Data Analytics & Continuous Auditing: Who Needs It and Who Does Not
Whether Data Analytics & Continuous Auditing applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the Data Analytics & Continuous Auditing page.
What data do you need access to, and is it secure?
Typically read-only or scheduled-export access to your accounting/ERP system's general ledger, your GSTN portal filings, bank statements in electronic format, payroll register, and vendor/customer master data. We do not require write access to any live system. Data handling follows our standard client confidentiality and data security protocols consistent with ICAI Code of Ethics requirements on confidentiality.
In practice: We recommend clients grant read-only or export-only access wherever the system supports it — there is no operational reason for an analytics engagement to require write access to your live ERP, and we structure the engagement to avoid it.
What does GSTR-2A/2B reconciliation analytics actually catch?
It performs a full-population match between every input tax credit entry in your purchase register and books against the entries auto-populated in your GSTR-2B from your vendors' filings. (Under Section 16(2)(aa) of the CGST Act, ITC eligibility depends on the invoice being reflected in GSTR-2B, and Invoice Management System (IMS) actions — accept, reject or pending — affect what flows into it.) It flags: vendors who have not filed their GSTR-1, invoices with mismatched taxable value or tax amount, credit claimed on invoices not appearing at all in 2A/2B, credit at risk of reversal under Rule 37 for non-payment to the vendor within the prescribed period, credit exposed under Rule 37A where a supplier's invoice appears in 2A/2B but the supplier has not filed the corresponding GSTR-3B, and disallowance exposure under Section 16(2)(c) of the CGST Act where the supplier has not deposited the tax.
In practice: This is one of the highest-value analytics tests we run because the downside of missing a mismatch is concrete and quantifiable — a GST demand notice with interest and potential penalty. Running this monthly rather than at year-end gives you time to chase the vendor for a correction before the credit is permanently at risk.
What is journal entry testing and why does SA 240 require it?
SA 240 (The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements) specifically requires auditors to test journal entries and other adjustments for evidence of possible material misstatement due to fraud — because management override of controls, when it happens, most often surfaces as an unusual journal entry. Analytics-based journal entry testing screens the full population for entries with characteristics associated with manipulation: postings outside business hours, postings by unauthorised users, round-number entries, entries with vague or missing narratives, and entries clustered just before period-end.
In practice: This test is specifically difficult to perform meaningfully with manual sampling — a fraudulent entry is by definition rare, and a small sample has a low probability of catching it by chance. Full-population testing is the only approach that gives this SA 240 requirement real teeth.
Who reviews and acts on the exceptions identified?
The exception dashboard is walked through jointly with your finance team, and material or unusual findings are escalated to the audit committee or board as appropriate. Each material exception is assigned an owner within the business and a remediation action with a target date — this response is documented and becomes part of the evidence trail for the statutory or internal auditor.
In practice: An analytics programme without a defined ownership and escalation process for its findings produces reports that get read once and shelved. We insist on an agreed remediation-tracking process as part of the engagement scope — otherwise the exercise loses most of its value after the first cycle.
Does this service require IT audit expertise as well as accounting expertise?
Yes, meaningfully. Extracting reliable data from an ERP requires understanding the system's data schema, access controls, and how transactions flow through its modules — skills more associated with IS/IT audit than traditional financial audit. PNPC delivers this service jointly through audit and IT-audit trained team members, which is why we position it within our Information Systems & IT Audit practice area alongside services like IT general controls review.
In practice: Analytics projects delivered by pure data-science vendors without audit training can produce technically impressive dashboards built on unreconciled data — the numbers look sophisticated but do not tie back to the trial balance, which makes the whole output unreliable for audit purposes.
Can a small business afford this, or is it only for large enterprises?
It is scalable. A large enterprise with multiple ERP modules and locations needs a comprehensive, multi-test programme; a smaller business can start with a narrow, high-value scope — commonly GST reconciliation and duplicate payment screening only — at a proportionately lower cost. The methodology scales down; it does not require enterprise-level budget to deliver meaningful value on a focused scope.
In practice: We actively discourage smaller clients from over-scoping their first engagement. A focused, well-executed two-test programme that management actually acts on delivers more real value than an ambitious ten-test programme that overwhelms a small finance team.
Where this sits in the wider engagement
Data Analytics & Continuous Auditing rarely arrives on its own. The statutory basis and the current requirements are set out on the Data Analytics & Continuous Auditing service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Data Analytics & Continuous Auditing we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.