Computer-aided audit tools
||This article is written like a personal reflection or opinion essay rather than an encyclopedic description of the subject. (August 2009)|
'Computer-assisted audit techniques (CAATs) or computer-assisted audit tools and techniques (CAATTs) is a growing field within the audit profession. CAATs is the practice of using computers to automate the audit processes. CAATs normally includes using basic office productivity software such as spreadsheet, word processors and text editing programs and more advanced software packages involving use statistical analysis and business intelligence tools. But also more dedicated specialized software are available (see below).
CAATs have become synonymous with data analytics in the audit process.
- 1 Traditional auditing vs CAATs
- 2 Specialized software
- 3 Other uses of CAATs
- 4 See also
- 5 External links
- 6 References
Traditional auditing vs CAATs
Traditional audit example
The traditional method of auditing allows auditors to build conclusions based upon a limited sample of a population, rather than an examination of all available or a large sample of data. The use of small samples may diminish the validity of audit conclusions. Management realizes that they conduct thousands or perhaps millions of transactions a year and the auditor only sampled a handful. The auditor will then state that they conducted the sample based upon generally accepted audit standards (GAAS) and that their sample was statistically valid.
Another common criticism of the audit profession occurs after a problem emerges. Whenever a problem emerges within a department, management might ask, "Where were the auditors?" This is a futile question, because nobody can see beyond the present.
CAATTs, not CAATs, addresses these problems. CAATTs, as it is commonly used, is the practice of analyzing large volumes of data looking for anomalies. A well designed CAATTs audit will not be a sample, but rather a complete review of all transactions. Using CAATTs the auditor will extract every transaction the business unit performed during the period reviewed. The auditor will then test that data to determine if there are any problems in the data. For example, using CAATTs the auditor can find invalid Social Security Numbers (SSN) by comparing the SSN to the issuing criteria of the social security administration. The CAATTs auditor could also easily look for duplicate vendors or transactions. When such a duplicate is identified, they can approach management with the knowledge that they tested 100% of the transactions and that they identified 100% of the exceptions.
Traditional audit vs CAATTs on specific risks
Another advantage of CAATs is that it allows auditors to test for specific risks. For example, an insurance company may want to ensure that it doesn't pay any claims after a policy is terminated. Using traditional audit techniques this risk would be very difficult to test. The auditor would "randomly select" a "statistically valid" sample of claims (usually 30–50.) They would then check to see if any of those claims were processed after a policy was terminated. Since the insurance company might process millions of claims the odds that any of those 30–50 "randomly selected" claims occurred after the policy was terminated is extremely unlikely.
Using CAATTs the auditor can select every claim that had a date of service after the policy termination date. The auditor then can determine if any claims were inappropriately paid. If they were, the auditor can then figure out why the controls to prevent this failed. In a real life audit, the CAATTs auditor noted that a number of claims had been paid after policies were terminated. Using CAATTs the auditor was able to identify every claim that was paid and the exact dollar amount incorrectly paid by the insurance company. Furthermore, the auditor was able to identify the reason why these claims were paid. The reason why they were paid was because the participant paid their premium. The insurance company, having received a payment, paid the claims. Then after paying the claim the participant's check bounced. When the check bounced, the participant's policy was retrospectively terminated, but the claim was still paid costing the company hundreds of thousands of dollars per year.
Which looks better in an audit report:
"Audit reviewed 50 transactions and noted one transaction that was processed incorrectly"
"Audit used CAATTs and tested every transaction over the past year. We noted XXX exceptions wherein the company paid YYY dollars on terminated policies."
However, the CAATTs driven review is limited only to the data saved on files in accordance with a systematic pattern. Much data is never documented this way. In addition saved data often contains deficiencies, is poorly classified, is not easy to get, and it might be hard to become convinced about its integrity. So, for the present CAATTs is complement to an auditor's tools and techniques. In certain audits CAATTs can't be used at all. But there are also audits which simply can't be made with due care and efficiently without CAATTs.
In the most general terms, CAATTs can refer to any computer program utilized to improve the audit process. Generally, however, it is used to refer to any data extraction and analysis software. This would include programs such as spreadsheets (e.g. Excel), databases (e.g. Access), statistical analysis (e.g. SAS), business intelligence (e.g. Crystal Reports and Business Objects), etc.
Benefits of audit software include:
- They are independent of the system being audited and will use a read-only copy of the file to avoid any corruption of an organization’s data.
- Many audit-specific routines are used such as sampling.
- Provides documentation of each test performed in the software that can be used as documentation in the auditor’s work papers.
Audit specialized software may perform the following functions:
- Data queries.
- Data stratification.
- Sample extractions.
- Missing sequence identification.
- Statistical analysis.
- Duplicated transactions.
- Pivot tables.
- Cross tabulation.
Other uses of CAATs
In addition to using data analysis software, the auditor uses CAATs throughout the audit for the following activities while performing data analysis:
Creation of electronic work papers
Keeping electronic work papers on a centralized audit file or database will allow the auditor to navigate through current and archived working papers with ease. The database will make it easier for auditors to coordinate current audits and ensure they consider findings from prior or related projects. Additionally, the auditor will be able to electronically standardize audit forms and formats, which can improve both the quality and consistency of the audit working papers.
CAATs provides auditors with tools that can identify unexpected or unexplained patterns in data that may indicate fraud. Whether the CAATs is simple or complex, data analysis provides many benefits in the prevention and detection of fraud.
CAATs can assist the auditor in detecting fraud by performing and creating the following,
Evaluations of financial information made by studying plausible relationships among both financial and non-financial data to assess whether account balances appear reasonable (AU 329). Examples include ratio, trend, and Benford's Law tests.
Data analysis reports
Reports produced using specific audit commands such as filtering records and joining data files.
Continuous monitoring is an ongoing process for acquiring, analyzing, and reporting on business data to identify and respond to operational business risks. For auditors to ensure a comprehensive approach to acquire, analyze, and report on business data, they must make certain the organization continuously monitors user activity on all computer systems, business transactions and processes, and application controls.
Curb stoning in surveys
Curb stoning is the term for instances where a surveyor completes a survey form by making up data. Because some of the data should conform with Benford's law, this practice can be detected using CAATTs which provide the capability of performing such tests.
Note on the acronyms CAATTs vs CAATs
CAATTs and CAATs are used interchangeably. While CAATs has emerged as the more common spelling, CAATTs is the more precise acronym. The acronym CAATTs solves one of the two problems with defining the acronym. CAATs means:
Computer Aided (or Assisted) Audit Techniques (or Tools and Techniques)
The first "A" and the "T" can have two different meanings depending on who uses the term. By using the term CAATTs, one is clearly incorporating both "Tools" AND "Techniques."
- Comparison of specialized computer-aided audit tools
- Generalized audit software
- Information technology audit
- Separation of duties
- Information Technology Control and Audit; Frederick Gallegos, Sandra Senft, et al.; 2nd Edition ISBN 0-8493-2032-1