Digital Auditing and Group Audits

Two topics, one shared underlying tension

Digital auditing asks how much confidence an auditor can place in evidence generated or processed by a system the auditor did not build and cannot fully inspect from the inside. Group audits ask how much confidence a group auditor can place in work performed by another auditor, the component auditor, whom the group auditor did not directly supervise. Both topics, despite covering entirely different subject matter, resolve to the same underlying question this paper has asked repeatedly in different forms: when the auditor must rely on something — a system, another auditor's work, an expert's opinion — what specific evaluation must genuinely occur before that reliance is justified, and what residual responsibility does the relying auditor retain regardless?

Digital auditing and the use of automated tools

Computer-Assisted Audit Techniques (CAAT). Rather than manually testing a small sample of transactions, CAATs allow the auditor to apply audit procedures directly to an entity's electronic data, testing entire populations of transactions rather than a limited sample — a fundamental shift from sample-based assurance to population-based assurance wherever CAATs are genuinely and correctly deployed, since testing 100% of a population removes sampling risk (the risk that a sample is not representative of the population) entirely for the specific attribute being tested, though it does not remove the risk that the underlying data itself is incomplete or the test criteria themselves are flawed.

Data analytics. Beyond simple, rule-based testing, data analytics techniques can identify patterns, trends, and anomalies within large volumes of transactional data that a manual, sample-based approach would be highly unlikely to surface at all — a duplicate payment pattern spread thinly across many different vendor accounts specifically to avoid detection through any single vendor's own account review, for instance, is exactly the kind of dispersed anomaly data analytics across the full population can reveal, but that manual sampling, examining only a limited subset of transactions, would very likely miss entirely.

Artificial intelligence in audit. AI-based tools are increasingly used to assist with tasks such as identifying unusual journal entries warranting further investigation (directly supporting the SA 240 fraud-response requirement to test journal entries), extracting and classifying information from unstructured documents (contracts, invoices) to support audit procedures, and flagging transactions or relationships (as one of this paper's earlier chapters noted for Ind AS 115 performance obligation identification) that resemble patterns associated with a specific accounting or audit risk — but, exactly as that earlier discussion established, an AI tool's flag identifies a candidate for review, it does not itself constitute the professional judgement the auditor must still exercise to determine whether the flagged item actually represents the risk or issue the tool has identified a resemblance to.

Remote auditing. Technology enabling audit procedures to be performed without the auditor's physical presence at the client's location — reviewing documents transmitted electronically, conducting inquiries and even physical observation (such as an inventory count) via live video — expanded considerably in recent years, and raises specific considerations the auditor must address before relying on remotely-gathered evidence: can the auditor genuinely be satisfied about the authenticity and completeness of documents received electronically, is a video-observed inventory count genuinely equivalent in reliability to physical attendance (considering camera coverage, the risk of selective or staged presentation, and the auditor's more limited ability to move freely and independently around the location compared to being physically present), and does the specific engagement's risk profile permit remote procedures at all, or does it specifically warrant physical attendance given the assessed risk.

The recurring caution across every one of these tools. Each of these digital tools genuinely expands what evidence the auditor can efficiently gather and what patterns the auditor can detect, but none of them removes the auditor's own responsibility to exercise professional judgement over the results — a system correctly flags a statistical anomaly; only the auditor's own judgement determines whether that anomaly reflects a genuine risk of material misstatement, an innocent, explicable business reason, or a data quality artefact unrelated to any genuine underlying issue.

Group audits

Defining the group audit landscape. A group comprises a parent and its components (subsidiaries, associates, joint ventures, branches, divisions) whose financial information is included in the group financial statements; the group engagement partner takes overall responsibility for the group audit opinion, and component auditors perform audit work on the financial information of one or more individual components, potentially from a different firm entirely, or from a different office of the same firm.

Determining component significance. Not every component warrants the same depth of audit work — a component is significant either due to its individual financial significance to the group (a large subsidiary contributing a substantial proportion of group revenue or assets) or because it is likely, due to its specific nature or circumstances, to include significant risks of material misstatement to the group financial statements (a component in an unstable jurisdiction, or one engaged in a specialised, high-risk activity even if individually small), and this significance assessment directly determines the type and extent of work required on that specific component — full-scope audit work, audit work on specific account balances or assertions only, or, for genuinely insignificant components, purely analytical procedures at the group level.

The group engagement team's involvement with component auditors. The group engagement team must be sufficiently involved in the component auditors' work to obtain sufficient appropriate audit evidence that the group financial statements are free from material misstatement — this involvement scales with the assessed risk and significance of each component, ranging from simply reviewing the component auditor's overall summary memorandum for a lower-risk, less significant component, to direct discussion with the component auditor and review of specific working papers for a highly significant or high-risk component, to, in the most significant cases, the group engagement team itself visiting the component and being directly involved in the component auditor's work.

Component materiality. The group engagement team sets a component materiality for each component subject to an audit or review, lower than group materiality, specifically to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements across all the group's components exceeds group materiality — exactly the same aggregation-risk logic SA 450 applies within a single entity's audit, now applied across an entire group of separately audited components.

Instructions to component auditors and evaluating their work. The group engagement team communicates specific requirements to each component auditor — the work to be performed, component materiality, a list of related parties the group is aware of that the component may need to consider, and the timetable for completing the work — and subsequently evaluates the component auditor's communicated work and findings, considering whether the work performed is sufficient and appropriate for the group audit's purposes, exactly the same residual-responsibility principle already established for internal audit and expert reliance: the group engagement team cannot simply accept a component auditor's conclusion without this evaluation, since ultimate responsibility for the group audit opinion rests with the group engagement partner, not with any individual component auditor.

Restrictions on access. Where the group engagement team is unable to obtain sufficient appropriate audit evidence regarding a significant component, whether due to management-imposed restrictions or genuine practical circumstances (denial of access, an inability for the component auditor to cooperate for reasons outside anyone's reasonable control), this is treated as a scope limitation exactly as established in the reporting chapter, requiring the group engagement team to assess the materiality and pervasiveness of this specific limitation and determine the appropriate reporting consequence for the group opinion as a whole.

Why these two chapters are grouped together

Digital auditing and group audits sit together in this paper's syllabus precisely because both, at their analytical core, are about the same underlying discipline: evaluating a source of evidence or work the auditor did not personally, directly generate or perform, and determining what specific additional evaluation and residual responsibility remains with the auditor before that evidence or work can genuinely support the audit opinion. Whether the source is an algorithm, a remote video feed, or another firm's audit team working on a subsidiary in a different country, the underlying question — and the underlying answer, that reliance never eliminates the primary auditor's own ultimate responsibility — is identical, and recognising this shared structure is what turns two seemingly unrelated topics into one coherent chapter.