Study guide
14.3 Diagnostic, Prescriptive, Predictive, Anomaly, and Text Analysis
CIA Part 2 Study Guide Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CIA Part 2 Exam Orientation
1.1 Current CIA Part 2 Exam Facts 1.2 Eligibility, Fees, and Pearson VUE Scheduling 1.3 Scoring, Results Timing, and the 2025 Syllabus Map
2 Chapter 2: Engagement Objectives and Scope
2.1 Topical Requirements in Objectives and Scope 2.2 Elements Used to Build Engagement Objectives 2.3 Scope Limitations, Stakeholder Requests, and Scope Changes
3 Chapter 3: Evaluation Criteria and Planning Context
3.1 Selecting and Testing Evaluation Criteria 3.2 Applying Topical Requirements When Planning 3.3 Strategy, Risk Management, and Performance of the Activity Under Review
4 Chapter 4: Technology, Continuity, and Finance in Planning
4.1 Cybersecurity, IT General Controls, Privacy, and Data Security 4.2 Business Continuity, Disaster Recovery, and Resilience 4.3 Finance and Accounting Concepts for the Activity Under Review
5 Chapter 5: Business Process and System Risks in Planning
5.1 Asset, Supply Chain, Inventory, Payables, Procurement, and Compliance Processes 5.2 Third-Party Process Risks 5.3 CRM, ERP, and GRC System Risks
6 Chapter 6: Engagement Approach and Project Management
6.1 Agile, Traditional, Integrated, and Remote Approaches 6.2 Project Management While Planning and Conducting Engagements
7 Chapter 7: Engagement Risk Assessment
7.1 Topical Requirements and Pervasive Financial, Operational, IT, Cyber, and Regulatory Risks 7.2 Emerging Risks and the Impact of Change 7.3 Methods to Evaluate and Prioritize Risks and Controls
8 Chapter 8: Structure, Environment, and Culture
8.1 Centralized vs Decentralized, Flat vs Traditional, In-Person vs Remote 8.2 Culture, Group Behavior, and Tone at the Top
9 Chapter 9: Control Design, Effectiveness, and Efficiency Procedures
9.1 Procedures to Evaluate Control Design 9.2 Procedures to Test Operating Effectiveness 9.3 Procedures to Test Control Efficiency
10 Chapter 10: Work Programs, Testing Methodologies, and Resources
10.1 Evaluating Adequacy of the Engagement Work Program 10.2 Testing Methodologies for Accounting, Finance, IT, Operations, and Cybersecurity 10.3 Financial, Human, and Technological Resources and Limitation Implications
11 Chapter 11: Information Sources and Preliminary Survey
11.1 Interviews, Observations, and Walk-Throughs 11.2 Data Analysis as an Information Source 11.3 Policies, Checklists, Risk-and-Control Questionnaires, and Self-Assessments
12 Chapter 12: Evidence Relevance, Sufficiency, and Reliability
12.1 Criteria for Evidence Quality 12.2 Independence, Corroboration, and the Control Environment 12.3 Evidence an Informed, Competent Person Could Rely On
13 Chapter 13: Technology Options for Findings and Conclusions
13.1 Artificial Intelligence, Machine Learning, and Robotic Process Automation 13.2 Continuous Monitoring, Dashboards, and Embedded Audit Modules
14 Chapter 14: Process Mapping and Data Analytics
14.1 Workflow Segments, Process Maps, Walk-Throughs, and RACI 14.2 Structured vs Unstructured Data and the Analytics Process 14.3 Diagnostic, Prescriptive, Predictive, Anomaly, and Text Analysis
15 Chapter 15: Analytical Review and Finding Evaluation
15.1 Ratios, Variances, Trends, and Benchmarking 15.2 Selecting Analytical Techniques for Engagement Objectives 15.3 Comparing Existing Conditions to Evaluation Criteria 15.4 Root Causes, Effects, and Significance of Findings
16 Chapter 16: Workpapers and Engagement Conclusions
16.1 Organizing Complete Workpapers with Sufficient Evidence 16.2 Linking Workpapers to Results; Retention, Regulation, and Policy 16.3 Aggregating Findings and Concluding on Governance, Risk, and Control
17 Chapter 17: Engagement Supervision
17.1 Supervision Throughout Planning and Fieldwork 17.2 Coordinating Assignments and Reviewing Workpapers and Conclusions 17.3 Evaluating Auditors' Performance
18 Chapter 18: Communication During the Engagement
18.1 Formal and Informal Communication Across Planning, Fieldwork, and Reporting 18.2 Situations That Require Escalation 18.3 Selecting Appropriate Stakeholders for Engagement Communication
19 Chapter 19: Final Review and Test Day
19.1 2025 vs 2019 Traps and Part 2 vs Part 3 Boundaries 19.2 Pacing, Test-Center Rules, and Official Results
14.3 Diagnostic, Prescriptive, Predictive, Anomaly, and Text Analysis
Key Takeaways Explain This Topic AI
B4e: determine when to use diagnostic, prescriptive, predictive, anomaly detection, and text analysis — match the method to the question, not to the fanciest tool.
Diagnostic explains why a known pattern happened (why duplicates posted). Prescriptive says what to change. Predictive estimates who or what will fail next. Anomaly detection flags items unlike their peers. Text analysis mines non-structured language (contract clauses, tickets).
A descending sort, a filter, or the biggest invoices is not predictive. Predictive needs a forward-looking score grounded in past outcomes, not this week's ranking.
Anomaly flags are leads, not fraud conclusions. Reading two PDFs is inspection, not text analysis of the population.
Do not answer a B4e method-choice item with Chapter 15 ratios/variances/trends/benchmarks or Chapter 13 AI/RPA/dashboard tools.
Last updated: August 2026
B4e: pick the method that answers the question you wrote
Quick Answer: B4e asks you to determine when to use diagnostic analysis , prescriptive analysis , predictive analysis , anomaly detection , and text analysis . Match the method to the question : why did this happen; what should change; who or what will fail next; which items are unlike the rest; what does the unstructured language say. A descending sort is not predictive . Ratios, variances, trends, and benchmarks are Chapter 15 . AI, RPA, and dashboards as tools are Chapter 13 .
Section 14.2 defined the analytics process. This section is the method inside the analyze step. GIAS Standard 14.2 (analyses and potential engagement findings) is why the method must be able to support a condition you might later evaluate. You still do not write Chapter 15's cause-effect-significance package here; you choose an analysis that can feed it.
The 2025 syllabus does not list descriptive as a B4e method. Arranging what already happened — counts, totals, sorts — still happens in survey scans (Chapter 11.2) and as input to the five methods. The fail is calling that arrangement predictive (or diagnostic, or prescriptive) when it has not earned the name.
The five methods, with internal-audit uses
Method Question it answers Use when Internal-audit example Not this
Diagnostic Why did this happen? A condition is already visible; you need drivers Why 18 duplicate invoices posted: same clerk after a bank-detail change; re-post after a failed ACH; the system reused invoice numbers Listing the 18 rows and stopping
Prescriptive What should we do (or stop doing)? You have cause and you are advising action Block same-ID vendor-change and payment-release; retire shared IDs; require a second release above a threshold A wish list with no link to the cause
Predictive What is likely next? A scoring rule or model uses past outcomes to rank future risk Which vendors are most likely to fail the duplicate-pay control next month , based on past confirmed issues Sorting this month's invoices from large to small
Anomaly detection Which items do not look like the rest? You need outliers without yet knowing why Invoices whose amount, timing, or vendor profile is far from the peer group Calling every large invoice an anomaly
Text analysis What does the language contain? Evidence is non-structured or free text Mining contracts for termination, audit-rights, or price-escalation clauses; scanning tickets for override Reading two contracts and claiming the population was mined
Diagnostic — why the duplicates happened. Start from a known pattern (the 18 exact duplicates from a scan). Diagnostic work disaggregates : by vendor, by user, by day, by whether a reversing document exists, by whether the second payment followed a bank-detail change. The output is a why you can take to a walk-through: 14 of 18 are vendor 4412, same user ID, within 48 hours of a bank-account edit. That is still analysis, not yet the Chapter 15 finding paragraph. Choose diagnostic when the stem already puts the condition on the table and asks what to do next to explain it.
Prescriptive — what to fix. Prescriptive analysis recommends an action given the objective and constraints: change the SOD rule in the ERP, recertify user IDs, stop the weekend upload job until a review exists. On CIA Part 2 this is engagement-level advice grounded in the analysis , not the CAE's residual-risk protocol (Part 3) and not a full operations-research solver. If the stem asks which analysis tells management what to change , the answer is prescriptive — after diagnostic work has a cause. Prescribing tone at the top from a sort of invoice amounts is theater.
Predictive — who will fail next month. Predictive methods use past labeled outcomes (confirmed duplicate payments, confirmed access violations, confirmed claim issues) to score future items or people . Vendors with a new bank account, no PO history, and a round-dollar first invoice that scored like last year's confirmed duplicates is predictive if you built and checked that scoring rule. Ranking this week's invoices by dollar amount is not . A hunch is not. A regression, a simple weighted score with a back-test, or a documented risk score can all be predictive in kind . The exam cares that you know future likelihood . It does not ask you to code a neural net; that tool conversation is Chapter 13.
Anomaly detection — outlier invoices. Anomaly methods flag items that are statistically or logically unlike peers : a z-score on amount versus the vendor's history, a first-time vendor with a round-dollar invoice, postings at 02:14 when the process runs at 14:00, quantities that dwarf the PO. The flag is not a conclusion. Many anomalies are legitimate rush orders. Use anomaly detection when you do not yet have a why and you need a lead list from the full population. Then diagnose. Sampling one large invoice you happened to see and calling it anomaly detection misses the method: the point is unlike the rest , not large .
Text analysis — contract clause mining. Text methods extract meaning from non-structured language: search, classification, clause extraction. Internal-audit uses: Does this population of vendor MSAs contain audit-rights and clawback language we think we have? Do incident write-ups mention the same failed lockout step? Do invoice memo lines say consulting on a hardware PO? You still inspect hits; text analysis aims the reading. Two PDFs opened in a hotel room are inspection , not text analysis of the population.
Loading diagram... Match the B4e method to the question — then chain only if the objective needs a chain
Sequence, mix, and the sort-is-not-predictive trap
Real engagements chain methods when the objective needs a chain. Anomaly detection or a structured match surfaces outliers. Diagnostic analysis explains a cluster. Prescriptive analysis says what to change . A predictive score, if you have labeled history, aims next period's testing. Text analysis often joins the structured file (clause present = yes/no) so you can diagnose the no population.
Do not chain them as a ritual. If the objective is whether termination clauses exist in 200 vendor contracts, start with text analysis , not a predictive employee-turnover model. If the objective is why vendor 4412 duplicated, start diagnostic , not a new anomaly screen of the whole GL.
A sort is not predictive. Sorting AP by amount, newest vendor, or weekend flag is arrangement of what already happened . It can support a survey scan (Chapter 11.2). It can feed anomaly thinking if you have a peer-group rule (this amount versus this vendor's history), which is then anomaly detection, still not prediction. It does not estimate who will fail next month . CIA stems love: the auditor sorted invoices descending by amount and called the top 20 a predictive model of fraud. The error is the label , not the sort. Use the sort if you need the largest items; name the method what it is.
Benford's law, if it appears, is a conformity / anomaly screen unless you have turned the result into a validated forward score — which almost nobody has on a two-week AP job. Do not call it predictive to sound current.
Anomaly is not fraud. Eighteen outliers are a lead list. Diagnostic work, walk-throughs, and evidence Chapter 12 would respect still sit between the flag and a finding. Prescriptive is not a slogan. Fix SOD in the system is prescriptive when it follows a cause; enhance culture is not a B4e method output. Text analysis is not two PDFs. Population plus a rule for what you extracted plus inspection of hits is the method. Opening the two contracts in the kickoff packet is reading.
Worked example: five questions, five methods
Same procure-to-pay file, five different objectives:
Which invoices are unlike their vendor's last 12 months? → anomaly detection .
Why did vendor 4412 duplicate? → diagnostic (user, bank-change, re-post).
What control change would stop same-ID bank-change plus release? → prescriptive .
Which current vendors look like last year's confirmed duplicate-pay cases heading into next month? → predictive , and only if you have that labeled history and a score you can explain.
Do MSAs for these vendors include audit rights and a right to claw back overpayments? → text analysis of the contracts.
If the team answers all five by sorting the register, they have not determined when to use the methods. If they answer (4) with a model they cannot explain and never back-tested, they confused Chapter 13 tools with B4e method choice . If they answer (3) with a current-ratio analysis, they wandered into Chapter 15. If they answer (1) by picking the single largest invoice in the sample, they never ran anomaly detection on the population.
Keep Chapter 15's analytical review (ratios, variances, trends, benchmarks, technique selection) in Chapter 15. Keep Chapter 13's technology options in Chapter 13. B4e is only: given this question, which of the five methods belongs.
Exam traps
Calling a sort , a filter, or the big ones predictive .
Using diagnostic as a synonym for any spreadsheet.
Using prescriptive without a cause.
Treating anomaly flags as fraud.
Treating text analysis as having read two documents.
Importing ratios, variances, trends, benchmarks (B5) or AI / RPA / dashboards (B3) into a B4e method-choice item.
B4e is done when you can name the question, name the method, and refuse the label that was only there to sound advanced.