1. Types of CAATs
Session 3

2. CAATs for program validation CAATs for data analysis
Categories of CAATs
CAATs for program validation
Verification of different processes in programs
CAATs for data analysis
Ignore programs used to generate data; focus exclusively on data

3. Program vs. Data Analysis CAATs
Program validation tools generally only for compliance and financial audits
Data analysis tools for performance and investigative audits also
Use of program-oriented CAATs requires higher level of technical expertise (Level 3 expert IT auditors)
May not be feasible for many SAIs

4. CAATs for Program Analysis
Tools for examining data flows
Tools for verifying data and file integrity
Embedded Audit Modules
Other Tools

5. Examining Data Flows Snapshot Tracing
Freeze a program at a given point, and check on processing and transaction values
E.g. debug facility
Tracing
Complete audit trail tracing transactions through processing of program code
Useful for highlighting errors
Requires knowledge of programming

6. Examining Data Flows (Contd.)
Mapping
Monitoring program execution for statistical information
Used for highlighting redundant / fraudulent code

7. Verifying data and file integrity
Parallel simulation
Test Data Generators and Integrated Test Facilities

8. Parallel simulation
Independently create routines to simulate/ re-perform parts of application program
Useful for checking accuracy of calculations
Programming and system knowledge required

9. Test data generators and Integrated Test Facilities
Generation of fictitious test data for testing application controls
Test data generators are independent software programs; while Integrated Test Facility is a part of the application program
Test results to be removed from system / reports
Difficult to create all possible combinations of test data

10. Embedded Audit Modules
Used to extract data meeting auditor-specified criteria into a separate file
Volatile data can also be captured
Needs to be integrated into the auditee IT system
SCARF
System Control Audit Review File
Extracting transactions falling outside auditor-determined reasonable limits
SARF (Sample Audit Review File)

11. Program library analysis Code comparison
Other Tools
Source code review
Review of sections of source code
Program library analysis
Review changes to program software
Code comparison
Compare production version of code with master copy
User log analysis
Identify unauthorised entry attempts and password violation

12. CAATs for Data Analysis
Predominant approach followed by auditors
Totalling
Stratification
Data mining
Sampling
Exception Reporting
Duplicate Record Checks
Ageing
Gap Detection
Re-performance of calculations

13. Potential risks from reliance on data analysis Issues
Exclusive reliance on data analysis
Prior IT Controls Review
Verification of integrity of downloaded data
Understanding of IT System and Data
Knowledge of CAAT Tool
Quality Assurance Methodology