ISA 520: Analytical Procedures: Complete Guide

What is ISA 520?

Most audit teams think of analytics as “the easy bit.” You pull the TB, compare PY to CY, highlight anything that moved more than 10%, ask management to explain the big ones, and move on. That version of analytics barely qualifies as a risk assessment procedure under ISA 315, let alone a substantive procedure under ISA 520.

ISA 520, titled “Analytical Procedures,” is built on a simple premise: financial data does not exist in isolation. Revenue relates to units sold. Payroll relates to headcount. Depreciation relates to the asset base. When the auditor genuinely understands these relationships, deviations from expected patterns become evidence that something may be wrong.

The standard covers two specific uses: substantive analytical procedures during fieldwork and the mandatory overall review at completion. Analytical procedures at planning (risk assessment) are governed by ISA 315, though the underlying technique is the same.

The three uses of analytical procedures in an ISA audit

Substantive analytical procedures

Here is what actually happens on most engagements. The senior opens last year’s WPs. They copy the analytics template. They paste in CY numbers from the TB. They note the variances. If anything moved more than 10% (a threshold that someone picked years ago and nobody has revisited since, sometimes called a PIOOMA number in the profession), they ask the client to explain it. The client says “volume increase” or “timing difference.” The senior writes it down. Done.

That is not what ISA 520.5 asks for. ISA 520.5 sets out the requirements for using analytical procedures as substantive procedures, meaning procedures that do real evidentiary work, replacing or supplementing tests of detail. The gap between what the standard requires and what teams actually do is where inspection findings live.

The four-step process

Step 1: develop an expectation. The auditor builds an independent prediction of what the recorded amount should be, using known relationships. The expectation should be developed before seeing the actual figure to avoid anchoring bias. I want to be honest about this: genuinely not looking at the TB before building your expectation is very difficult when the software loads it automatically. But the requirement exists because anchoring is real, and ignoring it turns your “independent” expectation into a post-hoc rationalization of whatever number is already on screen.

Sources for developing expectations include PY comparisons, budgets and forecasts, industry data, relationships between financial items (e.g., gross margin applied to revenue), and relationships between financial and non-financial data (e.g., headcount multiplied by average salary equals expected payroll).

Step 2: define a threshold. Before comparing, the auditor determines the amount of difference from the expectation that can be accepted without further investigation. The threshold must not exceed performance materiality and must be low enough to detect material misstatements. At firms like ours, we tie the threshold directly to PM and document why. The alternative (picking 10% because it feels right) is how you end up with a PIOOMA threshold that no reviewer can defend.

Step 3: compare and compute the difference. This is mechanical. Compare the recorded amount to the expectation and calculate the variance.

Step 4: investigate significant differences. Any difference exceeding the threshold requires investigation. The auditor inquires of management, obtains corroborating evidence, and performs additional procedures as necessary. We will return to this step in the investigation section below, because it is where most deficiency findings actually originate.

Factors that determine how much assurance you actually get

ISA 520.A5 identifies four factors. In practice, two of them do most of the work.

Suitability of the procedure for the assertion. Analytics work well for income statement items involving large volumes of predictable transactions (revenue, payroll, depreciation). They are much less suitable for balance sheet assertions like existence, where direct testing is more effective. I think teams over-rely on analytics for receivables and inventory existence precisely because analytics are faster, but faster is not the same as appropriate.

Reliability of the data. Your expectation is only as good as the data underneath it. If the underlying data (budgets, non-financial KPIs, industry benchmarks, client forecasts) is unreliable, the expectation inherits that unreliability. This is the factor teams most often skip over, because testing the reliability of the inputs to your analytic takes time, and the whole point of choosing analytics was to save time.

Precision of the expectation. A disaggregated analysis (e.g., revenue by product line by month) is more precise than a gross comparison (e.g., total revenue CY vs PY). Greater precision means greater assurance and a tighter acceptable threshold. There is a legitimate debate here: some practitioners argue that excessive disaggregation introduces noise rather than signal, because at very granular levels, individual product-month cells fluctuate for reasons that have nothing to do with misstatement. Others (including most regulators) maintain that disaggregation is always better because it reduces the size of misstatement you can detect. Both positions have merit, and the right answer depends on how stable the underlying business is.

Acceptable difference. Tied to materiality. Lower materiality means tighter thresholds and more precise expectations.

Overall review at the end of the audit

The overall review is the procedure nobody wants to do at 11 pm on the night before sign-off. It is also mandatory.

ISA 520.6 requires the auditor to design and perform analytical procedures near the end of the audit that assist in forming an overall conclusion about whether the FS are consistent with the auditor’s understanding of the entity. This is not designed to provide additional substantive assurance about specific assertions. It is a high-level check: do the FS, taken as a whole, make sense in light of everything the team has learned during the engagement?

The standard says this should be a thoughtful exercise performed by someone with deep knowledge of the entity. What actually happens is that a senior or assistant manager runs the PY comparisons, flags the big movers, copies the explanations from the substantive analytics WPs they already completed, and the PM signs off. We have all seen this. The reason it happens is that by completion stage, the team is exhausted, the deadline is real, and the overall review feels redundant when you have already tested every line item. But it catches things that fall between the cracks of line-item testing, and ISA 520.7 is clear: if the review reveals a previously unrecognised RMM, the auditor must revise the risk assessment and perform additional procedures. Even at this late stage. Even when nobody wants to hear it.

Investigating results

This is where analytics break down in practice. Not at the expectation stage, not at the threshold stage, but here, at investigation.

ISA 520.7 applies to both substantive procedures and the overall review. When analytical procedures identify significant or unexpected results, the auditor must inquire of management and obtain appropriate audit evidence relevant to management’s responses, and then perform other audit procedures as necessary in the circumstances.

The word “and” is doing all the work in that sentence. Management’s explanation alone is not sufficient. The auditor must corroborate it. If management says revenue increased 15% because of a new product line, the auditor should verify that product line’s existence and sales data independently. In our experience, teams write down management’s explanation, note it as “plausible,” and move on. That is inquiry without corroboration, and it is the single most common reason analytics fail inspection.

ISA 520.A21 acknowledges that management may not always be able to explain a fluctuation (for example, if management is unaware of a misstatement that caused it). When that happens, the auditor performs additional substantive procedures to determine whether the fluctuation represents a misstatement. An honest “we do not know” from management should sharpen your scepticism, not reduce your workload. Sometimes the reason management cannot explain a variance is that the variance is a misstatement.

Common types of analytical procedures and when they work

Worked example: final analytical review at Fischer Elektrotechnik GmbH

Fischer Elektrotechnik GmbH is a German electrical engineering company with €78M revenue, serving industrial clients across Bavaria and Baden-Württemberg. The engagement team has completed fieldwork. Overall materiality is €780,000 (1% of revenue) and performance materiality is €585,000. The team now performs the mandatory overall review under ISA 520.6 using the analytical review tool.

1. Prepare the analytical review framework. The team compiles a schedule comparing all material income statement and balance sheet line items: CY versus PY, CY versus budget, and key ratios across both periods. Revenue, cost of sales, payroll, depreciation, receivables, inventory, payables, and borrowings are each reviewed individually. Documentation note: record the data sources for each comparison (audited PY figures, management-approved budget, current TB) and confirm the data’s reliability.
2. Identify items requiring explanation. The review flags four items outside the expected range: revenue increased 11% (budget assumed 6%), raw materials cost increased 14%, trade receivables DSO increased from 48 to 61 days, and warranty provisions decreased 22% despite the revenue growth. Documentation note: list each flagged item with the calculated variance, the expected range, and why the variance exceeds the team’s threshold for investigation.
3. Investigate the revenue and cost increases. Management explains that Fischer won a large contract with a new automotive client in Q3, generating €6.2M of additional revenue. The team corroborates this by reviewing the signed contract, delivery records, and invoices. The raw materials increase is consistent with the revenue growth (materials represent 52% of cost of sales, and 14% cost growth against 11% revenue growth reflects a known price increase in copper components). Documentation note: reference the contract number, the delivery records reviewed, and the copper price index data that supports the cost explanation. Cross-reference to the revenue substantive testing WP.
4. Investigate receivables days and warranty provisions. The increased DSO reflects the new automotive client’s 90-day payment terms (versus Fischer’s standard 45 days). The team confirms the contract terms and reviews post-year-end receipts from this customer. The warranty provision decrease is harder to explain. Management says fewer claims were filed. The team examines the claims register and finds that warranty claims actually increased by 8% in volume. Management had reduced the provision rate without documenting a rationale. Documentation note: flag the warranty provision as a potential misstatement. Record the discrepancy between increased claims volume and decreased provision. Refer this to the summary of uncorrected misstatements and discuss with the EP.
5. Complication: the EP pushes back. The EP reviews the warranty finding and asks the team whether €120,000 is material. It is not (PM is €585,000). The EP suggests the team “just roll it forward” as an uncorrected misstatement and move on. The team recalculates: the €120,000 warranty understatement, combined with two other uncorrected misstatements already on the summary (€95,000 inventory count difference and €210,000 accrual timing), brings the total uncorrected misstatements to €425,000. Still below PM, but approaching it. The team documents the aggregation analysis and flags to the EP that if any additional misstatements surface during the remaining completion procedures, the aggregate will breach PM. The EP agrees to request that management correct the warranty provision rather than carry the risk through to sign-off.
6. Conclude the overall review. Three of the four flagged items are satisfactorily explained with corroborating evidence. The warranty provision issue was a previously unrecognised risk that the team caught only because the overall review was not a copy-paste exercise. Management revises the provision upward by €120,000. The overall review confirms that the FS, taken as a whole, are consistent with the team’s understanding of Fischer’s business and results.

This is what a file should look like after a real overall review. Each flagged item was investigated. Management’s explanations were corroborated with independent evidence. One item led to a correction, and the aggregation analysis forced a conversation about cumulative uncorrected misstatements that might otherwise have been deferred.

Practical checklist

1. Build the expectation before looking at the actual figure. Anchoring bias is real. If you see the recorded amount first, your “independent” expectation will drift toward it. Develop your expectation from non-financial data or budget figures before opening the TB (ISA 520.5(a)). Close the TB tab. Build the model in a separate workbook. Then compare.
2. Set and document the threshold before performing the comparison. For a substantive analytical procedure, tie the threshold explicitly to PM. For the overall review, the threshold can be wider but must still be documented (ISA 520.5(b)). If you cannot explain how you arrived at your threshold, it is a PIOOMA number, and it will not survive review.
3. Disaggregate to increase precision. Total revenue compared CY to PY is a screening tool. Revenue by product line by quarter, with an expectation built from units shipped and average prices, is a substantive procedure. The more disaggregated the analysis, the smaller the misstatement it can detect (ISA 520.A5). But watch for over-disaggregation in volatile businesses where cell-level noise overwhelms the signal.
4. Corroborate every management explanation. When management explains a variance, obtain independent evidence that supports it. A verbal explanation alone does not meet ISA 520.7. If revenue increased because of a new customer, verify the customer contract and the delivery records.
5. Do not skip the overall review because fieldwork was thorough. It is mandatory even when substantive testing covered every balance. Its purpose is different: it catches things that fell between the cracks of line-item testing. If it identifies a previously unrecognised risk, you go back and test it (ISA 520.6). The Fischer example above shows exactly how this works in practice.

Common mistakes and why they persist

These are not new findings. They have appeared in every major regulator’s inspection report for over a decade. The reason they persist is not that auditors are unaware of the rules. The reason is that the incentive structure of a busy season engagement rewards speed over rigour, and analytics are supposed to be the fast option.

• Documenting the “eyeball test” as a substantive analytical procedure. Comparing CY totals to PY totals and noting “broadly consistent” is a risk assessment procedure at best. ISA 520.5 requires a four-step process: expectation, threshold, comparison, investigation. Omit any step and the procedure provides no substantive evidence.
• Accepting management’s explanation without corroboration. The FRC’s 2025 inspection cycle identified valuation and estimates as the top finding area, and a recurring driver was teams accepting management’s narrative for analytical variances without testing whether it held up. ISA 520.7 says the auditor must inquire of management and obtain evidence relevant to those responses. Inquiry alone is not a procedure. Writing down what the CFO said is not evidence.
• Delegating the overall review to a junior team member who runs it as a mechanical comparison. The overall review requires someone who understands the entity well enough to spot inconsistencies that a formula cannot catch. A PM or EP who has been involved throughout the engagement should perform or closely supervise it (ISA 520.6).
• Using thresholds inherited from PY WPs without re-evaluating them against CY materiality. If materiality changed, your thresholds must change with it. We have seen files where PM dropped by 40% between years but the analytics thresholds stayed the same because the team just rolled the template forward.

Related content

• Analytical procedures (glossary) covers the definition and the three stages at which analytics appear in an ISA-compliant audit.
• Analytical review tool helps you build structured expectations, set thresholds, and document the four-step process for substantive analytics.
• How to perform analytical procedures under ISA 520 (blog) is a step-by-step guide with additional worked examples for substantive analytics during fieldwork.

ISA 520 in your jurisdiction

In the Netherlands, COS 520 follows ISA 520 closely. AFM inspections have repeatedly cited deficiencies in substantive analytics, particularly the lack of an independent expectation, insufficient precision (too aggregated), reliance on management’s explanations without corroboration, and failure to set and document a threshold before performing the comparison.

In Germany, IDW PS 520 adapts ISA 520. German practice traditionally favours detailed substantive testing over analytics, but the use of substantive analytics is increasing for large-volume transaction streams. WPK inspections focus on whether analytical procedures are supported by documented expectations and thresholds.

In the United Kingdom, ISA (UK) 520 is substantively aligned with ISA 520. FRC inspections consistently identify substantive analytics as an area of concern: auditors relying on analytics without sufficient precision, failing to investigate unexpected results adequately, confusing the overall review with substantive work, and setting thresholds without linking them to PM.

In France, NEP 520 implements ISA 520. French practice uses analytical procedures (revue analytique) extensively at planning and as part of the overall review. H3C inspections examine whether analytical procedures are properly documented in the dossier de travail and whether their conclusions are consistent with the overall audit approach.

Frequently asked questions

Can substantive analytical procedures replace all tests of detail?

For some assertions, yes. Analytics work well for income statement items where the relationship between variables is strong and the data is reliable. However, ISA 330 requires tests of detail for significant risks, and for assertions like existence of assets, tests of detail are inherently more effective. In practice, we find that analytics are best used alongside tests of detail rather than as a full replacement, except for highly predictable line items like depreciation or straightforward payroll.

How precise does the expectation need to be?

Precise enough to detect a misstatement that could be material, individually or when aggregated with other misstatements. The more the auditor relies on the analytical procedure (meaning the less it is supplemented by tests of detail), the more precise the expectation must be. Disaggregation (breaking down the analysis by location and product, or by product and period) is the primary tool for increasing precision.

Is the overall review the same as substantive analytical procedures?

No. They serve different purposes. The overall review is a mandatory completion procedure that acts as a consistency check. It does not provide targeted evidence about specific assertions. If the overall review reveals a potential issue, the auditor must go back and perform additional procedures. The overall review itself does not resolve anything.

What if management cannot explain a fluctuation?

The auditor performs additional audit procedures to determine whether the fluctuation represents a misstatement. The inability of management to explain a significant variance should increase the auditor’s professional scepticism about the area and may indicate a need for more extensive testing. In our experience, this situation is more common than teams expect, and it almost always leads to additional work at the worst possible time in the engagement.

Further reading and source references

• IAASB Handbook 2024, ISA 520 full text. The authoritative source including all application material.
• ISA 315 (Revised 2019), Identifying and Assessing Risks of Material Misstatement. Governs analytical procedures at the risk assessment stage.
• ISA 330, The Auditor’s Responses to Assessed Risks. The framework within which substantive analytical procedures are designed.
• ISA 500, Audit Evidence. The general framework for evaluating the sufficiency and appropriateness of evidence obtained from analytical procedures.

This guide reflects the ISA 520 text as published in the IAASB 2024 Handbook. National implementations may include additional requirements. Always consult the applicable national standard alongside the international text. This content is for educational purposes and does not constitute legal or professional advice.

Related ciferi content

Related guides:

Put audit concepts into practice with these free tools: