Analytical procedures are evaluations of financial information through plausible relationships among financial and non financial data, as ISA (UK) 520 defines them. UK auditors must use them at planning to find risks and near the end of the audit to check that the accounts make sense overall. Using them as substantive evidence is optional, but if the auditor does, ISA (UK) 520 paragraph 5 sets four steps: judge suitability, test the data, build a precise expectation and fix an investigation threshold in advance.

What counts as an analytical procedure?

ISA (UK) 520 paragraph 4 defines analytical procedures as evaluations of financial information through analysis of plausible relationships among both financial and non financial data, including investigation of fluctuations or relationships that are inconsistent with other information or differ significantly from expected values. Paragraph A1 lists comparisons with prior periods, with budgets or forecasts, with the auditor’s own expectations (an estimate of depreciation, for example) and with industry information such as a sales to receivables ratio. Paragraph A2 adds relationships within the figures, such as gross margin percentages, and between financial and non financial information, such as payroll cost against number of employees.

Paragraph A3 says the methods range from simple comparisons to complex statistical analysis. ISA (UK) 315 paragraph A31 notes that automated analytical procedures may be called data analytics. Whatever the tool, the analysis is only as good as the expectation behind it, which is why ratio analysis has limits when used without context.

How are analytical procedures used at the planning stage?

ISA (UK) 315 paragraph 14(b) makes analytical procedures a required risk assessment procedure on every audit. Paragraph A27 explains the purpose: to identify inconsistencies, unusual transactions or events, and amounts, ratios and trends that indicate risks of material misstatement, especially due to fraud. Paragraph A29 notes that planning analytics often use data aggregated at a high level, so they give only a broad initial indication of where misstatement may lie.

Paragraph A30 of ISA (UK) 315 confirms that risk assessment analytics do not have to meet the requirements of ISA (UK) 520, although that standard is useful guidance. In practice the planning review compares draft figures with last year and budget, notes movements that do not fit what the auditor knows about the business, and feeds them into the risk assessment.

When can analytical procedures replace tests of details?

Paragraph A4 leaves the choice between tests of details, substantive analytical procedures or both to the auditor’s judgment of effectiveness and efficiency. Paragraph A6 says substantive analytics suit large volumes of transactions that are predictable over time. Paragraph A7 gives a payroll example: with a known number of employees on fixed rates of pay, total payroll can be estimated accurately enough to reduce detailed testing. Paragraph A8 contrasts a prediction of rental income from rents, units and vacancy rates, which can be persuasive on its own, with a gross margin comparison used to support revenue, which gives less persuasive evidence and is better used alongside other procedures.

There are limits. Paragraph A9 says that if controls over sales order processing are deficient, the auditor may rely more on tests of details for receivables. ISA (UK) 330 paragraph 21 requires that where the response to a significant risk consists only of substantive procedures, those procedures must include tests of details, so an analytical procedure alone cannot answer a significant risk.

What are the four steps in a substantive analytical procedure?

  1. Suitability (paragraph 5(a)). Decide whether the procedure suits the assertion, taking account of the assessed risk and any tests of details on the same assertion.
  2. Reliability of data (paragraph 5(b)). Paragraph A12 lists the source of the information (independent external sources are generally more reliable), comparability, nature and relevance (for example, whether a budget was set as an expected result or as a goal to be achieved), controls over its preparation, and knowledge from prior audits. Paragraph A13 says the auditor may test controls over that information or audit it.
  3. A precise expectation (paragraph 5(c)). The expectation must be precise enough to identify a misstatement that could be material individually or in aggregate. Paragraph A15 notes that gross margins are usually more predictable than discretionary costs such as advertising, and that disaggregated data, by branch or product line, gives more precise results than whole company totals.
  4. An acceptable difference (paragraph 5(d)). Decide in advance how big a difference can be accepted without investigation. Paragraph A16 links this to materiality and to risk: the higher the assessed risk, the smaller the acceptable difference.

Illustration: a proof in total of payroll

Illustration only. A company had 20 staff on an average of £2,500 a month for the first half of the year. From the seventh month it gave a 4% pay rise and had 22 staff. The auditor verifies headcount from starters and leavers records and the pay rise from the board minute, then builds the expectation.

Step Amount
Months 1 to 6: 20 staff x £2,500 x 6 £300,000
Months 7 to 12: 22 staff x £2,600 x 6 £343,200
Expected gross pay £643,200
Recorded gross pay £671,000
Difference £27,800
Threshold set before the comparison £15,000

The difference exceeds the threshold, so it must be investigated. Management explains that a £25,000 bonus was paid in the final month. The auditor agrees the bonus to the board approval and the payroll report, leaving an unexplained £2,800 within the threshold. Had management said only that “costs went up”, that would not be evidence.

What happens when the results do not match the expectation?

Paragraph 7 requires the auditor to investigate fluctuations or relationships that are inconsistent with other information or differ from expected values by a significant amount, by inquiring of management and obtaining appropriate audit evidence relevant to management’s responses, and performing other procedures as necessary. Paragraph A20 says responses are evaluated against the auditor’s understanding of the entity and other evidence. Paragraph A21 says other procedures are needed when management cannot explain the difference or the explanation is not adequate. Where the gap remains, the usual next step is a test of details, often by audit sampling.

What is the final analytical review at completion?

Paragraph 6 requires analytical procedures near the end of the audit that help the auditor form an overall conclusion on whether the accounts are consistent with the auditor’s understanding of the entity. Paragraph A17 says they corroborate conclusions already reached on individual areas. A UK addition to that paragraph lists points to consider: whether the accounts reflect the explanations and conclusions obtained during the audit, whether new factors affecting presentation or disclosure have emerged, whether presentation has been unduly influenced by a wish to show results in a favourable or unfavourable light, and the effect of the aggregate of uncorrected misstatements, including bias in estimates, from this year and last.

Paragraph A18 warns that this review may reveal a previously unrecognised risk, in which case ISA (UK) 315 requires the risk assessment and planned procedures to be revised. A completion review that finds a new risk on the day before signing is uncomfortable, but it is exactly what the procedure is for. Late adjustments that change gross margin, or a sudden swing from loss to small profit, deserve particular attention in light of the auditor’s responsibilities on fraud.

What are the common mistakes?

  • Building the expectation from the same unaudited records being tested, so the procedure only proves the ledger agrees with itself.
  • Using a budget that was a sales target rather than a forecast of expected results, contrary to paragraph A12(c).
  • Setting the acceptable difference after seeing the result.
  • Working at whole company level when branch or monthly data would give a sharper expectation.
  • Recording management’s explanation without corroborating it, which paragraph 7(a) does not allow.
  • Relying on analytics alone for a significant risk, which ISA (UK) 330 paragraph 21 rules out.
  • Treating the completion review as a formality rather than a fresh look at whether the numbers fit the story, as described in how a statutory audit works.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.