Data Analytics & Continuous Auditing: The Process, Start to Finish
The mechanics of Data Analytics & Continuous Auditing are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the Data Analytics & Continuous Auditing page.
What is Benford's Law and how does it detect fraud?
Benford's Law is a statistical observation that in many naturally occurring numerical data sets, the leading digit 1 appears far more often (roughly 30% of the time) than higher digits, following a predictable logarithmic distribution. Genuine, unmanipulated financial data tends to follow this pattern. Manually fabricated or manipulated figures — invented invoice amounts, round-tripped entries — often deviate noticeably from the expected distribution, which flags them for further investigation.
In practice: Benford's Law analysis is a screening tool, not proof of fraud on its own. A deviation flags an area for a human auditor to investigate further — it narrows where to look, it does not replace professional judgement or corroborating evidence.
How is continuous auditing different from continuous monitoring done by management itself?
Continuous monitoring is a management/internal control activity — the business's own systems and staff watching for issues as part of day-to-day operations. Continuous auditing is an independent, audit-function activity applying auditor-designed tests with professional scepticism, documented as audit evidence, and reported to the audit committee or board. The two are complementary — management's monitoring is a first line of defence; continuous auditing provides independent assurance over that first line.
In practice: We sometimes see companies conflate a well-built Power BI operations dashboard with an audit function. A dashboard tracking sales versus target is management information. An analytics test flagging unauthorised journal entries with documented evidential support is audit work — the distinction matters for governance and for what an audit committee can rely on.
How long does the first analytics engagement take?
The time a first-time engagement takes from initial scoping to a working, management-ready exception dashboard depends heavily on how clean and accessible your underlying data is; confirm the expected timeline at scoping. Businesses with a well-maintained single ERP and clean master data move faster; businesses with multiple disconnected systems or significant data-quality issues take longer, because data cleansing and reconciliation is the most time-consuming phase.
In practice: Data quality is the single biggest driver of timeline. Timeline varies significantly based on data quality; we recommend confirming the expected timeline during scoping.
How does TDS reconciliation analytics work and what does it prevent?
Every payment in the ledger that attracts TDS under the Income-tax Act (rent, professional fees, contractor payments, commission, and others) is tested for whether tax was deducted at the applicable rate, deposited within the statutory due date (generally the 7th of the following month, or 30 April for tax deducted in March), and correctly reported in the TDS return so it reflects in the deductee's Form 26AS/AIS. Shortfalls or defaults trigger a 30% disallowance of the expense for payments to residents under Section 40(a)(ia) of the Income-tax Act, 1961 (Section 35(b) of the Income-tax Act, 2025, which applies from tax year 2026-27), and interest under Section 201(1A) of the 1961 Act — both of which are far cheaper to fix during the year than after the assessment.
In practice: The most common finding in our TDS analytics work is not fraud — it is a rate applied incorrectly on a category of payment, or a payment classified in a way that masked the TDS applicability. These are process fixes, not investigations, and catching them mid-year avoids compounding interest.
How is duplicate payment detection performed?
The full accounts payable population is screened for payments that match on combinations of vendor, invoice number, invoice amount, and date proximity — including near-duplicates where an invoice number has minor formatting differences or where the same underlying invoice was entered twice under slightly different vendor master records (a common issue where one vendor has multiple master entries in the ERP due to inconsistent onboarding).
In practice: Duplicate vendor master records are a frequent and underappreciated root cause. A vendor master clean-up project alongside the analytics engagement is worth considering — deduplicating vendor records materially reduces both fraud risk and the false-positive rate in future duplicate-payment tests.
What is a three-way match and how does analytics improve it?
A three-way match compares the purchase order, the goods receipt note (GRN), and the vendor invoice to confirm quantity, price, and terms agree before a payment is authorised. Where this is done manually, only a sample of purchases is typically checked. Analytics-based three-way match testing runs the comparison across the entire purchase population, flagging every exception — quantity mismatches, price variances beyond a defined tolerance, invoices processed without a corresponding GRN, or payments made before goods receipt is recorded.
In practice: Payments processed without a recorded GRN are one of the most common findings — sometimes legitimate (advance payment terms), sometimes indicative of a control gap that a dishonest employee could exploit. Each exception needs individual review; the analytics only identifies where to look.
How often should continuous auditing tests run?
It depends on the risk area, not a single fixed cadence. GST input credit reconciliation works well monthly, aligned to your GST filing cycle. TDS reconciliation aligns well to the quarterly TDS return cycle. High-risk payment controls (large-value payments, related-party transactions) can run weekly or even daily where the exposure justifies it. Lower-risk areas may only need a full re-test annually alongside the statutory or internal audit.
In practice: We design the cadence around materiality and exposure, not around what is technically possible to automate. Running every test daily generates alert fatigue and gets ignored; running high-risk tests daily and lower-risk tests annually keeps the programme credible and actionable.
How much does a data analytics and continuous auditing engagement cost?
Cost depends on transaction volume, number of data sources, system complexity, and whether the engagement is a one-time analytics exercise or an ongoing continuous auditing programme. PNPC provides a written scope and fee proposal after the initial scoping consultation, once we understand your systems and risk areas — we do not quote a fee before that conversation because the effort varies significantly by client.
In practice: We generally recommend clients start with a focused first-cycle engagement on their two or three highest-risk areas (commonly GST reconciliation, duplicate payments, and journal entry testing) rather than attempting full-scope analytics across every process in year one — this keeps cost proportionate and builds the case for expanding scope in later cycles.
How does related-party transaction analytics help with CARO 2020 reporting?
CARO 2020 (Companies (Auditor's Report) Order) requires the statutory auditor to report specifically on related party transactions, compliance with Sections 177 and 188 of the Companies Act, and end-use of borrowed funds. Full-population analytics testing of related-party transactions — screening for transactions with related parties not disclosed as such in master data, pricing that deviates from arm's-length benchmarks, or fund flows to related entities inconsistent with the stated loan purpose — provides a far more defensible basis for these specific CARO representations than a manual sample.
In practice: Related-party transaction testing is one of the areas where regulators and auditors have faced the most scrutiny in recent years for inadequate testing. We treat this as a standard, non-negotiable component of the analytics test suite for any company where CARO 2020 applies.
Where this sits in the wider engagement
Data Analytics & Continuous Auditing rarely arrives on its own. The statutory basis and the current requirements are set out on the Data Analytics & Continuous Auditing service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Data Analytics & Continuous Auditing we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.