Using ACL and IDEA for IT Audit Data Analysis
An overview of ACL (Galvanize/Diligent HighBond) and IDEA data analysis software, common commands, and how auditors apply them.
ACL (now part of the Diligent HighBond platform) and IDEA (Interactive Data Extraction and Analysis) are two of the most widely used specialized data analysis tools in the internal and IT audit profession. Both allow auditors to import very large data sets, far beyond what spreadsheet tools can comfortably handle, and run structured analytical routines against one hundred percent of a population rather than a sample.
Why Purpose-Built Audit Analytics Tools?
While spreadsheet software is adequate for small data sets, audit populations often include millions of rows of transactional data. ACL and IDEA are designed to import data directly from source systems (ERP exports, database extracts, flat files) while preserving a read-only, non-destructive working copy, ensuring the original data integrity is never compromised during analysis. This is a critical control from an evidentiary standpoint, since auditors must be able to demonstrate that their analysis was performed against unaltered source data.
Common Analytical Routines
- Duplicate detection: identifying duplicate invoice numbers, vendor payments, or employee records
- Gap detection: finding missing sequence numbers in checks, invoices, or purchase orders that could indicate suppressed or unrecorded transactions
- Stratification: grouping transactions into value bands to focus attention on high-dollar or unusual items
- Join and relate: combining multiple data sources, such as matching the HR termination file against the active directory user list to identify orphaned accounts
- Benford's Law analysis: comparing the distribution of leading digits in a data set against the expected natural distribution to flag potential fabrication
- Age analysis: calculating the age of outstanding items such as accounts receivable balances or unreconciled items
Typical Workflow
An audit data analysis project typically begins with defining the audit objective and the specific tests needed to address it, followed by identifying and requesting the required data extract, importing the data into the tool while verifying completeness (record counts and control totals reconciled to source system reports), cleansing and normalizing the data (standardizing date formats, trimming whitespace, handling nulls), running the defined analytical scripts, and finally investigating and documenting exceptions.
Data Completeness and Integrity Verification
A step auditors must never skip is verifying that the data extract received is complete and accurate. This is typically done by reconciling record counts, sum totals of key fields (such as total transaction value), and date ranges in the extract against independently obtained control totals, such as a general ledger trial balance or a system-generated summary report. Skipping this step risks drawing conclusions from an incomplete or manipulated data set.
Scripting and Repeatability
Both ACL and IDEA support scripting languages (ACLScript and IDEAScript, respectively) that allow auditors to automate repeatable analysis routines. This scripting capability is what enables the transition from one-time ad hoc analysis toward continuous auditing, since a validated script can be scheduled to run automatically against fresh data extracts on a recurring basis, with exceptions routed to an audit team for review.
Exam and Practical Relevance
CISA candidates should understand the conceptual role these tools play in the audit process even without needing to memorize specific software syntax: they enable full-population testing, preserve data integrity through read-only, non-destructive analysis, support automation and repeatability, and require rigorous completeness verification before any conclusions are drawn. Exam questions often focus on the underlying audit principle (data completeness, non-destructive analysis, full population testing) rather than specific tool commands.