Types of CAATs Session 3

CAATs for program validation CAATs for data analysis Categories of CAATs CAATs for program validation Verification of different processes in programs CAATs for data analysis Ignore programs used to generate data; focus exclusively on data

Program vs. Data Analysis CAATs Program validation tools generally only for compliance and financial audits Data analysis tools for performance and investigative audits also Use of program-oriented CAATs requires higher level of technical expertise (Level 3 expert IT auditors) May not be feasible for many SAIs

CAATs for Program Analysis Tools for examining data flows Tools for verifying data and file integrity Embedded Audit Modules Other Tools

Examining Data Flows Snapshot Tracing Freeze a program at a given point, and check on processing and transaction values E.g. debug facility Tracing Complete audit trail tracing transactions through processing of program code Useful for highlighting errors Requires knowledge of programming

Examining Data Flows (Contd.) Mapping Monitoring program execution for statistical information Used for highlighting redundant / fraudulent code

Verifying data and file integrity Parallel simulation Test Data Generators and Integrated Test Facilities

Parallel simulation Independently create routines to simulate/ re-perform parts of application program Useful for checking accuracy of calculations Programming and system knowledge required

Test data generators and Integrated Test Facilities Generation of fictitious test data for testing application controls Test data generators are independent software programs; while Integrated Test Facility is a part of the application program Test results to be removed from system / reports Difficult to create all possible combinations of test data

Embedded Audit Modules Used to extract data meeting auditor-specified criteria into a separate file Volatile data can also be captured Needs to be integrated into the auditee IT system SCARF System Control Audit Review File Extracting transactions falling outside auditor-determined reasonable limits SARF (Sample Audit Review File)

Program library analysis Code comparison Other Tools Source code review Review of sections of source code Program library analysis Review changes to program software Code comparison Compare production version of code with master copy User log analysis Identify unauthorised entry attempts and password violation

CAATs for Data Analysis Predominant approach followed by auditors Totalling Stratification Data mining Sampling Exception Reporting Duplicate Record Checks Ageing Gap Detection Re-performance of calculations

Potential risks from reliance on data analysis Issues Exclusive reliance on data analysis Prior IT Controls Review Verification of integrity of downloaded data Understanding of IT System and Data Knowledge of CAAT Tool Quality Assurance Methodology