AI and data analytics in auditing

What is changing in the way audits are performed, what the standards expect, and what UAE finance teams should do to prepare

-- Audits are increasingly analysing whole populations of transactions, not only testing samples. [Data analytics](https://www.claemirates.com/services/digital-advisory) is already routine in most audits; artificial intelligence is now being added for tasks such as anomaly detection and reading contracts. - The auditing standards have not been rewritten around technology, but they have been modernised to recognise automated tools and techniques. The principles have not changed: the auditor still needs sufficient appropriate evidence, still exercises professional scepticism, and still documents the work. - The quality of the entity's data now matters more than ever. Analytics are only as good as the extract they run on, so auditors spend more time testing completeness and accuracy of system reports. - For UAE finance teams, the practical implications are clean general ledger data, well controlled system access, and readiness for structured data under the national e-invoicing system, which becomes mandatory from 1 January 2027 after a pilot that began in July 2026. - Entities that prepare their data well get faster audits, fewer queries and more useful insights from their auditors. Those that do not will find that technology magnifies their data problems rather than hiding them."

From sampling to full populations: what has changed

For decades, the audit of a large business relied on sampling. An auditor could not examine every invoice, every journal entry and every payment, so a representative selection was tested, and conclusions were drawn about the whole. Sampling is still a valid technique, and it remains appropriate in many situations. But part of the reason for it was a practical limit on how much data could be examined, and that limit has eased.

Modern enterprise systems record every transaction in structured form, and audit firms now have tools that can read millions of lines in minutes. That allows an auditor to analyse an entire population: every journal entry posted during the year, every sales invoice matched to its delivery note and receipt, every user who posted to a sensitive account. Instead of asking "is this sample free of errors?", the auditor can ask, "where in this population are the items that look different, and why?". Analytics work best on data recorded in the system. They do not by themselves show that an asset physically exists, that an estimate is reasonable, or that information held outside the system is complete, and every exception still must be investigated and concluded on.

This changes the shape of the audit more than its objective. Risk assessment becomes more precise, because the auditor can see patterns across the whole year. Substantive testing becomes more targeted, focusing on the exceptions the data reveals rather than on randomly selected items. And the conversation with management shifts towards explaining outliers, which is often more useful to the business than a list of sample errors.

Where analytics are used across the audit today

Data analytics has moved from a specialist add-on to a standard part of most larger audits. It shows up at every stage, although the depth varies by firm, by engagement and by the quality of the data available.

Journal entry testing is the most common example. The auditing standards require auditors to test journal entries for evidence of management override of controls, a risk that exists in every audit and cannot be rebutted. Analytics make it possible to look at every journal and to focus on those with characteristics that are more often associated with fraud or error.

Where AI adds something new

Traditional analytics follow rules set by the auditor: show me all journals posted at weekends or outside normal working hours, all payments to new vendors above AED 500,000, all invoices without a matching delivery note. Artificial intelligence goes further in three ways.

• Anomaly detection. Machine learning models learn what normal looks like for a particular entity, such as which users post to which accounts, at what time and in what amounts. They then flag entries that are unusual for that entity, even if they would not trigger any pre-set rule.
• Reading unstructured documents. Language models can read contracts, lease agreements, board minutes and correspondence, and extract key terms such as payment conditions, termination clauses, guarantees and related party references. Work that can take days of manual review may be done much faster, with the auditor reviewing the output.
• Summarising and drafting. AI tools can summarise large volumes of information, draft working papers and prepare first versions of audit requests and communications, leaving auditors more time for judgement.

Each of these comes with limits. An anomaly is not an error; it is an item that needs explaining. A contract summary produced by an AI model may miss a clause or misread an Arabic term. A draft working paper still needs to be checked by someone who understands the engagement. The value of AI in auditing lies in directing human attention to where it matters, not in replacing the judgement that follows.

From the year-end audit to more continuous analytics

The longer-term direction is towards more continuous work. Where an auditor has secure, regular access to an entity's data, analytics can be run monthly or quarterly rather than once after the year end. Unusual journals, new vendors, credit notes and manual revenue adjustments can be reviewed close to the time they happen, when the people involved still remember the reasons and the supporting documents are easy to find.

For finance teams, this has clear advantages. Issues are raised while they can still be corrected in the period, rather than as audit adjustments in February. The year-end audit becomes shorter, because much of the population has already been analysed. And the same analytics can support internal audit and management reporting, so the investment in data quality pays off more than once.

It also requires trust and structure. Data access needs to be agreed formally, with clear limits on what the auditor can see and how long data is retained. Both sides need to agree what will happen when an exception is found during the year, and who will respond. Entities that already have well controlled systems and a clear data map are in the best position to benefit. The audit opinion still relates to the year-end financial statements, and management remains responsible for monitoring its own transactions. Auditors also need to consider independence: analytics run for audit purposes are part of the audit, but ongoing monitoring that management relies on can create self-review and management responsibility threats.

What the auditing standards expect

The International Standards on Auditing (ISAs), issued by the International Auditing and Assurance Standards Board (IAASB) and adopted for audits in the UAE, are principles based. They do not prescribe specific tools. The IAASB has already modernised the standards to make clear that automated tools and techniques are a legitimate way to perform audit procedures. ISA 315 (Revised 2019), the standard on identifying and assessing the risks of material misstatement, refers directly to automated tools and techniques and applies to audits of periods beginning on or after 15 December 2021. Further changes are proposed but not yet final. In August 2026 the IAASB issued exposure drafts of revised standards on audit evidence, responses to assessed risks and analytical procedures (ISA 500, 330 and 520), which address how auditors evaluate information from systems and use technological tools. Comments close on 15 December 2026, and final approval is not expected before December 2027.

Three principles carry across from traditional audit to technology-enabled audit unchanged.

1. Evidence must be sufficient and appropriate. A tool that identifies 300 exceptions has not produced evidence until the auditor has investigated them and reached a conclusion. The output of an analytic is the start of a procedure, not the end of it.
2. Information used as evidence must be reliable. If the auditor runs analytics on a ledger extract provided by the entity, the auditor must have evidence that the extract is complete and accurate. That usually means reconciling it to the trial balance and understanding the controls over the system that produced it.
3. Work must be documented so that an experienced auditor with no previous connection to the audit can understand it. That includes the data source and extraction date, the reconciliations performed, the scripts and parameters used, the exceptions identified and how each was resolved..

Professional scepticism matters more, not less, when technology is involved. There is a recognised tendency, known as automation bias, to trust the output of an automated system. An auditor who accepts a model's conclusion that "no anomalies were found" without understanding what the model was looking for has replaced one form of risk with another.

Data reliability: why the quality of your data now matters more

When an auditor tests a sample of 40 invoices, a few data quality issues in the wider system may not affect the result. When the auditor analyses the full population, every data issue becomes visible. Missing fields, inconsistent customer codes, duplicate vendors, journals posted with generic descriptions, and transactions recorded in the wrong period all generate exceptions that someone has to explain.

This is particularly relevant in the UAE, where many groups run several systems at once: one enterprise resource planning (ERP) system for the mainland business, another for a free zone entity, and spreadsheets for joint ventures or smaller subsidiaries. Chart of accounts structures differ, and customer and vendor masters are often maintained separately in each system. Descriptions may be in English, Arabic or both. Before analytics can be run, the auditor needs to understand and map all of this, and the cost of doing so is driven by how organised the entity's data is.

Auditors will also test the information produced by the entity, often referred to as IPE. Any report the auditor relies on, such as an aged receivables listing used for expected credit losses or a fixed asset register used for depreciation, needs to be shown to be complete and accurate, and sufficiently precise and detailed for the auditor’s purpose. Where the report is generated by a well-controlled system with standard parameters, that is straightforward. Where it has been exported, edited and reformatted in a spreadsheet, it is not.

Risks: explainability, confidentiality and data protection

The use of AI in auditing raises risks that both auditors and audited entities should understand.

Entities should ask their auditors which tools will be used, where data will be stored and processed, who will have access to it, and how long it will be kept. These are reasonable questions, and a well prepared audit firm will have clear answers.

What it means for UAE finance teams

Finance teams do not need to become data scientists to benefit from technology-enabled audits. But a few steps make a large difference to the cost, speed and quality of the audit.

• Know your systems. Maintain a simple map of which systems hold which data, who owns them, and how they connect to the general ledger.
• Make extracts repeatable. Agree with the auditor early on the format of full general ledger, sub-ledger and master file extracts, and produce them directly from the system, not through edited spreadsheets.
• Clean the master data. Remove duplicate vendors and customers, close dormant accounts and make sure related parties are flagged.
• Control access. Review who can post journals, approve payments and change master data. Analytics will show the auditor exactly who did what.
• Use meaningful descriptions. Journals described as "adjustment" or "as discussed" generate questions. A short, specific description saves time later.

The UAE’s national e-invoicing system adds another reason to prepare. Under Ministerial Decision No. 244 of 2025, as amended in 2026, structured electronic invoices will be exchanged through accredited service providers for all transactions other than business-to-consumer sales. A voluntary pilot started on 1 July 2026. Businesses with revenue of AED 50 million or more must appoint a provider by 30 October 2026 and go live on 1 January 2027. All other businesses must appoint a provider by 31 March 2027 and go live on 1 July 2027, and in-scope government entities go live on 1 October 2027. Structured invoice data will make full population testing of revenue and purchases more straightforward, and will make inconsistencies between the ledger and the invoice data easier for both auditors and the tax authority to see.

Practical example: Sharjah Co's journal entry analytics

The following example is illustrative. Sharjah Co is a fictional company and the figures are not from a real engagement. Sharjah Co is a manufacturing group with a mainland company and a free zone trading company, each on a different ERP system. For the year ended 31 December 2025, its auditors decided to analyse every journal entry rather than select a sample of manual journals.

The first step was to obtain full journal extracts from both systems and reconcile them to the trial balances. The extracts contained 1,200,000 journal lines. The reconciliation identified a difference in the free zone company caused by an unposted recurring journal, which was corrected before the analysis continued. Without that step, the analytics would have run on an incomplete population.

The auditors then applied a set of risk criteria agreed during planning, and an anomaly detection model trained on Sharjah Co's own posting patterns from the previous two years. The auditors recognised that a model trained on past patterns treats earlier errors as normal, so they used its output as a starting point and documented why it was fit for the purpose.

In total 13,310 lines were flagged, about 1.1% of the 1,200,000 lines, and many met more than one criterion. The auditors combined the results into a risk score for each journal and selected the 340 journals with the highest scores for review. The finance team explained 315 of them quickly: most were recurring accruals posted manually by a new team member, which the auditors also noted as a control point, and weekend postings during the year end close. The remaining 25 required supporting documents and discussion with management.

Two of the 25 resulted in adjustments. A manual journal of AED 850,000 had recognised revenue in December for goods that were shipped in January, when control had not passed to the customer by the year end, a cut-off error. The related cost of AED 610,000 had also been removed from inventory. A second journal of AED 320,000 had posted a subcontractor charge to capital work in progress rather than to cost of sales. The entries to correct them were as follows (amounts exclude VAT):

The net effect was to reduce profit before tax by AED 560,000: revenue down AED 850,000, cost of sales down by AED 610,000 for the reversed shipment and up by AED 320,000 for the reclassified charge. More valuable than the adjustments themselves were the findings about process. The analysis showed that 3,900 journal lines had blank or generic descriptions. A separate review of user access and vendor master data changes, run alongside the journal analysis, showed that one user in the free zone company could both create vendors and post payments. These points went into the management letter with specific recommendations.

Common pitfalls we see in practice

• Extracts that do not reconcile. Data is provided from a report rather than the underlying tables, or filtered before export, so the population is incomplete and the analytics have to be rerun.
• Late data requests. Extracts are requested and provided after year end, leaving no time to resolve exceptions before the reporting deadline.
• Treating flagged items as findings. Management becomes defensive about exceptions that are simply unusual, rather than explaining them, which slows the audit.
• Public AI tools used with confidential data. Staff paste contracts or ledger data into consumer AI tools to save time, creating data protection and confidentiality risks.
• Several systems, no mapping. Groups with multiple ERPs have no common chart of accounts mapping, so analytics across the group require heavy manual preparation.
• No follow-through. Process weaknesses identified by analytics are not fixed, so the same exceptions appear year after year.

Conclusion

Technology is changing how audit evidence is gathered, but not who is responsible for it. The auditor still needs sufficient appropriate evidence, still has to understand what the tools are doing, and still has to exercise judgement over every conclusion. Management remains responsible for the financial statements and for the data and controls that produce them.

For UAE finance teams, the opportunity is real. Clean, complete and well controlled data allows auditors to work faster, focus on genuine risks and provide insights that a sample-based audit cannot. Poor data has the opposite effect: analytics turn every inconsistency into an exception that needs explaining. With e-invoicing making transaction data more structured and more visible from 1 January 2027, and large businesses due to appoint a service provider by 30 October 2026, now is the time to get the basics in order..

How CLA Emirates can help

Our audit and advisory teams combine technical accounting knowledge with practical data experience. We can help you:

• Assess your audit data readiness, including system extracts, master data quality and access controls.
• Run journal entry and transaction analytics ahead of the audit to identify and resolve exceptions early.
• Prepare for e-invoicing by aligning invoice data with your general ledger and reporting processes.
• Develop policies for the responsible use of AI tools in your finance function, including data protection.

Disclaimer: This article provides general information only and does not constitute legal, tax or accounting advice.