Data Analytics & Continuous Auditing

It is the use of software to examine all — not a sample — of your financial and operational transactions for errors, duplicate payments, unauthorised entries, GST/TDS mismatches, and fraud indicators, on a schedule that can run monthly, weekly, or even daily rather than only once a year. Think of it as moving from spot-checking a handful of transactions to running an always-on scanner across everything that happens in your books.

No — it complements the statutory audit rather than replacing it. The statutory audit under the Companies Act 2013 must still be conducted by an independent Chartered Accountant following the Standards on Auditing, and results in a formal audit opinion. Data analytics strengthens the evidence base that opinion relies on and, where transaction volumes are high, is often the only practical way to genuinely satisfy the risk-assessment requirements of SA 315 and SA 330.

CAAT stands for Computer-Assisted Audit Technique — the general term for software-based methods auditors use to extract, analyse, and test data, rather than manually reviewing paper or PDF documents. Common CAATs include full-population testing, duplicate detection, Benford's Law analysis, three-way match testing, and journal entry testing.

Benford's Law is a statistical observation that in many naturally occurring numerical data sets, the leading digit 1 appears far more often (roughly 30% of the time) than higher digits, following a predictable logarithmic distribution. Genuine, unmanipulated financial data tends to follow this pattern. Manually fabricated or manipulated figures — invented invoice amounts, round-tripped entries — often deviate noticeably from the expected distribution, which flags them for further investigation.

Continuous monitoring is a management/internal control activity — the business's own systems and staff watching for issues as part of day-to-day operations. Continuous auditing is an independent, audit-function activity applying auditor-designed tests with professional scepticism, documented as audit evidence, and reported to the audit committee or board. The two are complementary — management's monitoring is a first line of defence; continuous auditing provides independent assurance over that first line.

Typically read-only or scheduled-export access to your accounting/ERP system's general ledger, your GSTN portal filings, bank statements in electronic format, payroll register, and vendor/customer master data. We do not require write access to any live system. Data handling follows our standard client confidentiality and data security protocols consistent with ICAI Code of Ethics requirements on confidentiality.

We have worked with Tally (Prime and ERP 9), SAP (Business One and larger implementations), Oracle NetSuite, Zoho Books, Microsoft Dynamics, and several banking core systems for concurrent/branch audit clients. For less common or custom-built systems, the first phase of scoping includes confirming extraction feasibility and the format available.

A first-time engagement typically takes 6–8 weeks from initial scoping to a working, management-ready exception dashboard — depending heavily on how clean and accessible your underlying data is. Businesses with a well-maintained single ERP and clean master data move faster; businesses with multiple disconnected systems or significant data-quality issues take longer, because data cleansing and reconciliation is the most time-consuming phase.

It performs a full-population match between every input tax credit entry in your purchase register and books against the corresponding entries auto-populated in your GSTR-2A/2B from your vendors' filings. It flags: vendors who have not filed their GSTR-1, invoices with mismatched taxable value or tax amount, credit claimed on invoices not appearing at all in 2A/2B, credit at risk of reversal under Rule 37 for non-payment to the vendor within the prescribed period, credit exposed under Rule 37A where a supplier's invoice appears in 2A/2B but the supplier has not filed the corresponding GSTR-3B, and disallowance exposure under Section 16(2)(c) of the CGST Act where the supplier has not deposited the tax.

Every payment in the ledger that attracts TDS under the Income-tax Act (rent, professional fees, contractor payments, commission, and others) is tested for whether tax was deducted at the applicable rate, deposited within the statutory due date, and correctly reported in the TDS return so it reflects in the deductee's Form 26AS/AIS. Shortfalls or defaults trigger disallowance of the underlying expense under Section 40(a)(ia) and interest under Section 201(1A) — both of which are far cheaper to fix during the year than after the assessment.

SA 240 (The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements) specifically requires auditors to test journal entries and other adjustments for evidence of possible material misstatement due to fraud — because management override of controls, when it happens, most often surfaces as an unusual journal entry. Analytics-based journal entry testing screens the full population for entries with characteristics associated with manipulation: postings outside business hours, postings by unauthorised users, round-number entries, entries with vague or missing narratives, and entries clustered just before period-end.

Yes — common tests include screening the payroll register for duplicate bank account numbers across different employee IDs, employees continuing to receive pay after their recorded separation date, employees with no corresponding statutory (PF/ESI) registration despite eligibility, and salary payments that do not reconcile against the approved headcount and pay-band structure.

The full accounts payable population is screened for payments that match on combinations of vendor, invoice number, invoice amount, and date proximity — including near-duplicates where an invoice number has minor formatting differences or where the same underlying invoice was entered twice under slightly different vendor master records (a common issue where one vendor has multiple master entries in the ERP due to inconsistent onboarding).

A three-way match compares the purchase order, the goods receipt note (GRN), and the vendor invoice to confirm quantity, price, and terms agree before a payment is authorised. Where this is done manually, only a sample of purchases is typically checked. Analytics-based three-way match testing runs the comparison across the entire purchase population, flagging every exception — quantity mismatches, price variances beyond a defined tolerance, invoices processed without a corresponding GRN, or payments made before goods receipt is recorded.

Usually yes, at least for the initial data-extraction phase — your ERP admin or IT team typically needs to run or authorise the export, especially for systems like SAP or Oracle where ad-hoc reporting requires specific access rights. For simpler systems like Tally, extraction can often be done directly by the finance team with our guidance. We minimise the burden on your IT team by specifying exactly what extract format and fields we need upfront.

It depends on the risk area, not a single fixed cadence. GST input credit reconciliation works well monthly, aligned to your GST filing cycle. TDS reconciliation aligns well to the quarterly TDS return cycle. High-risk payment controls (large-value payments, related-party transactions) can run weekly or even daily where the exposure justifies it. Lower-risk areas may only need a full re-test annually alongside the statutory or internal audit.

Typically a Power BI or Excel-based dashboard that groups flagged exceptions by risk category and materiality — for example, GST mismatches ranked by credit value at risk, duplicate payments ranked by rupee amount, journal entries ranked by unusualness score — with drill-down capability from a summary chart down to the individual transaction and its supporting documents for investigation.

The exception dashboard is walked through jointly with your finance team, and material or unusual findings are escalated to the audit committee or board as appropriate. Each material exception is assigned an owner within the business and a remediation action with a target date — this response is documented and becomes part of the evidence trail for the statutory or internal auditor.

Analytics output can identify anomalies that trigger a fraud investigation and can support the evidence base, but a formal fraud investigation requiring evidentiary standards suitable for disciplinary action, litigation, or regulatory reporting is a distinct, more rigorous exercise — typically a Forensic Audit — involving chain-of-custody documentation, forensic data preservation, and interview protocols beyond standard analytics testing.

Yes, meaningfully. Extracting reliable data from an ERP requires understanding the system's data schema, access controls, and how transactions flow through its modules — skills more associated with IS/IT audit than traditional financial audit. PNPC delivers this service jointly through audit and IT-audit trained team members, which is why we position it within our Information Systems & IT Audit practice area alongside services like IT general controls review.

Cost depends on transaction volume, number of data sources, system complexity, and whether the engagement is a one-time analytics exercise or an ongoing continuous auditing programme. PNPC provides a written scope and fee proposal after the initial scoping consultation, once we understand your systems and risk areas — we do not quote a fee before that conversation because the effort varies significantly by client.

Yes, though the value proposition shifts. For a smaller company below statutory audit thresholds, data analytics is less about strengthening an audit opinion and more about giving management and owners direct visibility into control gaps — duplicate payments, GST leakage, unusual journal activity — that would otherwise go unnoticed until they become material. It is a proportionate control investment even without a statutory audit mandate.

Yes — this is one of the most common and valuable configurations. Data analytics can be embedded directly into your existing internal audit programme, providing full-population testing evidence that supplements the internal audit team's judgemental and walkthrough-based procedures, and materially expanding the internal audit's effective coverage without a proportionate increase in headcount.

ITGC review assesses whether the controls around your IT environment itself are sound — access controls, change management, backup and disaster recovery, segregation of duties within the ERP's role configuration. Data Analytics & Continuous Auditing uses that IT environment's data to test the business transactions flowing through it. A weak ITGC environment (for example, poor access controls) directly undermines the reliability of analytics results, because unauthorised users could be altering data that the analytics later tests — the two services are closely linked and often scoped together.

CARO 2020 (Companies (Auditor's Report) Order) requires the statutory auditor to report specifically on related party transactions, compliance with Sections 177 and 188 of the Companies Act, and end-use of borrowed funds. Full-population analytics testing of related-party transactions — screening for transactions with related parties not disclosed as such in master data, pricing that deviates from arm's-length benchmarks, or fund flows to related entities inconsistent with the stated loan purpose — provides a far more defensible basis for these specific CARO representations than a manual sample.

We escalate immediately and outside the normal reporting cadence — a serious finding (suspected fraud, a material GST exposure, an unauthorised large payment) is not held back for the next scheduled dashboard review. Depending on severity, this may involve an immediate call with management, a recommendation to engage forensic specialists, or in specific regulated-sector contexts, an assessment of whether a reporting obligation to a regulator is triggered.

Yes. PNPC's Dubai office extends the same analytics methodology to UAE entities — reconciling VAT input credit against Federal Tax Authority filings, testing for duplicate payments and unauthorised journal entries, and screening payroll data against UAE Wages Protection System (WPS) records. For groups with both Indian and UAE entities, we run a coordinated programme so management gets one consolidated risk picture across both jurisdictions.

No. Analytics detects where controls are failing in practice; it does not itself document what the controls are supposed to be. A business still needs a documented internal control framework (approval matrices, segregation of duties design, standard operating procedures) against which analytics exceptions can be assessed — without that baseline, an analytics team cannot always tell whether a flagged transaction is a genuine control breach or simply an undocumented but legitimate exception process.

Depending on the client's system and the specific test, we use a combination of SQL-based extraction and query scripts, generalised audit software such as IDEA or ACL/Galvanize for full-population CAATs, and Power BI or Excel for management-facing exception dashboards. The specific tool is chosen based on your ERP and data format — the audit logic and professional judgement applied to the output matters more than the specific software.

All client financial and operational data handled during an analytics engagement is subject to the same confidentiality obligations under the ICAI Code of Ethics that apply to any PNPC audit or advisory engagement. Access is limited to the engagement team, data is not retained beyond the engagement period without client consent, and we agree specific data-handling terms — including any restrictions on cloud storage or cross-border data transfer — before extraction begins.

It is scalable. A large enterprise with multiple ERP modules and locations needs a comprehensive, multi-test programme; a smaller business can start with a narrow, high-value scope — commonly GST reconciliation and duplicate payment screening only — at a proportionately lower cost. The methodology scales down; it does not require enterprise-level budget to deliver meaningful value on a focused scope.

A pure technology or data-analytics vendor can build dashboards and run queries, but without audit training, the output is not reconciled to your books in an audit-defensible way, does not apply professional scepticism to what the exceptions mean, and cannot integrate the findings into a statutory or internal audit opinion. PNPC delivers this as Chartered Accountants with audit training, applying the same professional standards (SA 315, SA 330, SA 240) that govern the rest of our audit practice — the analytics is audit work, not a side technology project.

For clients opting into continuous auditing, we manage the recurring extraction, test execution, and dashboard refresh on the agreed cadence, flag material exceptions proactively as they arise rather than waiting for the next scheduled review, and provide a periodic summary to the audit committee or board. We also review and refresh the test suite annually or when the business changes materially.