Predictive analytics in auditing uses statistical and machine-learning models built on historical data to forecast expected account balances, classify transactions by risk, and flag deviations across entire populations rather than small samples. The approach lets auditors test millions of records for anomalies that manual review would miss, and the PCAOB has formalized how it fits into an audit through amendments to AS 1105 and AS 2301 that take effect for fiscal years beginning on or after December 15, 2025.1Public Company Accounting Oversight Board. PCAOB Updates Its Standards To Clarify Auditor Responsibilities When Using Technology-Assisted Analysis The tools don’t replace professional judgment. They sharpen it.
The Core Techniques
Regression Analysis
Regression builds a mathematical relationship between financial variables to project what a balance should look like given historical patterns. An auditor might model the link between advertising spend and subsequent revenue to test whether reported sales align with what the data predicts. When the actual figure diverges sharply from the model’s expectation, that variance becomes a target for deeper testing. The technique works best when the variables share a genuine economic relationship and enough historical data points exist to produce a reliable trend line.
Time-Series Analysis
Time-series analysis tracks data recorded at regular intervals to identify seasonal patterns, cyclical trends, and long-term shifts. A retail company’s quarterly revenue should show predictable holiday-season spikes year after year. When a quarter breaks from the established pattern without an obvious business explanation, that anomaly deserves scrutiny. The technique is especially useful for industries with pronounced seasonal swings, such as agriculture and hospitality, where timing drives much of the financial picture.
Classification Modeling
Classification models sort individual transactions into categories such as low, moderate, or high risk based on defined characteristics. Rather than reviewing every line item with the same intensity, auditors channel effort toward transactions the model flags as unusual. Accuracy depends on whether the parameters defining each category reflect genuine risk factors rather than arbitrary cutoffs, and getting the criteria right is where the auditor’s understanding of the business matters most.
Where Auditors Apply the Models
Revenue Recognition
Revenue is one of the most manipulation-prone areas in financial reporting. By modeling expected sales volumes based on production capacity, market demand, and historical conversion rates, an auditor can identify gaps where actual reporting diverges significantly from the model’s output. Those gaps often point to sales booked prematurely, spread across incorrect periods, or fabricated entirely. The technique carries particular weight for companies recognizing revenue over long-term contracts, where the timing of recognition involves substantial management judgment.
Fraud Detection
Fraud models scan for behavioral patterns that deviate from normal transactional baselines. One established technique compares the leading digits of financial data against Benford’s Law, which predicts that naturally occurring numerical datasets will show the digit 1 as the leading figure roughly 30% of the time, with each successive digit appearing less frequently. When expense reports or journal entries show a distribution that doesn’t match this expected curve, it signals potential manipulation. The methodology is widely accepted in forensic accounting and has been admitted as evidence in federal and state courts.
Algorithms also identify structural red flags: manual journal entries posted outside normal business hours, unusual activity by employees who don’t typically make accounting entries, and payments clustered just below internal approval thresholds. AS 2401 identifies several conditions that increase fraud risk, including an inadequate system of authorization and entries made to unrelated or seldom-used accounts with little explanation. The standard also highlights that management has a unique ability to perpetrate fraud by directly or indirectly manipulating accounting records, which is why override testing is a required component of every audit.2Public Company Accounting Oversight Board. AS 2401: Consideration of Fraud in a Financial Statement Audit
Going Concern Assessment
Evaluating whether a company can stay operational for at least the next twelve months is one of the most consequential judgments an auditor makes. Predictive models simulate future cash flows under multiple economic scenarios, incorporating variables such as debt maturity schedules, interest rate movements, and operating expense trajectories. The Center for Audit Quality notes that management may need to invest significant effort in preparing supportable cash flow projections for the coming twelve months, considering the entity’s current financial condition, obligations, and expected cash flows.3Center for Audit Quality. Going Concern: Management and Auditor Responsibilities
Incorporating external economic indicators, such as those in the Federal Reserve’s supervisory stress test scenarios, alongside company-specific financial data produces a more robust assessment than relying on management’s projections alone.4Federal Reserve. 2025 Stress Test Scenarios If the model shows a meaningful probability of insolvency, the auditor must evaluate whether a modified opinion or additional disclosures are needed.
Data and Infrastructure
A predictive model is only as reliable as the data feeding it. Effective models draw on historical financial ledgers, non-financial operational records such as production volumes and headcount, and external benchmarks such as industry growth rates or consumer price index changes. That combination lets the auditor account for both internal performance and the broader economic environment.
Before analysis begins, data goes through an extraction, transformation, and loading process that standardizes information from different accounting systems, removes duplicates, and corrects formatting inconsistencies. Most analytics projects succeed or fail in this preparation phase. Dirty data produces unreliable outputs regardless of how sophisticated the model is, and auditors who skip rigorous cleaning often find themselves chasing false positives that waste time and erode confidence in the tools.
Infrastructure matters too. Cloud environments provide the storage and processing power to handle large transaction volumes without interfering with the client’s production systems, and they need strong encryption and access controls. When an audit firm relies on third-party cloud platforms, PCAOB Quality Control Standard 1000 requires the firm to understand how those external resources are developed and maintained, and to adapt them as necessary to meet professional and legal requirements. QC 1000 also requires firms to ensure their technological resources have the capacity, integrity, resiliency, availability, reliability, and security needed for both the quality control system and individual engagements.5Public Company Accounting Oversight Board. QC 1000, A Firm’s System of Quality Control
Validating the Model and Documenting the Work
Running a predictive model is the easy part. Proving it produced reliable audit evidence is where the real work begins. Under AS 1105, when an auditor uses information produced by the company as audit evidence, the auditor must either test the accuracy and completeness of that information directly or test the controls over it, including IT general controls and automated application controls. The standard also requires that the information be sufficiently precise and detailed for the audit’s purposes.6Public Company Accounting Oversight Board. AS 1105: Audit Evidence A model that produces vague directional outputs without traceable inputs won’t meet that bar.
Documentation is equally demanding. AS 1215 requires that audit documentation contain enough information for an experienced auditor with no prior connection to the engagement to understand the procedures performed, the evidence obtained, and the conclusions reached. For predictive analytics, that means documenting the model’s inputs, the logic behind variable selection, validation steps, the results, and how anomalies were investigated.7Public Company Accounting Oversight Board. AS 1215: Audit Documentation
Models also degrade. A regression trained on five years of pre-pandemic data may produce unreliable expectations when applied to current-year transactions in an economy that has shifted structurally. Auditors should monitor for drift by comparing predictions against actual results throughout the engagement and recalibrating when the gap widens beyond acceptable ranges. Treating a model as a set-it-and-forget-it tool is a common mistake that can undermine the entire analytical framework.
Standards Governing the Use
PCAOB Amendments to AS 1105 and AS 2301
The PCAOB’s amendments to AS 1105 (Audit Evidence) and AS 2301 (The Auditor’s Responses to the Risks of Material Misstatement) specifically address technology-assisted analysis of electronic data. They take effect for audits of fiscal years beginning on or after December 15, 2025, applying to virtually every public company audit conducted in 2026 and beyond.
The amendments require auditors using technology-assisted analysis to evaluate the reliability of the electronic information being analyzed, either by testing the information directly to determine whether it has been modified, or by testing controls over the receiving, maintaining, and processing of that information. When an analysis identifies specific transactions or balances warranting further investigation, auditors must determine whether those items individually or in the aggregate indicate misstatements or control deficiencies. If a single analytical procedure serves more than one purpose, the auditor must achieve each objective independently.8Public Company Accounting Oversight Board. Amendments Related to Aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form
The practical significance is that auditors can now use technology-assisted analysis to examine a full population of transactions, both for identifying risks of material misstatement and for performing substantive procedures. The standards explicitly contemplate this approach rather than treating it as an extension of traditional sampling.
AICPA SAS 142 and SAS 145
On the non-public company side, AICPA Statement on Auditing Standards No. 142 updated the foundational guidance on audit evidence, superseding the prior framework under SAS 122. The standard emphasizes professional skepticism when interpreting outputs from analytical tools, requiring auditors to question the assumptions baked into their models and ensure that findings reflect actual financial conditions rather than artifacts of the model’s design.9American Institute of Certified Public Accountants. Statement on Auditing Standards 142 Audit Evidence
SAS 145 modernizes risk assessment for IT-related risks. It requires auditors to assess inherent risk and control risk separately, document the rationale for significant judgments, and includes a stand-back requirement that forces auditors to evaluate whether their identification of significant transaction classes and account balances is complete. The standard also pushes auditors to tailor procedures to specific risks rather than relying on standardized audit programs, which is exactly the kind of targeted approach predictive analytics enables.
QC 1000: Firm-Level Technology Oversight
PCAOB Quality Control Standard 1000, effective December 15, 2026, establishes firm-level quality objectives for technological resources. Firms must ensure their technology is obtained, developed, implemented, and maintained in a way that supports both the quality control system and individual engagements. Resource planning, including technology budgets and capacity, must be addressed at the governance level. Predictive analytics isn’t just an engagement-level decision. Firms need infrastructure, policies, and oversight structures that support the reliable use of these tools across all engagements.
Bias, Third-Party Risk, and the Limits of the Standards
Predictive models inherit the biases present in their training data. A fraud detection algorithm trained primarily on data from one industry or time period may systematically overlook patterns common in other contexts, or flag benign transactions as suspicious because they resemble anomalies from a different operating environment. Auditors who accept model outputs uncritically risk building conclusions on a skewed foundation.
The PCAOB amendments address part of this concern by requiring auditors to evaluate the reliability of electronic information used in technology-assisted analysis and to achieve each objective of a multi-purpose procedure independently. But the standards don’t yet prescribe specific bias-testing procedures for algorithms. That gap leaves auditors to exercise professional judgment about how to test for and mitigate model bias. The AICPA has published guidelines for the responsible use of AI in forensic and valuation engagements, noting that AI introduces specific risks and professional responsibilities, but those guidelines are explicitly described as neither authoritative guidance nor standards.10AICPA & CIMA. Guidelines for Responsible Use of Artificial Intelligence (AI) in Forensic and Valuation Services Engagements Firms are largely on their own when it comes to developing internal policies for vetting algorithmic tools, testing for bias, and ensuring that reviewers understand the model’s logic well enough to challenge it meaningfully.
Audit analytics platforms also process sensitive financial records, employee data, and proprietary business information, often on third-party cloud infrastructure. SOC 2 examinations provide one framework for evaluating third-party service organizations across security, availability, processing integrity, confidentiality, and privacy.11AICPA & CIMA. SOC 2 – SOC for Service Organizations: Trust Services Criteria Requesting and reviewing a current SOC 2 report from any analytics vendor is a baseline step. Several states now require businesses that process large volumes of personal information to complete annual cybersecurity audits and risk assessments, with compliance timelines phasing in based on company revenue, creating a dual obligation to protect client data processed during the engagement and to verify that the client’s own data governance practices meet applicable legal requirements.