Internal audit functions today operate in an environment defined by rapid technological advancement, increased business complexity, and growing expectations from stakeholders. Traditional audit techniques, largely manual and sample-based, are no longer sufficient to provide the depth, speed, and assurance required. Data analytics has therefore emerged as a powerful enabler, allowing internal auditors to generate deeper insights, enhance risk coverage, and transition from a retrospective approach to a forward-looking, advisory-driven role.
The effective use of data analytics in internal audits revolves around four key analytical techniques: descriptive, diagnostic, predictive, and prescriptive analytics. Each technique offers a unique perspective and contributes to building a comprehensive, end-to-end audit strategy. When used together, they significantly strengthen both assurance and advisory outcomes.
Descriptive Analytics — “What Happened?”
Descriptive analytics summarises historical data to highlight trends, patterns, anomalies, and key performance metrics. It forms the foundation of audit analytics because it enables auditors to shift from sample testing to full-population analysis, thereby improving assurance quality and reducing the risk of oversight.
Typical descriptive tools include dashboards, statistical summaries, rule-based filters, and trend charts. These help auditors quickly understand the state of a process and identify unusual activities or exceptions.
Use Case: Procurement Process Review
During a procurement audit, descriptive analytics is used to analyse all purchase transactions for the past year. The analysis reveals patterns such as:
- frequent purchases from a single vendor,
- multiple invoices just below approval thresholds,
- high-value purchases processed outside business hours.
These findings guide auditors toward high-risk areas that require deeper scrutiny, enabling a more focused and efficient audit.
Diagnostic Analytics — “Why Did It Happen?”
Once descriptive analytics highlights an anomaly, diagnostic analytics helps determine the underlying reasons. This technique involves drilling down into data, performing root-cause analysis, and comparing performance across segments, time periods, or control expectations.
Diagnostic analytics is crucial for identifying systemic issues rather than treating symptoms. It enables auditors to connect data irregularities with control breakdowns, behavioural patterns, or policy gaps.
Use Case: Increase in Employee Reimbursement Claims
An audit reveals an unexpected spike in employee reimbursements during one quarter. By applying diagnostic analytics:
- expenses are segmented by department, employee, and category,
- approval workflows are reviewed,
- spikes are compared across regions.
The analysis uncovers that claims surged in one region due to weak approval oversight and inconsistent application of reimbursement policies. This evidence-based insight allows auditors to recommend targeted corrective actions.
Predictive Analytics — “What Is Likely to Happen Next?”
Predictive analytics uses historical data, statistical models, and machine learning algorithms to forecast future outcomes. For internal audit, this means proactively identifying emerging risks, prioritising audit areas, and detecting fraud indicators before significant losses occur.
Predictive analytics helps the audit function shift from a reactive posture to a proactive one, anticipating issues rather than simply reporting them after they arise.
Use Case: Predicting Fraud-Prone Transactions
Using historical fraud cases, auditors identify key attributes associated with fraudulent activity—round-dollar transactions, last-minute approvals, vendor master changes, or unusual timing. A predictive model is built to score current transactions for fraud likelihood.
Transactions with high-risk scores are flagged for immediate investigation, enabling early detection and prevention of potential fraud.
Prescriptive Analytics — “What Should Be Done?”
Prescriptive analytics represents the most advanced stage of audit analytics. It not only predicts what may happen but also recommends the most effective course of action. This technique uses optimization models, business rules, and scenario simulations to provide auditors and management with data-backed recommendations.
Prescriptive analytics expands the internal audit function’s advisory role by helping improve operations, reduce costs, enhance compliance, and optimise processes.
Use Case: Working Capital Improvement
During a working-capital review, prescriptive analytics evaluates payment behaviour, vendor terms, discount utilisation, and ageing patterns. Based on this data, the analytics model recommends:
- renegotiating terms with specific vendors,
- adopting early-payment discounts where financially advantageous,
- adjusting approval workflows to prevent invoice delays.
These recommendations help management make informed decisions that strengthen liquidity while maintaining business continuity.
Integrating Analytics into the Internal Audit Lifecycle
To fully benefit from these analytical techniques, internal audit functions should integrate analytics throughout the audit lifecycle:
- Risk Assessment: Predictive analytics highlights high-risk areas for audit planning.
- Fieldwork: Descriptive & diagnostic analytics enable detailed testing & deeper insights.
- Reporting: Visual dashboards present findings clearly for stakeholders.
- Follow-up: Prescriptive insights guide corrective actions & track improvements over time.
This integration results in faster audits, improved coverage, stronger fraud detection, and enhanced credibility with boards and management.
Conclusion
Data analytics has become indispensable for modern internal audits. By effectively applying descriptive, diagnostic, predictive, and prescriptive analytics, auditors can move beyond traditional assurance and deliver meaningful, forward-looking value. Each technique serves a distinct purpose:- summarising what happened, understanding why it happened, predicting what could happen, and recommending what should be done. Together, they enable internal audit functions to operate with greater accuracy, relevance, and strategic impact.
Disclaimer: The views expressed are solely those of the author and do not represent those of the publishing organization
About the author:
Amit Sharma is the Vice President and Head of Audit – APAC at EXL, with over 24 years of experience in internal audits, risk management and compliance. As part of his commitment of giving back to the auditing profession, he also serves on the IIA India Delhi Branch Board of Governors and is the Chairperson of the Publications & Research committee of IIA India Delhi Branch.