Data Analytics & Continuous Auditing: Where It Goes Wrong
The failures on Data Analytics & Continuous Auditing repeat, which means they are avoidable if you know what to watch. The questions below are the ones raised most often in practice; the full scope of the service is on the Data Analytics & Continuous Auditing page.
Is this the same as a statutory audit or does it replace it?
No — it complements the statutory audit rather than replacing it. The statutory audit under the Companies Act 2013 must still be conducted by an independent Chartered Accountant following the Standards on Auditing, and results in a formal audit opinion. Data analytics strengthens the evidence base that opinion relies on and, where transaction volumes are high, is often the only practical way to genuinely satisfy the risk-assessment requirements of SA 315 and SA 330.
In practice: We are frequently asked whether analytics 'counts' as the audit. It does not, on its own — but a statutory audit that layers analytics on top is meaningfully more robust than one relying purely on manual sampling, and audit committees increasingly expect this.
What is a CAAT?
CAAT stands for Computer-Assisted Audit Technique — the general term for software-based methods auditors use to extract, analyse, and test data, rather than manually reviewing paper or PDF documents. Common CAATs include full-population testing, duplicate detection, Benford's Law analysis, three-way match testing, and journal entry testing.
In practice: CAATs are not new — they have existed in audit practice for decades. What has changed is the volume and structure of available data, which now makes full-population CAATs practical and expected rather than a specialised add-on.
Which ERP systems can you work with?
Systems commonly encountered include Tally (Prime and ERP 9), SAP (Business One and larger implementations), Oracle NetSuite, Zoho Books, Microsoft Dynamics, and banking core systems used in concurrent/branch audits. For less common or custom-built systems, the first phase of scoping includes confirming extraction feasibility and the format available.
In practice: Tally remains the most common system among our mid-market clients and has good raw data export capability once you know where to look. SAP and Oracle environments usually need IT team involvement to configure the extract — we coordinate this directly with your IT team or ERP vendor.
Can data analytics detect ghost employees or payroll fraud?
Yes — common tests include screening the payroll register for duplicate bank account numbers across different employee IDs, employees continuing to receive pay after their recorded separation date, employees with no corresponding statutory (PF/ESI) registration despite eligibility, and salary payments that do not reconcile against the approved headcount and pay-band structure.
In practice: Ghost employee schemes are usually not sophisticated — they persist because nobody is cross-checking the payroll register against the HR master file line by line every month. A simple recurring analytics test closes this gap at low cost relative to the loss it can prevent.
What does an exception dashboard actually look like?
Typically a Power BI or Excel-based dashboard that groups flagged exceptions by risk category and materiality — for example, GST mismatches ranked by credit value at risk, duplicate payments ranked by rupee amount, journal entries ranked by unusualness score — with drill-down capability from a summary chart down to the individual transaction and its supporting documents for investigation.
In practice: A raw spreadsheet of thousands of flagged rows is not usable by a CFO or audit committee. The prioritisation and ranking layer is where most of the practical value sits, and it is what distinguishes a useful analytics deliverable from a data dump.
Can this integrate with our existing internal audit function?
Yes — this is one of the most common and valuable configurations. Data analytics can be embedded directly into your existing internal audit programme, providing full-population testing evidence that supplements the internal audit team's judgemental and walkthrough-based procedures, and materially expanding the internal audit's effective coverage without a proportionate increase in headcount.
In practice: Where PNPC also provides internal audit services, we build the analytics test results directly into the internal audit reporting cycle, so the audit committee sees one integrated risk picture rather than two disconnected reports.
Can analytics be run on UAE entities as well as Indian entities?
Yes. PNPC's Dubai office extends the same analytics methodology to UAE entities — reconciling VAT input credit against Federal Tax Authority filings, testing for duplicate payments and unauthorised journal entries, and screening payroll data against UAE Wages Protection System (WPS) records. For groups with both Indian and UAE entities, we run a coordinated programme so management gets one consolidated risk picture across both jurisdictions.
In practice: The specific regulatory reconciliation points differ — UAE VAT and WPS instead of Indian GST and PF/ESI — but the underlying CAAT methodology (duplicate detection, Benford's Law, three-way match, journal entry testing) is largely consistent across both jurisdictions.
Where this sits in the wider engagement
Data Analytics & Continuous Auditing rarely arrives on its own. The statutory basis and the current requirements are set out on the Data Analytics & Continuous Auditing service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Data Analytics & Continuous Auditing we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.