. The detection risk is the risk of not spotting an error when there is one. Whereas the inherent risk and the control risk are sort of ‘given’ by the company environment and the auditor cannot change that, the auditor can do something about the detection risk. These risks work in opposite directions: if the inherent risk and the control risk are low (so things are not so risky), then the auditor can accept a higher detection risk. If a higher detection risk is accepted, then the auditor can undergo a smaller number of substantive procedures and will follow a controls approach of the audit (where he trusts the controls of the company and does less substantive testing). If the inherent risk is high and the control risk is high, then the auditor will have to try to minimize the detection risk. So, the auditor will be cautious and will accept a low detection risk and perform more substantive testing in the attempt to spot any material errors in the financial statements.
The gathering of evidence is done through audit procedures, such as recalculations or analytics procedures. Some of these audit procedures, like analytical procedures, can be used to gather evidence for both audit approaches, the substantive approach and the control approach. The auditor uses professional judgement to decide on the audit procedures to follow. Often, in order to decide on ‘how much to do’ per procedure (e.g., how many sales transactions to look at), sampling approaches are used.
What the diagram does not show is that the auditing process is iterative, flexible and like life, based on trade-offs. The auditor aims to give a correct opinion but she cannot possible check everything that a company did in the last year. As such, the auditor will have to trade-off the need to gather as much evidence as possible with the need to keep the audit process profitable. This is a challenging trade-off and the analytics domain promises to make this trade-off less challenging by allowing the auditor to gather better evidence, faster.
4.3 Analytics in auditing
In this reader, I define audit analytics as the use of data (e.g., client data or external data such as social media data), technology (e.g., robotic process automation) and algorithms (e.g., machine learning algorithms) in the audit process. The same definition would hold if I would use ‘accounting analytics’ instead of ‘audit analytics’; accounting analytics would be the use of data, technology and algorithms in the accounting process where the accounting process can refer to audit or other accounting tasks such as budgeting or valuation. Most of the elements in Figure 4.1 can be affected by analytics (e.g., planning the audit can be done by using technology with minimal audit partner involvement, test of controls can use approaches such as process mining, sampling can be improved with simulations, substantive testing such as analytical procedures can use machine learning). The book Audit Analytics - Data Science for the Accounting Profession (Westland 2020) shows some ways in which analytics (that is, the use of data, technology, and algorithms) can be applied in an audit to allow the auditor to gather better evidence, faster.
An example will hopefully illustrate better how audit analytics can improve the audit process. The famous fraud of Crazy Eddie (here is a reference to the documentary in case you want to watch a classic) was possible because, among other things, the auditor was distracted by Crazy Eddie personnel and thus tricked into writing wrong inventory numbers at the stock taking. But what if we used drones and algorithms to measure inventory like PwC did when in 2019 it completed its first stock count audit using drone technology? Then, the auditor would not depend so much on client information, such in the case of Crazy Eddie, and the audit would become more effective and efficient.
But are analytics approaches sufficient to perform a good audit? Dr. Amanda White uses the analogy of a sonar in a submarine to describe the help that analytics can provide in an audit. Like the sonar of the submarine who uses sound propagation to identify objects in its vicinity, the analytics part of an audit can point us in the right direction but it cannot give us guarantees. So a combination of analytics approaches with professional judgement are always needed in an audit process.