How do auditors test management-owned analytics?

Test both design and operation. For design, understand the control objective, source data, population, join logic, threshold, owner, frequency, and exception workflow. For operation, inspect evidence that the analytic ran, exceptions were reviewed, follow-up was performed, and unresolved items were escalated.

Auditors should also validate data reliability. A clean exception report is weak evidence if the population is incomplete, field definitions are misunderstood, or filters exclude high-risk transactions.