AU-C Section 520 requires auditors to use analytical procedures at two mandatory points in every financial statement audit — during planning and again near the end as part of the overall review — and sets specific conditions that must be met before analytical procedures can stand as substantive evidence for an assertion. The standard, issued by the AICPA’s Auditing Standards Board, also dictates how the auditor must respond when results diverge from expectations by a significant amount.
An analytical procedure, as the standard defines it, is an evaluation of financial information through analysis of plausible relationships among financial and nonfinancial data, together with investigation of fluctuations or relationships that are inconsistent with other information or that differ from expected values by a significant amount.1PCAOB. Comparison of Proposed AS 2305 With ISA 520 and AU-C Section 520 Investigation is part of the definition, not a separate step. The forms these procedures take vary: trend analysis across periods, ratio analysis between accounts or against operating data, reasonableness testing that builds a dollar expectation from underlying drivers, and regression models that quantify expected amounts with measurable confidence. What they share is that no number is looked at alone. Each procedure rests on a relationship, and the stronger and more predictable that relationship, the more useful the procedure.
When The Standard Requires Analytical Procedures
Two applications are mandatory on every engagement.
At Planning
Analytical procedures at the planning stage are not discretionary. Their purpose is to help the auditor understand the entity and identify areas of elevated risk of material misstatement. These procedures work alongside the risk assessment requirements of AU-C 315.
Planning analytics are typically broad. Comparing the current trial balance to the prior year’s, scanning key ratios against industry benchmarks, reviewing quarterly revenue for unusual spikes — the goal is pattern recognition, not precision. An auditor who sees inventory grow 40% while sales drop 10% has found something worth investigating, even without pinning down exact numbers. The results shape the audit plan. Deteriorating receivables turnover pushes the team toward expanded testing of the allowance; consistent revenue patterns may support a lighter substantive approach. The precision threshold at this stage is intentionally lower than what substantive testing demands, because the auditor is mapping risk, not proving balances.
At Final Review
Near the end of the audit, the auditor must perform analytical procedures to help form an overall conclusion about whether the financial statements are consistent with the auditor’s understanding of the entity.1PCAOB. Comparison of Proposed AS 2305 With ISA 520 and AU-C Section 520 By this point the engagement team has completed most fieldwork and built a deep view of the client’s operations, risks, and accounting. The final review is a sanity check against that view: consolidated balances, key ratios, and trends examined against everything learned during the audit.
If something unexpected surfaces this late, the auditor cannot note it and move on. Investigation is required through management inquiry and, if necessary, additional audit procedures. An unexplained jump in deferred revenue caught during the final review might mean reopening substantive testing on that balance with the report deadline approaching. The timing is inconvenient by design. The final review exists to catch what earlier procedures missed.
Using Analytical Procedures As Substantive Evidence
Between planning and final review, an auditor can use analytical procedures as substantive tests — evidence about whether a specific assertion is fairly stated. That use can replace or supplement tests of details, but only when four conditions are met. The bar is considerably higher than at planning.
One limit up front: for assertions involving significant risks of material misstatement, substantive analytical procedures alone are unlikely to provide sufficient evidence, and tests of details will almost always be needed alongside them. Analytical procedures also are not well-suited to detecting fraud, because management override can create artificial relationships that make numbers look reasonable when they are not.2Public Company Accounting Oversight Board. AS 2305 Substantive Analytical Procedures
Suitability For The Assertion
Not every account lends itself to analytical testing. The relationship being analyzed has to be stable and predictable enough to produce meaningful results. Payroll for a company with steady headcount and known pay rates is a textbook candidate; the auditor can build a tight expectation from employee counts and pay scales. A complex litigation accrual involves too much judgment for an analytical procedure to carry alone.
These procedures work best where a misstatement wouldn’t be obvious from examining individual transactions but would show up as an anomaly in the aggregate. Comparing total salaries paid against headcount, for instance, can surface unauthorized payments that wouldn’t appear in a sample of payroll transactions.2Public Company Accounting Oversight Board. AS 2305 Substantive Analytical Procedures
Reliability Of The Data
The expectation is only as good as the data behind it. AU-C 520 requires the auditor to assess data reliability based on its source, the controls over its preparation, and whether those controls have been tested. Data from an independent external source generally carries more weight than internally generated data. Internal data produced by systems with strong, tested controls is more reliable than data from systems the auditor hasn’t evaluated.
Before relying on data for a substantive analytical procedure, the auditor must either test the controls over that data or perform alternative procedures to confirm it is complete and accurate.2Public Company Accounting Oversight Board. AS 2305 Substantive Analytical Procedures Skipping this step is a common failure. If you are relying on the client’s internal production data to build a revenue expectation and you have done nothing to verify that production data, the procedure gives you very little. When the client outsources significant processes to a service organization, the reliability question extends there too, and the auditor may need a SOC 1 report covering that organization’s controls before treating the downstream data as reliable.
Precision Of The Expectation
Precision refers to how closely the auditor’s expectation approximates the true amount, assuming no misstatement exists. A precise expectation narrows the range of acceptable outcomes, making it more likely that a material misstatement will produce a noticeable difference. “Revenue should be somewhere around last year’s level” is not going to catch much.
Several factors drive precision. Disaggregating data improves it — testing revenue by product line and month yields a tighter expectation than testing total annual revenue in one lump. The predictability of the relationship matters. Income statement accounts tied to operational drivers tend to be more predictable than balance sheet accounts, which is why analytical procedures are used more often for income statement assertions. Regression models with quantifiable confidence intervals sit at the high end of the precision spectrum; simple trend comparisons sit at the low end.
Threshold For Acceptable Difference
Before running the comparison, the auditor sets a threshold: the maximum difference between the expected and recorded amounts that can exist without triggering investigation. The threshold must be set at or below the tolerable misstatement for the account being tested.1PCAOB. Comparison of Proposed AS 2305 With ISA 520 and AU-C Section 520 Set it too wide and misstatements that matter will slip through. Set it too narrow and every account throws a flag, drowning the team in follow-up that adds cost without improving audit quality. The threshold should account for the risk that the difference represents a misstatement material on its own or when combined with others in the same account.
Recorded amounts inside the threshold support the conclusion that the assertion is fairly stated. Amounts outside it produce a significant difference that has to be investigated.
Investigating Significant Differences
When any analytical procedure identifies a fluctuation or relationship that differs from the expected value by a significant amount, the auditor must investigate. AU-C 520, paragraph .07, sets a two-step process: inquire of management and obtain audit evidence relevant to the responses, then perform other audit procedures as necessary.1PCAOB. Comparison of Proposed AS 2305 With ISA 520 and AU-C Section 520
Evidence is the critical word. Asking why receivables jumped 35% and accepting the answer at face value does not satisfy the standard. The auditor needs corroborating documentation: sales reports supporting a claimed surge in fourth-quarter orders, contracts backing a new customer relationship, shipping records confirming goods left the warehouse. If management says “we had a strong Q4,” the auditor needs to see the Q4.
When management’s explanation holds up under scrutiny and evidence corroborates it, the auditor can conclude the difference is not a misstatement. When it does not hold up, or when management cannot provide a coherent explanation at all, the auditor pivots to alternative procedures. In practice, that usually means reverting to tests of details: pulling individual invoices, recalculating accruals, confirming balances with third parties. The analytical procedure has failed to provide the assurance needed, and the audit program has to change accordingly.
Documentation The Standard Requires
AU-C 520 requires specific documentation when substantive analytical procedures are performed. The auditor must document the expectation developed, the factors considered in building it, and the results of comparing the expectation to the recorded amount. Weak documentation is one of the most common deficiencies reviewers find. “Expectation: consistent with prior year” is not documentation of an expectation.
The workpaper should show the data used, its source, why it is reliable, the mathematical or logical basis for the expected amount, the threshold set, and the conclusion reached. If a significant difference triggered investigation, the file needs the specific inquiries made, the evidence obtained, and the auditor’s evaluation of whether the difference represents a misstatement. Planning-stage and final-review analytical procedures also require documentation, though the standard allows more flexibility: the procedures performed, the results, and, for the final review, how the results affected the overall conclusion about the financial statements.
Where AU-C 520 Stops
Two boundaries are worth knowing. First, AU-C 520 applies to audits performed under AICPA standards, which generally means non-issuer engagements. Audits of SEC-reporting public companies follow PCAOB AS 2305, which covers similar ground but is more prescriptive in places — it explicitly prohibits building the expectation from the company’s own recorded amount and states that investigating an exceeded threshold “should extend beyond inquiry.”1PCAOB. Comparison of Proposed AS 2305 With ISA 520 and AU-C Section 520 Applying the AU-C approach to a public company audit will not satisfy the PCAOB.
Second, fraud considerations are governed by AU-C 240, not 520. That standard imposes its own requirements on how analytical procedures are used during fraud risk assessment, including a presumption that fraud risks exist in revenue recognition unless the auditor documents why they do not.3Ohio State University. AU-C 240 Consideration of Fraud in a Financial Statement Audit
Consequences Of Non-Compliance
Firms performing audits under AICPA standards are subject to peer review, and analytical procedure deficiencies are among the issues reviewers look for. A firm can receive a deficient or failing rating and enter a remediation process; firms that fail remediation risk having their license revoked by the state board of accountancy.4AICPA & CIMA. Peer Review A Vital Component in Audit Quality
State boards have independent authority to discipline CPAs for failure to follow professional standards, with penalties running from required continuing education to license suspension or revocation in serious cases. Civil liability enters the picture when an audit failure causes financial harm to investors or creditors. A firm that skipped required analytical procedures or failed to investigate a flagged difference has a much harder time defending the quality of its work in litigation. The documentation the standard requires is the auditor’s proof that the work was actually done.