A machine learning model flags 1,200 journal entries as anomalous out of 480,000. That is not 1,200 findings. It is 1,200 items you still have to corroborate, and the exam tests whether you know the difference.
Artificial intelligence, machine learning, robotic process automation, continuous monitoring, dashboards, and embedded audit modules each produce one of two things: a larger population you can examine, or a faster signal that something deviates. Neither produces a finding. A finding still needs the four elements (criteria, condition, cause, effect), and the tool usually delivers only condition. You supply criteria from policy or regulation, and you test for cause before you conclude.
KEY: Technology output is audit evidence only after you validate the input data's completeness and accuracy and confirm the logic that produced the output. An unvalidated model result is a lead, not evidence.
Artificial intelligence (AI) is software that performs tasks normally requiring human judgment, such as classifying documents or generating text.
Two ML shapes matter for engagement work:
Common mistakes
- Reporting model flags as exceptions. A 930-item flag list with 35% precision would overstate violations by 605 items. Corroborate before reporting.
- Confusing continuous monitoring with continuous auditing. Ownership is the test. Management's routine is monitoring and is subject to your testing; internal audit's routine is auditing and supports independent conclusions.
- Relying on management's monitoring without testing it. Reliance requires evaluating the routine's scope, logic, and thresholds. A routine covering only orders above $10,000 misses 94.8% of exceptions.
Bottom line
- Technology output supplies condition; criteria, cause, and effect remain auditor work, and all output requires data completeness and accuracy validation first.
- Machine learning: supervised needs labeled history, unsupervised finds outliers without labels; limits are data quality, bias, and explainability.
- Robotic process automation repeats rule-based steps with no judgment; it breaks silently when screens or processes change.
- Continuous monitoring is management-owned and must itself be tested; continuous auditing is internal audit-owned and supports independent conclusions.
Exam shortcut
Ask "who owns the routine" the moment a stem mentions ongoing automated testing. Management owns it means continuous monitoring, and the correct answer includes testing the routine before reliance. Internal audit owns it means continuous auditing. Stem signals: "the model identified" or "the tool flagged" means the answer is corroborate to source documents, never report the count. "Rule-based, repetitive, high volume" means RPA.
The full lesson (about 2,086 words, 14 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 3
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.