10 data analytics tests every internal auditor should run
Sampling tells you about a few transactions. Analytics tells you about all of them. These ten tests run on standard ERP data and consistently surface the issues that matter.
Traditional audit testing selects a sample, often 25 or 40 items, and draws conclusions about thousands of transactions. It was the only practical option when records were on paper. With an ERP, every transaction is already structured data, and the IIA’s Global Internal Audit Standards encourage auditors to use technology and data analytics where they improve audit effectiveness. Full-population testing is no longer a luxury; it is simply better assurance.
Before you start
- Read-only access: auditors need logged, read-only access to ERP data to preserve independence.
- Understand the data: know which tables hold suppliers, invoices, payments, journals and user activity.
- Define thresholds: agree what counts as an exception before running the test.
- Follow up: an exception is a lead, not a finding, until it is investigated.
The 10 tests
1. Duplicate payments
Look for invoices with the same supplier and amount, the same invoice number with different formatting, or the same amount paid to different suppliers sharing bank details. Duplicate payments are among the most common and most recoverable losses.
2. Split purchases
Identify multiple purchase orders or invoices to the same supplier, on the same or nearby dates, each just below an approval threshold. This pattern often signals deliberate avoidance of authorization limits.
3. Supplier master file changes
Review changes to supplier bank accounts, especially changes followed shortly by payments, or changes made by users who also process payments. This is a classic route for payment fraud.
4. Suppliers matching employees
Compare supplier addresses, phone numbers and bank accounts with employee master data. Matches deserve explanation; some will be legitimate, others will be conflicts of interest or ghost vendors.
5. Unusual journal entries
Filter manual journal entries posted on weekends or holidays, outside business hours, by unusual users, with round amounts, or just before period-end close. Journal entry testing is a core response to management override risk.
6. Benford’s Law analysis
In many natural financial datasets, the leading digit 1 appears far more often than 9. Significant deviations in expense claims or payments can indicate fabricated figures and help focus deeper testing.
7. Segregation-of-duties conflicts
Map user roles and actual activity to find users who both created and approved the same document, or who hold incompatible permissions such as creating suppliers and releasing payments.
8. Credit notes and returns after period end
Large credit notes issued shortly after a period close can indicate revenue recorded to meet targets and reversed later. Test sales cut-off together with subsequent returns.
9. Payroll anomalies
Look for employees with duplicate bank accounts, employees paid after termination dates, or unusual overtime and allowance spikes. Ghost employees remain a real risk in large or decentralized workforces.
10. Slow-moving and negative inventory
Identify items with no movement for long periods, items with negative balances, and large stock adjustments. These point to valuation issues, weak warehouse controls or process errors.
The power of analytics is not finding one exception. It is proving that, across 100% of transactions, there are no others.
From one-off tests to continuous auditing
Once a test is designed and validated, it can be scheduled to run automatically every week or month, with exceptions routed to the audit team or to management owners. This shifts internal audit from periodic reviews to continuous assurance, and gives the audit committee a living view of control health.
Turning results into value
- Investigate exceptions and separate true issues from false positives.
- Quantify impact: amounts recovered, exposure avoided, controls strengthened.
- Report root causes, not just symptoms, so management fixes the process.
- Convert recurring tests into monitoring rules owned by management.
How Amy Technology helps
We give internal audit teams a digital audit platform on top of ERPNext, with ready-made analytics tests, working papers, findings tracking and committee reporting. For teams that need people as well as tools, our auditors provide co-sourced and outsourced internal audit services.