Data Analytics Is Not the Same as Audit Judgment

A duplicate-invoice alert can be a good starting point. It cannot, by itself, tell an auditor that the business paid twice or that fraud occurred.

Consider an original fictional restaurant group. An analyst compares supplier, invoice number and amount in an accounts-payable extract. Two rows match: supplier S-014, invoice INV-204, and IDR 12,000,000. The query returns a candidate pair.

What the result actually says

The selected fields matched under the chosen rule. That statement depends on how the data was extracted, transformed and joined. It does not yet establish that there are two distinct invoices, two postings or two payments.

Start with record identity. In the first worked scenario, the original posting ID AP-073 appears twice because a join attached two approval-history rows. After reconciling the source extract and inspecting the join, the reviewer confirms that both rows represent one posting. The analytic output contains a duplicated representation. There is no support from this pair for a duplicate-posting finding.

In the second scenario, AP-073 and AP-108 are distinct postings with the same selected fields. That requires further work. Compare source invoices, supplier identity, purchase and receipt records, reversals, payment references and the applicable process criterion. A reused invoice reference or a credit-and-rebill sequence could explain a match. Supporting evidence may instead establish an uncorrected duplicate posting. A payment conclusion requires payment evidence.

Move from a match to a supported assessment

Ask what business condition the test was designed to examine. A rule about duplicate postings does not automatically test duplicate payment, service delivery or the adequacy of approval.

Check whether the population and relevant fields are dependable for that purpose. Retain the data period, selection criteria, treatment of reversals, transformation logic and reconciliation results. A test covering the entire extracted file can still miss transactions absent from that file.

Compare the supported condition with a suitable evaluation criterion. In this fictional group, assume the documented process prohibits uncorrected duplicate invoice postings. If distinct postings represent the same obligation and no valid correction explains them, the reviewer has a potential exception to evaluate. The significance depends on the circumstances, risk and supporting evidence. It is not set by the color of an alert.

Document the reasoning, contradictory evidence and remaining work. “Awaiting payment evidence” is more accurate than “duplicate payment confirmed” when payment records have not been checked. An unsupported closure reason makes the queue smaller without improving the evidence.

Judgment also applies to what the rule misses

Exact matching will miss some near-duplicates with altered references, different supplier IDs or changed amounts. Conversely, broader matching can produce more legitimate candidates. Neither a larger nor a smaller alert count demonstrates better assurance by itself.

Exercise: for the two matching rows, write one sentence stating what the query establishes, one item of evidence needed next and one conclusion it cannot yet support. Then ask whether excluded, unmatched or missing records change the scope of the assessment.

The IIA's 2024 Global Internal Audit Standards provide professional context for evaluating information, developing potential findings and documenting the work. The restaurant-group example and review sequence here are original educational explanations, not a reproduced checklist or a claim of conformance.

The useful handoff is clear: analytics identifies a candidate. The auditor investigates its meaning, evaluates the evidence against the objective and explains the supported conclusion and its limits.

Inside Assurance — Beyond the numbers. Inside the business.