Accounting data analytics: what it is and how finance teams use it

In a 2024 Gartner survey of 497 accountants, 59% reported making several financial errors every month. The controls built into most finance processes are not designed to catch those errors one at a time. A three-way match, an approval threshold and a signed reconciliation confirm that a process ran. They say little about what happened inside the millions of entries that passed through it.

Accounting data analytics closes that gap. It takes the transaction and master data already sitting in the ERP, standardizes it, and tests all of it against rules that describe what a correct entry looks like. The output is a working list of entries that break a rule, with enough context to judge whether each one is a mistake, a policy breach or fraud.

What is accounting data analytics?

Accounting data analytics applies analytical techniques to the transaction and master data produced by accounting processes, to detect errors, policy breaches and fraud, and to evidence how a process behaved.

Three characteristics set it apart from the reporting work finance teams already do.

The data is operational: general ledger entries, sub-ledger lines, vendor and customer master records, purchase orders, payment files, expense claims and bank statements, at individual record level, not the summarized figures they roll up into.

The tests describe correctness, not performance. A control looks for two invoices from the same supplier with the same amount and date, a supplier bank account changed within 48 hours of a payment run, or a manual journal posted on a Sunday by a user who posts nothing else. Each one encodes a specific way a transaction can be wrong.

The result is an exception with a population behind it. When a control returns 340 suspect invoices out of 1.2 million, both numbers matter: the 340 need investigating, and the 1.2 million are evidence that nothing else broke that rule. That second half is what turns the output into control evidence. The mechanics are covered in transaction data analysis.

Accounting analytics vs audit analytics vs BI

These three categories use overlapping technology and are routinely treated as one thing. They answer different questions, for different owners.

The ownership split is the part that matters operationally, and the one the standards address. The IIA's GTAG: Continuous Auditing (2nd edition, 2015) describes continuous monitoring as a management process, overseen by compliance, risk or the functions that own the risk, while continuous auditing comprises the ongoing assessments internal audit performs. Management runs the controls; internal audit tests whether they work.

Audit analytics has its own definition. The AICPA's Guide to Audit Data Analytics (2017) describes it as the discovery and analysis of patterns, identification of anomalies and extraction of other useful information in data underlying the subject matter of an audit, for the purpose of planning or performing that audit. The purpose clause is the distinction: the same duplicate-invoice test is accounting analytics when accounts payable runs it to stop a payment, and audit analytics when internal audit runs it to conclude on the P2P control environment.

Business intelligence sits further away: a dashboard showing supplier spend by category will not tell you that one of those suppliers shares a bank account with an employee. For the assurance side, see audit analytics and continuous control monitoring.

The four types of analytics in accounting

The descriptive, diagnostic, predictive and prescriptive ladder comes from the analytics maturity model popularized by Gartner, built on an earlier three-level scheme from IBM researchers. It is useful for describing what a given control does, and misleading as a roadmap.

Descriptive analytics reports what happened: invoice volumes by entity, manual journal counts by user, the distribution of expense claims by amount. Most finance teams already have this layer in some form.

Diagnostic analytics explains why. Duplicate payments tripled in one subsidiary last quarter; diagnostic work traces that to an ERP interface that stopped enforcing invoice-number uniqueness in March. Most of the value lives in these first two layers, because most of the money is lost to things that already happened and were never found.

Predictive analytics estimates what will happen: which customers are likely to pay late, which vendors are likely to trigger a penalty clause. It serves working capital planning well and works poorly as control evidence, because a probability is not an exception.

Prescriptive analytics recommends an action: close this invoice as a false positive, block this payment, route this claim to a manager. In practice this is anomaly scoring and exclusion management, telling a reviewer which 40 of 340 exceptions to open first.

The AICPA organizes audit data analytics by the phase of work it supports instead: risk assessment, tests of controls, substantive procedures. That framing is closer to how a control team plans its year, and worth remembering when a vendor presents the four-level ladder as a maturity path to climb.

Accounting data analytics by process

Finance teams organize their work by cycle, and so does the control library on top of it. The ACFE's Occupational Fraud 2026: A Report to the Nations, based on 2,402 investigated cases, estimates that organizations lose 5% of revenue to fraud each year, with a median loss of $104,000 per case and a typical 12 months before detection. Those losses land in specific cycles, each with its own data, failure modes and controls.

Procure-to-pay

P2P is where analytics usually starts, because the errors are unambiguous and the recovery is measurable. A duplicate payment is either a duplicate or it is not, and the money either comes back or it does not.

The tests that matter run across data sets. Matching invoices against each other catches straightforward duplicates. Matching vendor master changes against the payment calendar catches the pattern payment fraud follows: a bank account updated, a payment released, the account changed back. Matching vendor addresses and bank details against the employee master catches ghost suppliers. None of this is visible in the AP sub-ledger alone.

For scale, the US Government Accountability Office reported in April 2026 that federal agencies estimated $186 billion in improper payments for fiscal 2025, most of them overpayments. That is government benefit programs, not corporate accounts payable, but the mechanism is the same: large payment populations, controls designed for the typical case, errors that surface only when someone tests the whole file. More in purchase-to-pay analytics.

Order-to-cash

O2C analytics looks for revenue that was earned and never collected. Deliveries made but never invoiced, prices billed below the contracted rate, discounts applied outside the approval matrix, credit notes issued to clear a receivable nobody could explain.

APQC's Open Standards Benchmarking data puts median days sales outstanding at 38, with the top quartile at 30 days or less and the bottom quartile at 46 or more. Part of that spread is commercial and part is invoice quality: disputed invoices sit in the ledger until someone resolves them, and testing billing accuracy reduces disputes before they start. See order-to-cash analytics.

Record-to-report

The general ledger is the cycle with the clearest standards backing. Manual journal entries are the mechanism through which management override of controls is executed, which is why PCAOB AS 2401 requires auditors to test the appropriateness of journal entries and other adjustments, and why the IAASB's revised ISA 240, issued in July 2025, requires evidence about the completeness of the journal entry population itself.

The tests follow the risk: entries posted after the close cutoff, entries with no supporting documentation reference, round-sum amounts, postings by users whose role should not generate journals, debits and credits hitting account combinations that appear nowhere else in the year.

APQC data puts the median monthly close at six calendar days, with top performers at five and bottom performers at ten. Analytics shortens the close by removing the reconciliation work that upstream errors create. See record-to-report analytics.

Travel and expense

Expense claims are low in value per item and high in volume, the profile manual review handles worst. The common failure modes: a claim submitted twice in different months, a single expense split into two claims to stay under an approval threshold, a claim dated during recorded leave, and merchant categories the policy excludes.

What has changed recently is that the policy itself can be machine-readable. Testing claims directly against the text of a travel policy, instead of against a hard-coded threshold list, keeps the controls aligned when the policy changes.

Treasury

Treasury is where accounting analytics meets an active adversary. In the Association for Financial Professionals' 2026 Payments Fraud and Control Survey Report, based on 465 US treasury practitioners surveyed in January 2026, 76% of organizations experienced attempted or actual payments fraud during 2025. Checks remained the most targeted method at 58%, followed by ACH debits at 30% and wire transfers at 25%.

Tom Hunt, CTP, director of treasury practice at the AFP, said on release that treasury has solidified its role as a primary line of defense against fraud, and that pairing AI-powered technologies with traditional controls is how the profession keeps pace with changing tactics.

The analytics side of that defense is comparative: this beneficiary has never been paid before, this amount sits outside the historical range for this vendor, this payment file contains a line matching no approved invoice. See payment monitoring.

The data problem nobody talks about

Most accounting analytics projects stall before any analysis happens. The failure is almost never the analytics; it is the three steps that come first.

Extraction is the first. Finance teams typically have access to reports, not to tables. A report has already filtered, aggregated and formatted the data, so the exceptions have often been removed before anyone looks. Analytics needs the underlying records: the journal entry file with header and line detail, the vendor master with its change history, the payment file as transmitted. Getting that out of an ERP on a recurring schedule is its own piece of work, covered in financial data extraction.

Normalization is the second. ERP exports arrive with inconsistent date formats, currency fields that mix amounts and symbols, document types encoded differently by module, and the same supplier spelled four ways across four entities. Surveys outside finance put data preparation at 45% to 60% of analysts' time, in CrowdFlower's 2016 data science survey and Anaconda's 2020 State of Data Science survey. Both are old and neither is finance-specific, so treat that as an order of magnitude, not a benchmark.

Multi-ERP standardization is the third, and it decides whether a control library scales. Deloitte's 2021 Global Shared Services and Outsourcing Survey found 55% of respondent organizations operating a single-instance ERP, leaving close to half on several instances or systems. For them, a duplicate-invoice control written against SAP field names does nothing in NetSuite, and a chart of accounts that differs by entity makes the same control return different results by country.

This is why chart-of-accounts mapping matters more than it sounds. Supervizor handles it with TranscoGPT, which maps charts of accounts between source systems so the same control executes identically across every entity. The test of any platform here: ask whether a control written once runs unchanged on every system in scope, or has to be rewritten per ERP.

From sampling to full-population analysis

Sampling exists because testing everything used to be impossible. An auditor selected 40 invoices from a population of 400,000, tested them, and extrapolated. The method is statistically defensible and it has a structural consequence: a scheme that touches 300 transactions out of 400,000 has roughly a 3% chance of appearing in a 40-item sample.

That trade-off no longer has a technical justification for structured accounting data. The same control that tests 40 invoices can test 400,000, and the marginal cost of the extra 399,960 is close to zero.

The standards have started to reflect this. The PCAOB's amendments to AS 1105 and AS 2301 covering technology-assisted analysis took effect for audits of fiscal years beginning on or after 15 December 2025, so they apply to calendar-2026 audits now under way. Erica Williams, then PCAOB chair, said at the June 2024 adoption that some firms appeared reluctant to perform technology-assisted analysis because the existing standards did not specifically address it. The IIA's Global Internal Audit Standards, effective January 2025, make the point from the other direction: Standard 10.3 requires the chief audit executive to strive to ensure the function has the technology to support the audit process.

Coverage also changes what the control team can say. A sample supports a statement about the population with a confidence interval attached; the full population supports a statement about every transaction in it. That is a different kind of evidence, and an easier conversation with an external auditor.

The ACFE's 2026 report found that more than half of all fraud cases involved either a lack of internal controls or an override of existing controls. Both are population-level problems: a control that does not exist cannot be sampled into visibility, and an override is by definition the transaction designed to look normal. Supervizor runs its 350+ out-of-the-box controls across the full transaction population at every extraction, which makes coverage a property of the system instead of an annual scoping decision.

How to get started

The projects that work start narrow and prove recovery before they expand.

1. Pick one cycle with a measurable outcome. P2P is the usual choice, because duplicate payments produce cash back and a number everyone agrees on.
2. Secure a repeatable extraction, not a one-off file. Involve IT now and specify the schedule. A project that depends on someone manually exporting a file each month ends when that person changes role.
3. Standardize before you test. Map the chart of accounts, reconcile entity and supplier identifiers, agree how currencies and document types are represented. Skip it and your first exceptions will be artifacts of the data, not findings.
4. Run a small set of controls and calibrate the thresholds. Ten well-tuned controls generate a workload a team can absorb. A hundred untuned ones generate a backlog that discredits the programme in its first quarter.
5. Assign an owner to the exceptions before the first run. Analytics produces work. If nobody owns the queue, the results become a report nobody reads, which is how the previous generation of audit analytics licences became shelfware.
6. Measure the false positive rate and tune it down. Track how many exceptions turn out to be genuine, by control, and retune or retire the ones that waste reviewer time. This is the discipline that separates programmes surviving year two from those that do not.
7. Extend to the next cycle once the first one runs itself.

Two decisions shape everything that follows. The first is whether controls are configured or coded, because a control that needs a developer will not be adjusted when the policy changes. Supervizor ships its controls pre-built and configurable to your own thresholds, with Supervizor Studio for custom dashboards and controls. The second is whether exceptions land in a workflow with ownership and an audit trail, or in a spreadsheet. How this connects to the wider control framework is covered in internal control.