CIA-2 - Information Gathering, Analysis, and Evaluation (40% of the exam) - Section B.4
Apply appropriate analytical approaches and process mapping techniques, including structured and unstructured data types, data analytics processes, and diagnostic, prescriptive, predictive, anomaly, and text analysis.
Define process workflow segments and analyse them through process mapping, walk-throughs, and responsibility assignment matrices to understand how a process actually operates. Distinguish structured from unstructured data, follow a data analytics process from defining objectives through obtaining, normalising, and analysing data to communicating results, and select the appropriate analysis method, whether diagnostic, prescriptive, predictive, anomaly detection, or text analysis, for the question being asked.
Process mappingData analytics processAnomaly detectionPredictive analysis
Practice question for this objective
lock_openFree sampleInformation Gathering, Analysis, and Evaluationhard
During a procurement review, an internal auditor runs an algorithm that flags purchase transactions whose amounts, timing, and approver combinations deviate markedly from the established pattern for that vendor. Which type of data analysis does this technique best represent?
APredictive analysis, because the model estimates the most likely future value of each purchase transaction from prior vendor behaviour.
BPrescriptive analysis, because it recommends the specific corrective control the process owner should implement for the vendor.
CAnomaly detection, because it isolates transactions that diverge significantly from the expected pattern for further examination.check_circle Correct
DText analysis, because it interprets the unstructured narrative descriptions attached to each purchase order line.
Distinguish anomaly detection from predictive, prescriptive, and text analysis by what each technique is designed to produce. Anomaly detection compares each record against a modelled norm and surfaces significant deviations for review, whereas predictive analysis forecasts values, prescriptive analysis recommends actions, and text analysis interprets unstructured language.
Why A is wrong: Predictive analysis forecasts a future outcome or value; it is tempting because both use historical patterns, but flagging deviations from an existing pattern is detection of the unusual, not a forecast.
Why B is wrong: Prescriptive analysis advises what action to take; it is plausible because auditors act on the results, but the technique itself only identifies outliers and does not recommend a control.
Why C is correct: Anomaly detection identifies records that depart from an established norm so they can be investigated, which is exactly what flagging unusual amount, timing and approver combinations does.
Why D is wrong: Text analysis extracts meaning from unstructured language; it is tempting where free-text fields exist, but the technique described works on structured amounts, dates and approvers, not narrative text.
Exam traps in Information Gathering, Analysis, and Evaluation
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-2 bank for this domain.
The comments are structured data suited to text analysis, whereas the ledger is unstructured data that must first be parsed into fields before it can be queried.
errorWhy it is wrong: This inverts the definitions; it is tempting if the terms are half-remembered, but free text is unstructured and a ledger is structured, so the labels are reversed.
Descriptive analytics, because it summarises what happened by reporting the totals and trends in the payment data
errorWhy it is wrong: Tempting because a summary of the spike is a useful starting point, but descriptive analytics only reports what occurred and does not explain the drivers behind it.
Distribute a self-assessment survey to warehouse staff asking how they believe the receiving controls operate
errorWhy it is wrong: A survey captures staff perceptions and is a useful input, but it does not let the auditor follow one transaction through the process or watch the controls operate, so it is weaker for this objective.