data integrity audit — A practical guide to understanding and applying this topic.
Introduction
Data integrity — the accuracy, completeness and consistency of data over its lifecycle — is a specific problem internal auditors increasingly need to understand. With growing reliance on IT systems and the introduction of AI into decision-making, traditional audit techniques can miss controls that affect data reliability. This article explains how a structured approach to IT governance and AI audit helps internal auditors identify and test data integrity risks, with practical examples and clear next steps you can apply immediately.
Why data integrity is a modern audit challenge
Data flows across multiple systems, is transformed by algorithms, and is accessed by many users. Weaknesses can arise from configuration errors, inadequate change management, poor access controls, or biased machine-learning models. Internal auditors must therefore combine IT governance knowledge with AI-specific audit techniques to evaluate whether data used for reporting and decision-making remains trustworthy.
Key areas to focus when auditing data integrity
- Data lineage and ownership: Understand where data originates, how it is transformed, and who is accountable.
- Change and configuration management: Verify processes for software updates, model retraining, and parameter changes.
- Access controls and segregation of duties: Check who can read, change or delete source data and model parameters.
- Model governance for AI: Assess documentation on model purpose, training data, validation results and monitoring plans.
- Monitoring and exception handling: Evaluate automated alerts, reconciliation routines and incident response actions.
Hypothetical work example: auditing a revenue recognition pipeline
Scenario (hypothetical): An organization uses an automated pipeline that extracts sales records from a POS system, enriches them with customer loyalty data, applies a rules-based engine and a small machine-learning model to estimate returns, and posts journal entries to the general ledger.
Audit steps you might take:
- Map the data flow: document each system and transformation from POS to GL, including intermediate files and APIs.
- Confirm ownership: identify individuals responsible for each system and for the model that estimates returns.
- Inspect change controls: review recent updates to the POS configuration, the ETL scripts and the model. Verify approval records and testing artifacts.
- Test access rights: sample user accounts with write access to ETL scripts or model parameters; check for orphaned or shared service accounts.
- Validate reconciliations: perform end-to-end sample reconciliations from POS transactions to GL entries and evaluate exception logs.
- Assess model inputs and outputs: review the training dataset characteristics, look for drift in input distributions and test model output stability on known cases.
Findings from this approach might reveal, for example, that a recent configuration change increased the number of excluded transactions, or that a model retraining used a truncated dataset—both conditions that could materially affect reported revenue if not detected and corrected.
Practical audit techniques and tools
- Use reproducible sampling: Capture transaction batches at different points in the pipeline and compare counts and amounts to detect losses or duplicates.
- Leverage logs and hashes: Where feasible, use cryptographic hashes or checksums on files exchanged between systems to detect unintended alteration.
- Baseline model behavior: Maintain a set of benchmark inputs and expected outputs for models to detect drift after retraining or parameter changes.
- Control self-assessments: Have system owners complete focused questionnaires on recent changes, testing and monitoring activities to gather documentary evidence quickly.
- Collaborate with IT and data science: Engage specialists early to help interpret technical artifacts such as model training logs, ETL scripts, and API definitions.
Actionable next steps for internal auditors
- Perform a short scoping review: identify two or three high-volume or high-impact data pipelines that feed financial reporting or major business decisions.
- Request key artifacts: data flow diagrams, system owner lists, recent change logs, model documentation and reconciliation procedures.
- Run targeted tests: select representative samples for end-to-end reconciliation and test one model for input drift using simple statistical checks.
- Report clear remediation steps: when you find control gaps, recommend practical actions such as formalizing change approval, adding automated reconciliations, or documenting model retraining procedures.
- Build follow-up into your plan: schedule monitoring steps to confirm remediation and consider periodic model performance reviews as part of continuous auditing.
Where to learn these skills
Developing competence in IT governance and AI audit techniques is best done through structured learning combined with hands-on practice. Programs that combine up-to-date standards guidance, real-world case studies and worked examples can accelerate learning. For a comprehensive option that covers the 2026 syllabus updates, practical case studies and practice questions, consider the EasyPathUni program on The New Internal Auditor Professional Track: The New Internal Auditor Professional Track™.
Understanding data integrity in modern environments requires auditors to expand beyond traditional sampling and control testing. By focusing on data lineage, change management, access controls and model governance, you can design audits that surface the most relevant risks and provide management with actionable recommendations.
Next step: View the course details and start learning.
