Computer-aided audit tools

Last updated

Computer-assisted audit tool (CAATs) or computer-assisted audit tools and techniques (CAATTs) is a growing field within the IT audit profession. CAATs is the practice of using computers to automate the IT audit processes. CAATs normally include using basic office productivity software such as spreadsheets, word processors and text editing programs and more advanced software packages involving use statistical analysis and business intelligence tools. But also more dedicated specialized software are available (see below).

Contents

CAATs have become synonymous with data analytics in the audit process.

Traditional auditing vs CAATs

Traditional audit example

The traditional method of auditing allows auditors to build conclusions based upon a limited sample of a population, rather than an examination of all available or a large sample of data.

CAATTs alternative

CAATTs, not CAATs, addresses these problems. CAATTs, as it is commonly used, is the practice of analyzing large volumes of data looking for anomalies. A well-designed CAATTs audit will not be a sample, but rather a complete review of all transactions. Using CAATTs the auditor will extract every transaction the business unit performed during the period reviewed. The auditor will then test that data to determine if there are any problems in the data.

Traditional audit vs CAATTs on specific risks

Another advantage of CAATTs is that it allows auditors to test for specific risks. For example, an insurance company may want to ensure that it doesn't pay any claims after a policy is terminated. Using traditional audit techniques this risk would be very difficult to test. The auditor would "randomly select" a "statistically valid" sample of claims (usually if any of those claims were processed after a policy was terminated). Since the insurance company might process millions of claims the odds that any of those 30–50 "randomly selected" claims occurred after the policy was terminated is extremely unlikely.

Using CAATTs the auditor can select every claim that had a date of service after the policy termination date. The auditor then can determine if any claims were inappropriately paid. If they were, the auditor can then figure out why the controls to prevent this failure. In a real-life audit, the CAATTs auditor noted that several claims had been paid after policies were terminated. Using CAATTs the auditor was able to identify every claim that was paid and the exact dollar amount incorrectly paid by the insurance company. Furthermore, the auditor was able to identify the reason why these claims were paid. The reason why they were paid was because the participant paid their premium. The insurance company, having received a payment, paid the claims. Then after paying the claim the participant's check bounced. When the check bounced, the participant's policy was retrospectively terminated, but the claim was still paid costing the company hundreds of thousands of dollars per year.

Which looks better in an audit report:

"Audit reviewed 50 transactions and noted one transaction that was processed incorrectly"

or

"Audit used CAATTs and tested every transaction over the past year. We noted XXX exceptions wherein the company paid YYY dollars on terminated policies."

However, the CAATTs driven review is limited only to the data saved on files in accordance with a systematic pattern. Much data is never documented this way. In addition saved data often contains deficiencies, is poorly classified, is not easy to get, and it might be hard to become convinced about its integrity. So, for the present CAATTs is a complement to an auditor's tools and techniques. In certain audits, CAATTs can't be used at all. But there are also audits that simply can't be made with due care and efficiently without CAATTs.

Specialized software

In the most general terms, CAATTs can refer to any computer program utilized to improve the audit process. Generally, however, it is used to refer to any data extraction and analysis software. This would include programs such as data analysis and extraction tools, spreadsheets (e.g. Excel), databases (e.g. Access), statistical analysis (e.g. SAS), generalized audit software (e.g. ACL, Arbutus, EAS), business intelligence (e.g. Crystal Reports and Business Objects), etc.

Benefits of audit software include:

Audit specialized software may perform the following functions:

CAATs Education and Professional Development

CAATs Courses

CAATs are the fundamental tool that is used by the auditors. This tool facilitates them to make search from the irregularities from the given data. With the help of this tool, the auditors and accountants of any firm will be able to provide more analytical results. These tools are used throughout every business environment and also in the industry sectors too. With the help of computer-assisted audit techniques, more forensic accounting with more analysis can be done. It’s really a helpful tool that helps the firm auditor to work in an efficient and productive manner. Working with the CAATs, it is essential for the accountant or the auditor to select the right data, the selection process is very much tricky, and you need to be professional for it. After selecting the right data, import that to the CAATs, now the tool will automatically generate the analytical data. This tool contributes to the efficiency of the auditors. The fundamental course outline [1] include:

CAATs Certification Program

There are several certification programs from various CAATs vendors and professional associations as the following:

  1. International Certified CAATs Practitioner (ICCP): established by the International Computer Auditing Education Association (ICAEA).
  2. ACL™ Certified Data Analyst (ACDA): established by ACL Services Ltd.
  3. Certified IDEA Data Analyst (CIDA): established by CaseWare Analytics.
  4. Jacksoft Certified CAATs Practitioner (JCCP): established by Jacksoft Commerce Automation Ltd.

Other uses of CAATs

In addition to using data analysis software, the auditor uses CAATs throughout the audit for the following activities while performing data analysis:

Creation of electronic work papers

Keeping electronic work papers on a centralized audit file or database will allow the auditor to navigate through current and archived working papers with ease. The database will make it easier for auditors to coordinate current audits and ensure they consider findings from prior or related projects. Additionally, the auditor will be able to electronically standardize audit forms and formats, which can improve both the quality and consistency of the audit working papers.

Fraud detection

CAATs provide auditors with tools that can identify unexpected or unexplained patterns in data that may indicate fraud. Whether the CAATs is simple or complex, data analysis provides many benefits in the prevention and detection of fraud.

CAATs can assist the auditor in detecting fraud by performing and creating the following,

Analytical tests

Evaluations of financial information made by studying plausible relationships among both financial and non-financial data to assess whether account balances appear reasonable (AU 329). Examples include ratio, trend, and Benford's Law tests.

Data analysis reports

Reports produced using specific audit commands such as filtering records and joining data files.

Continuous monitoring

Continuous monitoring is an ongoing process for acquiring, analyzing, and reporting on business data to identify and respond to operational business risks. For auditors to ensure a comprehensive approach to acquire, analyze, and report on business data, they must make certain the organization continuously monitors user activity on all computer systems, business transactions and processes, and application controls.

Curb stoning in surveys

Curb stoning is the term for instances where a surveyor completes a survey form by making up data. Because some of the data should conform with Benford's law, this practice can be detected using CAATTs which provide the capability of performing such tests.

Note on the acronyms CAATTs vs CAATs

CAATTs and CAATs are used interchangeably. While CAATs has emerged as the more common spelling, CAATTs is the more precise acronym. The acronym CAATTs solves one of the two problems with defining the acronym. CAATs means:

Computer Aided (or Assisted) Audit Techniques (or Tools and Techniques)

The first "A" and the "T" can have two different meanings depending on who uses the term. By using the term CAATTs, one is clearly incorporating both "Tools" AND "Techniques."

Comparison of tools

Comparison by specification

Product Name / BrandDeveloped byLatest stable versionLatest release dateOS Software license Open source Comments
Arbutus Analyzer Arbutus Software7.002021-05-31 Windows Proprietary commercial No
Audit Command Language (ACL)Galvanize15.02020-10-31 Windows Proprietary commercial NoStarting 2014 provide a free Excel add-in
Easy2Analyse QDAC.net.4.32015-05-15 Windows Proprietary commercial NoAvailable in full and auditfiles version
Intrasoft Audit Support Computer Audit (Formerly known as ESKORT / SESAM)Intrasoft International7.0 [2] 2021-03-31 Windows Proprietary commercial NoRequires Excel for showing graphs and result of Benford law analysis.
InfoZoom humanIT9.0.52016-11-07 Windows Proprietary commercial No
Interactive Data Extraction and Analysis (IDEA)CaseWare International Inc.11.1 [3] 2016-10-26 Windows Proprietary commercial No
TeamMate Analytics (formerly TopCAATs)Wolters Kluwer5.12017-09-18 Windows Proprietary commercial NoRequires Microsoft Excel (TeamMate Analytics runs within Excel)
SoftCAAT/ eCAAT [4] [5] Wincer Infotech Limited9.0/ 9.02016-04-04 Windows Proprietary commercial NoSoftCAAT is an independent application. eCAAT requires Microsoft Excel (eCAAT is an Excel add-in) [5]

Comparison by analysis features

The following table compares features of specialized computer-aided audit tools. The table has several fields, as follows:

  1. Product Name: Product's name; sometime includes edition if a certain edition is targeted.
  2. Age analysis: Specifies whether the product supports making age analysis (stratification by date).
  3. Benford's law: Specifies whether the product supports finding abnormal distribution of specific digits accordingly to Benford's law.
  4. Calculated field: Specifies whether the product supports adding extra calculated fields into the table/file. Usually implies using an expression builder feature to build up expressions for defining the field calculation.
  5. Drill-down (Table): Specifies whether the product supports drill-down features by zooming in (filtering) on selected rows in the table.
  6. Drill-down (Pivot): Specifies whether the product supports drill-down features through pivot table.
  7. Matching: Specifies whether the product supports finding matching items for a specific field in a table/file. For example, this could be used to find duplicate billings of invoices within the sales ledger.
  8. Matching (Fuzzy): Specifies whether the product supports finding matching items for a specific field using fuzzy comparison. For instance, values compared are similar but not exactly the same (e.g., using Levenshtein matching).
  9. Sample (Random): Specifies whether the product supports selecting a random sample of rows from the table/file (population).
  10. Sample (Monetary unit): Specifies whether the product supports selecting a monetary unit sample of rows from the table/field (population). This is also known as dollar-unit sampling (when values are in U.S. currency).
  11. Sequence check (Gap): Specifies whether the product supports can find (identify) gabs (in sequences) for a specific field. For example, finding a broken sequence in an invoice number sequence.
  12. Sort field: Specifies whether the product supports sorting (indexing) by a specific field (column). Sorting helps identifying blank/empty values or excessive (out-of-band) values.
  13. Sort multiple fields: Specifies whether the product supports sorting by multiple fields (columns).
  14. Statistics: Specifies whether the product supports calculation and presentation of various statistics on a specific field (e.g., for the values of a numeric field such as a total number of positive numbers, total number negative numbers, average value (balance), etc.)
  15. Stratification: Specifies whether the product supports stratification on number (amount) values in specified intervals. Splits the population into strata (intervals) and aggregates (summarizes) values. Can be used to find largest, smallest and average amount transactions (rows).
  16. Total row: Specifies whether the products supports displaying a total row for the table/file, e.g. accumulated numerical value.
Product NameAge Analysis Benford's law Calculated fieldDrill-down (Table)Drill-down (Pivot)MatchingMatching (Fuzzy)Sample (Random)Sample (Monetary unit)Sequence Check (Gap)Sort fieldSort multiple fieldsStatisticsStratificationTotal row
Analyzer - Arbutus Software YesYesYesYesYesYesYesYesYesYesYesYesYesYesYes
Audit Command Language (ACL)YesYesYesYesYesYesYesYesYesYesYesYesYesYesYes
Easy2Analyse (QDAC.net)YesYesYesYesYesYesYesYesYesYesYesYesYesYesYes
Intrasoft Audit Support Computer AuditYesYesYesYesYesYesYesYesYesYesYesYesYesYesYes
InfoZoom YesYesYesYesYesYesYesYesYesYesYesYesYesYesYes
Interactive Data Extraction and Analysis (IDEA)YesYesYesYesYesYesYesYesYesYesYesYesYesYesYes
TeamMate Analytics / TopCAATsYesYesYesYesYesYesYesYesYesYesYesYesYesYesYes
SoftCAAT/ eCAATYesYesYesYesNoYesYesYesNoYesYesYesYesYesYes

Comparison by other features

  1. Audit log: Specifies whether the product logs activity performed by the user (the auditor) for later reference (e.g., inclusion into audit report).
  2. Data graph: Specifies whether the product provides graphs of results.
  3. Export (CSV): Specifies whether the product support exporting selected rows to a comma-separated values formatted file. Usually also implies capability to the clipboard (in CSV format) for pasting into applications supporting pasting from CSV files such as Excel.
  4. Export (DBF): Specifies whether the product support exporting (saving) selected rows to a dBase Table file.
  5. Export (Excel): Specifies whether the product support exporting (saving) selected rows to an Excel file. Usually also implies capability to copy the rows to the clipboard (in some format) for pasting into Excel.
Product NameAudit logData graphExport (CSV)Export (DBF)Export (Excel)
Analyzer - Arbutus Software YesYesYesYesYes
Audit Command Language (ACL)YesYesYesYesYes
Easy2Analyse (QDAC.net)YesYesYesYesYes
Intasoft Audit Support Computer AuditYesYesYesYesYes
InfoZoom YesYesYesNoYes
Interactive Data Extraction and Analysis (IDEA)YesYesYesYesYes
TeamMate Analytics / TopCAATsYesYesYesNoYes
SoftCAAT/ eCAATYesYesYesNoYes

Comparison by data preparation features

  1. Append/Merge: Specifies whether the product can combine two tables/files with identical fields into a single table/file. For example, it could be doing a merge of two years of accounts payable tables/files into a single table/file.
  2. Import wizard: Specifies whether the product provides an import wizard to assist in importing (interpretation, conversion, formatting) data for analysis.
  3. Import (CSV): Specifies whether the product supports import data from a comma-separated values formatted file.
  4. Import (DBF): Specifies whether the product supports import data from dBase DBF files.
  5. Import (Excel): Specifies whether the product supports import data from Microsoft Excel workbook file. Note that different Excel format versions may apply.
  6. Import (SAF-T): Specifies whether the product supports import data from an OECD SAF-T file. As SAF-T is based on XML a more general XML import may cover the feature although direct SAF-T import improves the user experience. Note that different SAF-T format versions may apply.
  7. Import (SIE): Specifies whether the product supports import data from a SIE format file.
  8. Import (XBRL-GL): Specifies whether the product supports import data from a XBRL GL file. As XBRL-GL is based on XML a more general XML import may cover the feature although direct XBRL-GL import improves the user experience. Note that different XBRL-GL format versions may apply.
Product NameAppend/MergeImport wizardImport (CSV)Import (DBF)Import (Excel)Import (SAF-T)Import (SIE)Import (XBRL-GL)
Analyzer - Arbutus Software YesYesYesYesYesYesYesYes
Audit Command Language (ACL)YesYesYesYesYes??Yes
Easy2Analyse (QDAC.net)YesYesYesYesYesYesYesYes
Intrasoft Audit Support Computer Audit (SESAM)YesYesYesYesYesYesYesYes
InfoZoom YesYesYesYesYes???
Interactive Data Extraction and Analysis (IDEA)YesYesYesYesYes [3] YesYesYes
TeamMate Analytics / TopCAATsYesYesYesYesYesYes?Yes
SoftCAAT/ eCAATYesYesYesYesYesNoNoNo

See also

Related Research Articles

<span class="mw-page-title-main">Spreadsheet</span> Computer application for organization, analysis, and storage of data in tabular form

A spreadsheet is a computer application for computation, organization, analysis and storage of data in tabular form. Spreadsheets were developed as computerized analogs of paper accounting worksheets. The program operates on data entered in cells of a table. Each cell may contain either numeric or text data, or the results of formulas that automatically calculate and display a value based on the contents of other cells. The term spreadsheet may also refer to one such electronic document.

<span class="mw-page-title-main">Extract, transform, load</span> Procedure in computing

In computing, extract, transform, load (ETL) is a three-phase process where data is extracted, transformed and loaded into an output data container. The data can be collated from one or more sources and it can also be output to one or more destinations. ETL processing is typically executed using software applications but it can also be done manually by system operators. ETL software typically automates the entire process and can be run manually or on reoccurring schedules either as single jobs or aggregated into a batch of jobs.

The BMP file format or bitmap, is a raster graphics image file format used to store bitmap digital images, independently of the display device, especially on Microsoft Windows and OS/2 operating systems.

<span class="mw-page-title-main">Table (information)</span> Arrangement of information or data, typically in rows and columns

A table is an arrangement of information or data, typically in rows and columns, or possibly in a more complex structure. Tables are widely used in communication, research, and data analysis. Tables appear in print media, handwritten notes, computer software, architectural ornamentation, traffic signs, and many other places. The precise conventions and terminology for describing tables vary depending on the context. Further, tables differ significantly in variety, structure, flexibility, notation, representation and use. Information or data conveyed in table form is said to be in tabular format. In books and technical articles, tables are typically presented apart from the main text in numbered and captioned floating blocks.

A GIS file format is a standard for encoding geographical information into a computer file, as a specialized type of file format for use in geographic information systems (GIS) and other geospatial applications. Since the 1970s, dozens of formats have been created based on various data models for various purposes. They have been created by government mapping agencies, GIS software vendors, standards bodies such as the Open Geospatial Consortium, informal user communities, and even individual developers.

<span class="mw-page-title-main">Comma-separated values</span> File format used to store data

Comma-separated values (CSV) is a text file format that uses commas to separate values. A CSV file stores tabular data in plain text, where each line of the file typically represents one data record. Each record consists of the same number of fields, and these are separated by commas in the CSV file. If the field delimiter itself may appear within a field, fields can be surrounded with quotation marks.

<span class="mw-page-title-main">Laboratory information management system</span> Software infrastructure for improving research and storing data

A laboratory information management system (LIMS), sometimes referred to as a laboratory information system (LIS) or laboratory management system (LMS), is a software-based solution with features that support a modern laboratory's operations. Key features include—but are not limited to—workflow and data tracking support, flexible architecture, and data exchange interfaces, which fully "support its use in regulated environments". The features and uses of a LIMS have evolved over the years from simple sample tracking to an enterprise resource planning tool that manages multiple aspects of laboratory informatics.

A hex editor is a computer program that allows for manipulation of the fundamental binary data that constitutes a computer file. The name 'hex' comes from 'hexadecimal', a standard numerical format for representing binary data. A typical computer file occupies multiple areas on the storage medium, whose contents are combined to form the file. Hex editors that are designed to parse and edit sector data from the physical segments of floppy or hard disks are sometimes called sector editors or disk editors.

<span class="mw-page-title-main">XBRL</span> Exchange format for business information

XBRL is a freely available and global framework for exchanging business information. XBRL allows the expression of semantic meaning commonly required in business reporting. The standard was originally based on XML, but now additionally supports reports in JSON and CSV formats, as well as the original XML-based syntax. XBRL is also increasingly used in its Inline XBRL variant, which embeds XBRL tags into an HTML document. One common use of XBRL is the exchange of financial information, such as in a company's annual financial report. The XBRL standard is developed and published by XBRL International, Inc. (XII).

An information technology audit, or information systems audit, is an examination of the management controls within an Information technology (IT) infrastructure and business applications. The evaluation of evidence obtained determines if the information systems are safeguarding assets, maintaining data integrity, and operating effectively to achieve the organization's goals or objectives. These reviews may be performed in conjunction with a financial statement audit, internal audit, or other form of attestation engagement.

Data cleansing or data cleaning is the process of detecting and correcting corrupt or inaccurate records from a record set, table, or database and refers to identifying incomplete, incorrect, inaccurate or irrelevant parts of the data and then replacing, modifying, or deleting the dirty or coarse data. Data cleansing may be performed interactively with data wrangling tools, or as batch processing through scripting or a data quality firewall.

A software audit review, or software audit, is a type of software review in which one or more auditors who are not members of the software development organization conduct "An independent examination of a software product, software process, or set of software processes to assess compliance with specifications, standards, contractual agreements, or other criteria".

An entity–attribute–value model (EAV) is a data model optimized for the space-efficient storage of sparse—or ad-hoc—property or data values, intended for situations where runtime usage patterns are arbitrary, subject to user variation, or otherwise unforeseeable using a fixed design. The use-case targets applications which offer a large or rich system of defined property types, which are in turn appropriate to a wide set of entities, but where typically only a small, specific selection of these are instantiated for a given entity. Therefore, this type of data model relates to the mathematical notion of a sparse matrix.

A geographic data model, geospatial data model, or simply data model in the context of geographic information systems, is a mathematical and digital structure for representing phenomena over the Earth. Generally, such data models represent various aspects of these phenomena by means of geographic data, including spatial locations, attributes, change over time, and identity. For example, the vector data model represents geography as collections of points, lines, and polygons, and the raster data model represent geography as cell matrices that store numeric values. Data models are implemented throughout the GIS ecosystem, including the software tools for data management and spatial analysis, data stored in a variety of GIS file formats, specifications and standards, and specific designs for GIS installations.

XBRL assurance is the auditor's opinion on whether a financial statement or other business report published in XBRL, is relevant, accurate, complete, and fairly presented. An XBRL report is an electronic file and called instance in XBRL terminology.

<span class="mw-page-title-main">Continuous auditing</span>

Continuous auditing is an automatic method used to perform auditing activities, such as control and risk assessments, on a more frequent basis. Technology plays a key role in continuous audit activities by helping to automate the identification of exceptions or anomalies, analyze patterns within the digits of key numeric fields, review trends, and test controls, among other activities.

The XBRL Global Ledger Taxonomy Framework is a holistic and generic XML and XBRL-based representation of the detailed data that can be found in accounting and operational systems, and is meant to be the bridge from transactional standards to reporting standards, integrating the Business Reporting Supply Chain.

The following is provided as an overview of and topical guide to databases:

SAF-T is an international standard for electronic exchange of reliable accounting data from organizations to a national tax authority or external auditors. The standard is defined by the Organisation for Economic Co-operation and Development (OECD). The file requirements are expressed using XML, but the OECD does not impose any particular file format, recommending that "It is entirely a matter for revenue bodies to develop their policies for implementation of SAF-T, including its representation in XML. However, revenue bodies should consider data formats that permit audit automation today while minimising potential costs to all stakeholders when moving to new global open standards for business and financial data such as XBRL, and XBRL- GL in particular."

Audit technology is the use of computer technology to improve an audit. Audit technology is used by accounting firms to improve the efficiency of the external audit procedures they perform.

References

  1. International Computer Auditing Education Association (ICAEA), "CAATs (Computer Assisted Audit Techniques) Courses", "ICAEA--Training". Archived from the original on 2015-02-05. Retrieved 2015-02-26.
  2. "Intrasoft COMPLIANCE Audit Support 7.0". 2021-09-02. Retrieved 2021-09-02.
  3. 1 2 "IDEA Version 10.2" . Retrieved 9 May 2013.
  4. "WINCER: Products".
  5. 1 2 "WINCER: Products". Archived from the original on 2016-04-08.