Audit data analytics is the use of software to examine all of a company's transactions, or very large slices of them, so the auditor can spot unusual items and decide where to focus testing. For a business under audit, it means requests for full ledger and subledger exports instead of a few photocopied invoices, and follow-up questions on the specific entries the software flags.
The auditor's judgment and the familiar audit steps stay in place, while the data you hand over and the transactions that draw questions change. Recent auditing standards now say more about how auditors should use these tools, which matters for both public and private companies heading into 2026 year-end audits.
In an older paper-based audit, the auditor tested a sample of invoices or payments and drew conclusions about the rest. With audit data analytics, the auditor usually loads your general ledger, accounts payable, accounts receivable, payroll or sales data into an analysis tool and runs routines across the whole file first.
Typical routines look for duplicate invoice numbers, payments made to the same vendor for the same amount within a few days, entries posted on weekends or by unusual users, gaps in numbering sequences, and journal entries with round amounts or vague descriptions. The results guide where sampling and detailed testing happen. Transactions that fall outside normal patterns get more attention, and well-behaved populations may need less detailed work.
Sampling still exists, and the analytics results now shape which items get selected. If you want a broader view of how the same techniques work inside a finance team, our guide on data analytics in accounting covers internal reporting uses.
Artificial intelligence tools sit on top of many of these platforms. They are a related topic with their own risks, covered in our practical guide to AI in audit and assurance. This article focuses on the data side that every client experiences.
Two sets of standards apply, depending on who you are. Audits of public companies follow PCAOB standards. Audits of private companies and nonprofits follow AICPA standards, often called generally accepted auditing standards. Our explainer on GAAS standards covers that framework in more depth.
The AICPA Auditing Standards Board issued SAS No. 142, Audit Evidence, which took effect for audits of financial statements for periods ending on or after December 15, 2022. In announcing it, the AICPA's chief auditor said the standard "recognizes the use of automated tools and techniques such as audit data analytics, AI, and remote observation tools to obtain audit evidence" (Journal of Accountancy). The same report notes the premise that the auditor should evaluate information used as evidence regardless of where it came from. In practice, a report your system produces is still checked for accuracy and completeness before the auditor relies on it.
SAS No. 145, on risk assessment, took effect for audits of periods ending on or after December 15, 2023. It includes "extensive guidance regarding the use of information technology and the consideration of general IT controls" (Journal of Accountancy). That is why auditors now ask more questions about who can change data in your accounting system and how user access is approved.
The PCAOB adopted amendments to AS 1105, Audit Evidence, and AS 2301, The Auditor's Responses to the Risks of Material Misstatement, that address audit procedures involving technology-assisted analysis of information in electronic form. According to the SEC order approving them, the amendments "specify auditor responsibilities when identifying items that require further investigation when performing tests of details" and "emphasize the importance of controls over information technology." They "will be effective for audits of financial statements for fiscal years beginning on or after December 15, 2025" (SEC Release No. 34-100774). For a calendar-year public company, that means the audit of fiscal 2026 is the first one covered.
The amendments also address the reliability of external information that the company itself provides to the auditor, such as a bank statement file you download and pass along. Auditors may ask how that file was obtained and whether it can be traced back to the source.
Confirmations used to mean paper letters mailed to banks and customers. Many audit firms now use secure electronic confirmation platforms that connect directly with banks and some large customers.
For public company audits, the PCAOB replaced its confirmation standard with a new AS 2310, The Auditor's Use of Confirmation. The SEC order approving it says the requirements apply to "the use of email or an intermediary to facilitate direct electronic transmission of confirmation requests and responses," add a requirement that the auditor perform confirmation procedures for cash held by third parties, and state that the auditor should control both the sending of requests and the receipt of responses. The new standard is "effective for all audits of financial statements for fiscal years ending on or after June 15, 2025" (SEC Release No. 34-99060).
For you, this usually means fewer lost letters and faster answers. You may still need to authorize your bank to respond through the platform. Auditors control the process themselves, so sending your own bank confirmations to the auditor is not a substitute.
The figures below are illustrative. Suppose a distribution company has 18,400 vendor invoices for the year, totaling $9,214,600. A traditional approach might test a sample of 60 invoices, which is about 0.33% of the items. With audit data analytics, the auditor runs routines over all 18,400 first.
| Analytics routine | Items flagged | Amount flagged | Share of invoices | Share of dollars |
|---|---|---|---|---|
| Same vendor, same amount, invoice dates within 7 days | 37 | $62,310 | 0.20% | 0.68% |
| Invoice number reused by the same vendor | 6 | $14,880 | 0.03% | 0.16% |
| Posted on a weekend or holiday | 112 | $241,750 | 0.61% | 2.62% |
| Vendor master record changed within 30 days of payment | 9 | $88,420 | 0.05% | 0.96% |
| Round-dollar amounts of $10,000 or more | 14 | $210,000 | 0.08% | 2.28% |
Before removing items caught by more than one routine, the tests flag 178 invoices worth $617,360, or 6.70% of total spend. Most will have ordinary explanations. Weekend postings may come from a scheduled batch import, and round amounts may be retainer payments. The auditor will ask you to explain the flagged items and provide support for some of them. The six reused invoice numbers and the nine vendor record changes are the ones most likely to need documents, because they are classic signs of duplicate payments or a changed bank account. Our article on materiality and risk in audits explains how auditors decide which amounts matter.
The practical lesson is that an auditor using analytics can review every invoice. Items that a small sample would have missed now generate questions, so cleaning up known duplicates and documenting unusual payments before fieldwork saves time.
Because auditors rely on your data files, the format you provide matters as much as the numbers.
Export full populations. Provide complete general ledger detail and subledger reports for the full period, with opening and closing balances that tie to the trial balance. Partial exports lead to repeat requests.
Use consistent fields. Keep one date format throughout, with net amount and tax in separate columns. Vendor and customer IDs should stay stable. A vendor entered under three spellings will look like three vendors, or like a duplicate-payment risk.
Send native files. Screenshots and scanned PDFs of reports that exist digitally slow the work down. CSV or Excel exports straight from the system are usually preferred.
Agree formats early. Ask your audit team which reports and file layouts they want, especially if you changed accounting software during the year or use a less common system. Our PBC request list for first-time audits gives a 30-day plan you can adapt.
Document how reports are produced. Since auditors now check the reliability of company-produced information, note which report or query created each file and the parameters used.
If this is your first audit, start with our guide to preparing for your first external audit, then come back to the data steps here.
Some audit teams ask for direct read access to your accounting platform instead of exports. That can speed things up, though you should not feel pressured to grant administrator rights.
The NIST security glossary defines least privilege as the principle that a system "should restrict the access privileges of users (or processes acting on behalf of users) to the minimum necessary to accomplish assigned tasks" (NIST CSRC). Applied to an audit, that means a dedicated audit user with read-only rights, limited to the modules and periods under audit, switched off when fieldwork ends. Confirm how the audit firm stores files, and use its secure portal rather than email attachments for payroll and bank data.
Access rules feed back into the audit itself. Since auditors now look harder at IT general controls, weak user access management in your own system can lead to more testing. Our guide to Sox-lite internal controls for scale-ups covers practical access and approval controls to put in place before an audit.
The routines auditors run at year-end can also run monthly inside your business. You do not need an audit platform to start. Built-in reports in most accounting systems, or a spreadsheet with filters and pivot tables, can catch duplicate payments and pricing that drifts from the price list.
Running these checks before the auditor arrives means fewer surprises and fewer adjusting entries. It also addresses several issues listed in our article on common audit issues for small businesses, such as unreconciled accounts and unsupported journal entries.
If you are deciding whether you need a full audit at all, our comparison of financial statement audit vs review vs compilation sets out what each engagement covers.
What is audit data analytics in simple terms? It is the auditor's use of software to analyze complete sets of your accounting data, such as every invoice or journal entry for the year, to find unusual items. The results help the auditor decide which transactions to examine in detail.
Does audit data analytics mean auditors no longer use samples? No. Auditors still sample and perform detailed tests. Analytics run across the full population usually guide which items get selected and which areas need more work.
Which standards cover audit data analytics for private companies? Private company audits follow AICPA standards. SAS No. 142 on audit evidence, effective for periods ending on or after December 15, 2022, recognizes automated tools such as audit data analytics, and SAS No. 145 added guidance on IT and general IT controls.
What changed for public company audits in 2026? PCAOB amendments on technology-assisted analysis apply to audits of fiscal years beginning on or after December 15, 2025. They clarify how auditors investigate items flagged by tests of details and how auditors evaluate external information that the company itself provides, such as downloaded bank data.
Should I give my auditor direct access to my accounting system? You can, but limit it to a read-only audit user covering only the modules and periods being audited, and disable it once fieldwork ends. Exports in an agreed format are a reasonable alternative.
Madras Accountancy supports US businesses and CPA firms with bookkeeping and audit preparation, including organizing ledger exports and supporting documents so they are ready for audit data analytics. To discuss your next audit, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
