- Deloitte Warns Against Treating Audit Anomalies as Evidence of Wrongdoing
Data analytics is allowing internal auditors to examine more transactions and identify unusual patterns faster. But a flagged payment, repeated supplier award or after-hours journal entry is only a starting point, Deloitte Ghana argues in a practice note on modern internal audit. The auditor’s task is to establish what the signal means before treating it as a finding.
The distinction is consequential for companies, public institutions and boards that increasingly rely on dashboards to monitor financial activity.
A system can identify an anomaly across thousands of transactions, but it cannot by itself determine whether the cause was fraud, a control failure, an error or a legitimate business event. Treating detection as proof risks turning a useful audit lead into an unjustified conclusion.
Deloitte’s illustration is deliberately simple: two payments to one supplier for the same amount and apparently the same invoice.
Analytics flags them, and suspicion of duplicate payment arises. But the transactions could also reflect a reversal followed by a reposting, a corrected invoice or a system-processing issue. The alert narrows the search; it does not settle the case.
That distinction can shape decisions well beyond an audit report. A premature finding may affect staff, suppliers, contracts, reputations and management decisions. The opposite risk is just as serious: accepting an explanation without checking it may leave a real weakness or misconduct undiscovered. The challenge for auditors is to avoid both automatic suspicion and automatic acceptance.
The note applies the same test to other familiar signals: a payment just below an approval threshold, repeated contract awards to one supplier, or a manual journal entered outside normal working hours.
Each pattern may warrant scrutiny because of the risk it could indicate. None, on its own, establishes that a rule was evaded, procurement was improper or an unauthorised override occurred.
This is where professional judgement becomes essential. Auditors must ask whether the underlying data is accurate, whether the analytics test was designed correctly and whether the business context supports or contradicts the apparent pattern.
A control test can generate false leads if it uses incomplete records, incorrect assumptions or a rule that does not reflect how the process actually works.
The note says the Global Internal Audit Standards provide a professional foundation for this approach. It points to Standard 4.3 on professional scepticism and Standard 14.1 on gathering information for analysis and evaluation.
The practical implication is that auditors must assess explanations against relevant, reliable and sufficient evidence, rather than deciding on the basis of a plausible story or a compelling dashboard.
In the duplicate-payment example, management might say the first transaction was reversed before a corrected payment was posted. The auditor should then inspect the reversal, trace the entries through the accounting records, check supporting documents and understand how the system processed the transactions.
The explanation should neither be accepted because it sounds reasonable nor rejected because it conflicts with the initial suspicion. It must be tested.
A disciplined sequence follows: identify the anomaly and validate the data and test; consider more than one explanation; examine the transaction and relevant controls; corroborate the account with evidence; then document what has been established and what remains uncertain.
That sequence helps guard against confirmation bias the tendency to look for evidence that supports an early view while overlooking information that challenges it.
The issue is especially important where fraud or misconduct is suspected. A label such as “duplicate payment” can quickly become shorthand for wrongdoing, even when the available evidence only shows two similar entries.
Conversely, a weak investigation can allow a genuine problem to be dismissed as a technical glitch. An audit conclusion must be proportionate to what the evidence actually shows and clear about unresolved questions.
Deloitte’s central warning is that wider visibility does not automatically produce stronger assurance. Analytics may allow internal audit to review far more transactions than traditional sampling, but an increase in alerts is not itself a measure of audit quality.
If teams are judged mainly by the number of exceptions they identify, they may be encouraged to produce more red flags rather than better-supported findings.
That has implications for boards and audit committees deciding where to invest. Spending on analytics needs to be matched by attention to data quality, staff capability and business understanding.
Auditors need to know not only how to run a test, but also how the organisation’s processes work and what records can confirm or refute a result.
Leaders should therefore consider whether audit reports distinguish clearly between an alert, a matter under investigation and a substantiated finding. They should ask how explanations were tested, what evidence was reviewed and whether management’s response was independently corroborated.
Those questions can help prevent analytics from becoming a machine for generating suspicion or a shield behind which genuine risks go unexamined.
The same discipline matters in public spending and procurement. A repeated award to one supplier may be supported by a valid commercial reason, or it may point to a weakness in competition or oversight.
A payment near a threshold may reflect the actual cost of a service, or it may warrant investigation. In either case, the records and the applicable controls must determine the conclusion. The pattern alone cannot fairly answer the question.
The practice note’s closing principle is concise: “Analytics reveals the signal. Evidence establishes its meaning.” The point is not to limit the use of technology, but to make sure technology improves the questions auditors ask without deciding the answers in advance.
As organisations automate more monitoring, the credibility of internal audit will depend less on how many unusual transactions its tools can surface than on whether its investigators can explain what happened, show how they know and acknowledge what remains unproven. A red flag can start an inquiry. Only evidence, tested with judgement, can finish it.
