Where should internal audit look next? Using data to plan, predict, detect and evidence

Internal audit teams have more data than time. The question is rarely whether to use analytics, but where it earns its place: choosing what to audit, seeing where risk is heading, finding signs of fraud and keeping evidence in order for a regulator. This guide takes those four jobs in turn for UK audit and risk teams, and says what to ask of any tool that claims to help.

What is risk-based audit planning software for UK enterprises?

Risk-based audit planning software for UK enterprises uses data on risks, past findings and control performance to rank what should be audited and when. It replaces a fixed annual rota with a plan that follows risk, so limited audit hours go to the areas where failure would cost most.

The Chartered IIA's Internal Audit Code of Practice took effect in January 2025. It is principles-based and meant to be applied proportionately, and its supporting guidance includes risk-based internal audit planning in financial services. The profession treats planning from risk as basic practice, and data makes it repeatable.

Useful inputs include risk register scores, the age and number of open findings, control test results, loss and incident data, and changes in people, systems or transaction volumes. Score each auditable area from those inputs, rank them, then let the head of audit challenge the order. The data gives a starting point and the judgement stays with the auditor.

For example, if payments to new suppliers have grown quickly while the supplier onboarding control has not been tested for two years, that area should rise in the ranking without anyone having to argue for it. Common problems are stale inputs, scoring nobody can explain and low-scoring areas that are never looked at. Look for data that refreshes automatically, transparent scoring, overrides that record a reason, and the ability to re-rank during the year.

What is predictive audit analytics software for UK risk teams?

Predictive audit analytics software for UK risk teams looks at historical data to estimate where control failures or losses are most likely next. It flags rising risk early, so audit and risk teams can look at an area before an incident, and not only after one.

The methods can be simple. Trend lines on exception rates, thresholds on overdue actions, and comparisons between branches or business units will often show which area is drifting. Machine learning can add value where there is plenty of clean history, but it is not a starting requirement.

A prediction points to where to look. It is not proof that anything is wrong, and an auditor still has to test the area and form a view. Models trained on thin or biased history can mislead, and a score that nobody can explain will not be acted on.

A practical check is to back-test. Run the model on last year's data and see whether it would have flagged the issues you already know about. If it would not, treat its output with caution. If it would, record the result and use it as the case for relying on it. Keep the number of signals small, review them at a set point each quarter, and feed the ones that hold up into the planning ranking.

What is fraud detection analytics software for UK internal audit?

Fraud detection analytics software for UK internal audit tests whole populations of transactions for patterns that suggest error or fraud, such as duplicates, unusual timing or split payments. It narrows thousands of records to a short list of exceptions that an auditor can investigate and document.

Sampling checks a slice of the records and can miss a pattern that sits across the rest. Testing every record removes that gap and lets the team spend its time on the exceptions. The Chartered IIA's guidance list for the Code also covers financial crime topics, including whistleblowing and anti-money laundering, which shows how far fraud risk reaches into audit work.

Common tests include:

• Duplicate payments, where the supplier, amount and date match or nearly match.
• Payments just below an approval limit, or split across several invoices to stay under it.
• Entries posted at weekends, late at night or by users who rarely post.
• Suppliers that share a bank account or address with an employee.
• Round-sum or repeated amounts that depart from the number patterns expected in genuine data, as in Benford's law tests.

An exception is not a finding. Many have an innocent explanation, such as a legitimate repeat order or an out-of-hours month-end close. Record how each one was resolved, tune thresholds to cut false alerts, and also ask what the tests could not see. A test that never fires may be well controlled, or it may be pointed at the wrong data.

For example, a quarterly duplicate payment test might return 40 exceptions. Thirty are repeat orders, eight are genuine duplicates already recovered and two need investigation. The log of that work is the audit evidence. If the same team keeps appearing, that is a signal to move its area up the planning ranking. Remember too that management owns the controls that prevent fraud. Internal audit tests them and reports, and should not take them over.

What is automated audit intelligence software for FCA compliance?

Automated audit intelligence software for FCA compliance pulls data from source systems, runs agreed tests on a schedule and records the results. For FCA-regulated firms it helps show that internal audit examines systems and controls on evidence, and it keeps a trail of what was checked.

For the firms it covers, SYSC 6.2 of the FCA Handbook requires, where appropriate and proportionate, an internal audit function that is separate and independent from the firm's other functions. That function must keep an audit plan to examine and evaluate the adequacy and effectiveness of systems and internal control mechanisms, issue recommendations, verify compliance with them and report on internal audit matters.

Automation supports each step. Data-led ranking feeds the audit plan. Scheduled tests examine controls. Re-running a test after a fix confirms that a recommendation was acted on, which is the verification step. The result is a dated record that can be shown to a reviewer without rebuilding it from emails.

Automation does not replace independence or judgement. Every scripted test needs an owner, a change history and a note of what data it ran on. Ask whether you could show a reviewer what was tested, on which data, when and with what result, and whether the data was complete. If any of those answers is no, fix that before adding more tests.

Where to start

Start with the planning ranking, because it decides where the other three are used. Add one or two fraud tests to the highest-ranked payment areas, back-test any prediction before relying on it, and keep a record of every automated test. For the external research side of audit work, such as auditor changes, restatements and regulatory filings, Ideagen's audit intelligence software brings more than 70 databases into one place.