Data Analytics Exception Review: Keep the Reasoning Behind the Result

An exception queue is useful when another reviewer can understand why an item was raised, what evidence was examined and what still needs to happen. A shorter queue alone does not demonstrate that the underlying risk has been addressed.

This Inside Assurance toolkit provides a working Excel review log for that handoff. It keeps the analytic rule, population, exception, data source, validation, risk relevance, auditor assessment and disposition together. Additional fields record evidence references, the reviewer and review date, and the next action and its owner when follow-up is needed.

Start with the test context

Before entering individual cases, document the review scope and period, the applicable evaluation criterion, and the source-extract reconciliation reference. Retain the rule logic and version in the rule field or linked working paper. The rule description should state the selected fields, matching or threshold logic, exclusions and treatment of reversals.

Use stable exception IDs. A repeated ID needs investigation before counting the records as separate reviews. The workbook flags duplicates within its 50-row starter log. It does not resolve identities or determine the completeness of the business population.

Separate data validation from the business assessment

A candidate may arise from a genuine business event or from extraction, matching or transformation issues. Record how the source and rule were checked. The validation field distinguishes Validated, Pending and Data issue. “Validated” is a reviewer input, not a result calculated by Excel.

Consider an original fictional restaurant-group accounts-payable test. Two output rows show the same supplier, invoice reference and amount. In example EX-001, a join repeated posting AP-073 because two approval-history records matched. The reviewer retained the source reconciliation and join correction evidence. The supported disposition explains a data representation issue rather than a duplicate invoice payment.

In EX-002, two distinct postings require further evidence. The invoice, reversal and payment trail has not yet been obtained. The review remains open with a named follow-up owner and an explicit action. A statement that a duplicate payment occurred would be unsupported at this point.

In EX-003, the fictional evidence establishes two uncorrected postings for one obligation against the stated process criterion. The assessment supports a posting exception. Payment occurrence remains outside the evidence reviewed. The record describes that boundary instead of expanding the conclusion.

Record a disposition that matches the evidence

The workbook offers Investigate, Explained, Exception supported and Not assessed. Use the assessment and evidence-reference fields to explain the selected disposition. A label alone is insufficient.

If validation is incomplete or has a data issue, the calculated prompt asks the reviewer to resolve it. If required review fields are missing, it asks for the missing review inputs. For Investigate and Not assessed, both a next action and a follow-up owner are required before the prompt changes to Follow up.

For a completed documented assessment, the prompt says Review recorded. This means the required fields have been filled. It does not certify the evidence, authorize a payment, approve a finding or show that remediation has been completed. The disposition and supporting assessment remain visible.

Read the totals within their scope

The blank Review sheet is for live use. The Worked example sheet is separate and clearly fictional. Its three example records are excluded from the live totals. A blank log shows no entered reviews; it is not a report of zero business exceptions.

The summary counts entries, records requiring follow-up or missing inputs, and reviews recorded. These are queue-management measures. They do not estimate an exception rate, loss, fraud probability or the effectiveness of the underlying control.

Use and adapt the file

Enter scope, criterion and reconciliation evidence first. Add the actual case information in the amber input cells. Keep calculated columns intact. Link to evidence in the authorized working-paper repository rather than embedding sensitive documents in a public download. Replace the fictional reviewer labels with appropriate authorized reviewers when using your own copy.

The template provides 50 prepared rows. To expand it, extend the formulas, validation, duplicate-ID range and summary references together, then test the expanded file. It contains no macros, external data connections or automated website publishing.

The IIA's 2024 Global Internal Audit Standards provide professional context for evidence evaluation and engagement documentation. The workbook structure, formulas and fictional case are original Inside Assurance work. The file is an educational starter, not a reproduced professional-body template or a claim of conformance.

Inside Assurance — Beyond the numbers. Inside the business.