Computer Assisted Audit Techniques CAATs

Computer Assisted Audit Techniques CAATs WinIDEA solely 1). 2). Some or most of us have been using this technique one way or the other It could be very simple 3).

Computer Assisted Audit Techniques CAATs is Computer Assisted Audit Techniques meaning We use computer to perform part of our auditing functions

Computer Assisted Audit Techniques Prime objective should be to assist in performing audit in the most effective and efficient manner They are tools to be used by the examiners, NOT a means to an end Need to first identify the objectives of audit then look at best method of achieving it

Computer Assisted Audit Techniques Considerations Importance of the system to the organisation Whether the review is a one-off or a continuing one Time and cost to set up the technique Time and cost to maintain the technique Level of audit assurance required Expected life of the system

Computer Assisted Audit Techniques Types of CAATs Interogation Software Embedded Audit Module Parallel simulation Test Data Integrated Test Facility Specialised audit software Commercial Software Using the auditee’s system & resources

Computer Assisted Audit Techniques Interogation Software Definition An audit interrogation program extracts data for subsequent audit review Examples: Easytrieve ACL IDEA Impromptu/PowerPlay

Computer Assisted Audit Techniques Generalised audit software comes in a variety of forms. It may either be a software package available commercially or one developed by an auditing firm. In most cases the purpose of the software package is to interrogate client’s computer files and extract information therefrom.

Computer Assisted Audit Techniques This type of software may be used to gather evidence in relation to both the effectiveness of operations of a programmed controll procedure and the extent of misstatements in accounts and underlying classes of transactions. In other words, this software may be used as either a test of control or as a substantive procedure.

Computer Assisted Audit Techniques Stages of Interogation File Define the file to be interrogated Field Determine the fields of interest Selection How data is to be collected Criteria Calc. Optional Output Most important aspect must get output right to meet objectives

Computer Assisted Audit Techniques Interogation Software (cont.) Advantages Independence form the IT department More effective use of audit time More Effective auditing Training Cost to set up and process Flexibility through the use of parameters

Computer Assisted Audit Techniques Interogation Software (cont.) Disadvantages Cost to purchase package Inexperience Does not review system controls

Computer Assisted Audit Techniques Embedded Audit Module Definition An audit program which is embedded in the application system to extract live data for subsequent audit review * Automating part of the the audit function

Computer Assisted Audit Techniques Embedded Audit Module (cont.) It is a CAAT in which code prepared by the auditor is embedded in the client’s software. The code may be designed, for example, to replicate specific aspect of control procedure, or to record details of certain transactions in a file accessible only to the auditor. Thus, it may be used as both a test of control* or as a substantive procedure

Computer Assisted Audit Techniques Advantages Concurrent auditing Continuous monitoring of transaction Reduces need for separate audit runs Particularly useful for very large files Extracts unusual transactions for subsequent audit checking

Computer Assisted Audit Techniques Disadvantages Must be included at system specification time Loss of independence as usually programmed by IT staff High set up and maintenance costs Program maintenance difficult, needs regular review Processing overheads may be high To be effective must assign audit staff to follow up Knowledge of testinging criteria may lead to circumvention

Computer Assisted Audit Techniques Parallel simulation Definition Live data is processed through the application system and checked to pre-determined results. lnvolves auditors developing either part or all the system and then processing data through to compare with output from original system.

Computer Assisted Audit Techniques Parallel simulation (cont.) Alternatively, actual client data is processed using a copy of the client’s software that has undergone program code analysis by the auditor and is under the control of the auditor. It provides evidence as to the effectiveness of design of program control procedures.

Computer Assisted Audit Techniques Advantages Simple and positive verification of specific programs and program controls Simple verification fo the integrity of data Uses live data files but does not corrupt them Repeatable test Can check all or part of a system

Computer Assisted Audit Techniques Disadvantages May require considerable programming knowledge Need detailed knowledge of application system Expensive to maintain Need good application documentation Are error caused by faults in live or parallel system?

Computer Assisted Audit Techniques Test Data Definition Test data is processed through the application system and checked to pre-determined results. INTEGRATED TEST FACILITY is an enhanced form of this May use TEST DATA GENERATOR Pansophic’s PANAUDIT.

Computer Assisted Audit Techniques Test data is a CAAT in which test data prepared by the auditor is processed on the current production version of the client’s software, but separately form the client’s normal input data. The test data that is processed updates the auditor’s copies of the client’s data files. It is typically used to gather evidences as to the effectiveness of design of programmed control procedures.

Computer Assisted Audit Techniques Advantages Does not interfere with live processing Enables the auditor to carry out more exhaustive testing

Computer Assisted Audit Techniques Disadvantages Computer staff assistance required Additional computer resources required No assurance that the test data followed normal processing procedures

Computer Assisted Audit Techniques Integrated Test Facility ITF is a facility forming part of the client’s software that enables the auditor’s test data to be integrated with the client’s live input data and then processed using the client’s current production version of the software. The facility ensures that the test data updates special dummy files, rather than actual operating files. This procedure provides evidence of the effectiveness of design of programmed control procedures.

Computer Assisted Audit Techniques Specialised audit software It is software designed to perform specific tasks in specific circumstances, such as comparison of source and object code, the analysis of unexecuted code and the generation of test data. It is used to gather evidence as to the design effectiveness of client’s software.

Standard software to audit operating software or applications Webtrend Security module

Computer Assisted Audit Techniques Commercial Software Such as Microsoft Excel, .., may be used by the auditor for analysing data imported from client files, writing audit program, etc. e.g. Stress Test is perform on Excel Breakeven Test (RWCR & NPL)

Computer Assisted Audit Techniques Using the auditee’s system & resources Its application system Its query tools Its programmer

Computer Assisted Audit Techniques Using the auditee’s application system Need to ask for a user-id with “read only” capability Need to understand the product Need to understand the system (command) Need system documentation Start with login & exit the application

Computer Assisted Audit Techniques Using the auditee’s query tools (very much like WinIdea) Need to ask for a user-id with “read only” capability & full assess to query tool Need to understand the query tool e.g Query/400, SQL, Crystal report,... Need system documentation Start with login & exit the application Begin extraction with the simplest query

Computer Assisted Audit Techniques Using their programmer (smart partnership) Need co-operation Must understand system flows & file structure Must know what you want & clearly communicated to the programmer Should review source code (program) Could submit/run the subsequent requests by yourself.