Data analysis (information technology)
Encyclopedia
Computer-assisted audit techniques or computer-aided audit tools (CAATS), also known as computer-assisted audit tools and techniques (CAATTs), is a growing field within the financial audit profession
. CAATTs is the practice of using computers to automate or simplify the audit process. In the broadest sense of the term, CAATTs can refer to any use of a computer during the audit. This would include utilizing basic office productivity software such as spreadsheet
and word processors programs and more advanced software packages involving use of statistical analysis and business intelligence
tools. But also more dedicated specialized software are available (see below).
CAATs have become synonymous with incorporating data analytics into the audit process. This is one of the emerging fields within the audit profession.
Another common criticism of the audit profession occurs after a problem emerges. Whenever a problem emerges within a department, management might ask, "Where were the auditors?" If the audit department had reviewed the area recently it becomes a sticky situation as the audit manager attempts to explain that the reason the problem wasn't identified was because the problem was outside of the scope of the audit. The audit manager might also try to explain that the sample was "a statistically valid sample with a 95% confidence level." The audit committee doesn't care that the audit was conducted according to GAAS, they only care that a problem went unnoted by the audit department.
Using CAATTs the auditor can select every claim that had a date of service after the policy termination date. The auditor then can determine if any claims were inappropriately paid. If they were, the auditor can then figure out why the controls to prevent this failed. In a real life audit, the CAATTs auditor noted that a number of claims had been paid after policies were terminated. Using CAATTs the auditor was able to identify every claim that was paid and the exact dollar amount incorrectly paid by the insurance company. Furthermore, the auditor was able to identify the reason why these claims were paid. The reason why they were paid was because the participant paid their premium. The insurance company, having received a payment, paid the claims. Then after paying the claim the participant's check bounced. When the check bounced, the participant's policy was retrospectively terminated, but the claim was still paid costing the company hundreds of thousands of dollars per year.
Which looks better in an audit report:
"Audit reviewed 50 transactions and noted one transaction that was processed incorrectly"
or
"Audit utilized CAATTS and tested every transaction over the past year. We noted XXX exceptions wherein the company paid YYY dollars on terminated policies."
However, the CAATTs driven review is limited only to the data saved on files in accordance with a systematic pattern. Much data is never documented this way. In addition saved data often contains deficiencies, is poorly classified, is not easy to get, and it might be hard to become convinced about its integrity. So, for the present CAATTs is complement to an auditor's tools and techniques. In certain audits CAATTs can't be used at all. But there are also audits which simply can't be made with due care and efficiently without CAATTs.
), databases (e.g. Access
), statistical analysis (e.g. SAS
), business intelligence
(e.g. Crystal Reports
and Business Objects
), etc.
There are, however, companies that have developed dedicated specialized data analytic software specifically for auditors.
Benefits of audit software include:
Audit specialized software can easily perform the following functions:
software, the auditor uses CAATS throughout the audit for the following activities while performing data analysis:
CAATTs can assist the auditor in detecting fraud by performing and creating the following,
tests.
.
Computer Aided (or Assisted) Audit Tools (or Techniques)
The first "A" and the "T" can have two different meanings depending on who uses the term. By using the term CAATTs, one is clearly incorporating both "Tools" AND "Techniques."
is the seminal work on CAATTs. David Coderre argues that the term CAATTs is much more appropriate because there is no purpose in having techniques if you don't have the tools, or the tools without the techniques. Coderre attempts to differentiate the use of CAATTs for any computer program used to improve the audit with the acronym "BEASTs." BEASTs stands for, "Beneficial Electronic Audit Support Tools." While CAATTs has become a household term in audit units, BEASTs remains relatively unused. BEASTs includes electronic work papers, Microsoft suite of products, and non-analytical programs/applications.
Financial audit
A financial audit, or more accurately, an audit of financial statements, is the verification of the financial statements of a legal entity, with a view to express an audit opinion...
. CAATTs is the practice of using computers to automate or simplify the audit process. In the broadest sense of the term, CAATTs can refer to any use of a computer during the audit. This would include utilizing basic office productivity software such as spreadsheet
Spreadsheet
A spreadsheet is a computer application that simulates a paper accounting worksheet. It displays multiple cells usually in a two-dimensional matrix or grid consisting of rows and columns. Each cell contains alphanumeric text, numeric values or formulas...
and word processors programs and more advanced software packages involving use of statistical analysis and business intelligence
Business intelligence
Business intelligence mainly refers to computer-based techniques used in identifying, extracting, and analyzing business data, such as sales revenue by products and/or departments, or by associated costs and incomes....
tools. But also more dedicated specialized software are available (see below).
CAATs have become synonymous with incorporating data analytics into the audit process. This is one of the emerging fields within the audit profession.
Traditional audit example
Traditionally auditors have been criticized because they reach conclusions based upon limited samples. It is not uncommon for an auditor to sample 30–50 transactions and declare a problem or conclude that "controls appear to be effective." Management upon hearing the verdict of the auditors may question the validity of the audit conclusions. Management realizes that they conduct thousands or perhaps millions of transactions a year and the auditor only sampled a handful. The auditor will then state that they conducted the sample based upon generally accepted audit standards (GAAS) and that their sample was statistically valid. The auditor is then forced to defend their methodology.Another common criticism of the audit profession occurs after a problem emerges. Whenever a problem emerges within a department, management might ask, "Where were the auditors?" If the audit department had reviewed the area recently it becomes a sticky situation as the audit manager attempts to explain that the reason the problem wasn't identified was because the problem was outside of the scope of the audit. The audit manager might also try to explain that the sample was "a statistically valid sample with a 95% confidence level." The audit committee doesn't care that the audit was conducted according to GAAS, they only care that a problem went unnoted by the audit department.
CAATTs alternative
CAATTs addresses these problems. CAATTs, as it is commonly used, is the practice of analyzing large volumes of data looking for anomalies. A well designed CAATTs audit will not be a sample, but rather a complete review of all transactions. Using CAATTs the auditor will extract every transaction the business unit performed during the period reviewed. The auditor will then test that data to determine if there are any problems in the data. For example, using CAATTs the auditor can find invalid Social Security Numbers (SSN) by comparing the SSN to the issuing criteria of the social security administration. The CAATTs auditor could also easily look for duplicate vendors or transactions. When such a duplicate is identified, they can approach management with the knowledge that they tested 100% of the transactions and that they identified 100% of the exceptions.Traditional audit vs CAATTs on specific risks
Another advantage of CAATTs is that it allows auditors to test for specific risks. For example, an insurance company may want to ensure that it doesn't pay any claims after a policy is terminated. Using traditional audit techniques this risk would be very difficult to test. The auditor would "randomly select" a "statistically valid" sample of claims (usually 30–50.) They would then check to see if any of those claims were processed after a policy was terminated. Since the insurance company might process millions of claims the odds that any of those 30–50 "randomly selected" claims occurred after the policy was terminated is extremely unlikely. Even if one or two of those claims was for a date of service after the policy termination date, what does that tell the auditor?Using CAATTs the auditor can select every claim that had a date of service after the policy termination date. The auditor then can determine if any claims were inappropriately paid. If they were, the auditor can then figure out why the controls to prevent this failed. In a real life audit, the CAATTs auditor noted that a number of claims had been paid after policies were terminated. Using CAATTs the auditor was able to identify every claim that was paid and the exact dollar amount incorrectly paid by the insurance company. Furthermore, the auditor was able to identify the reason why these claims were paid. The reason why they were paid was because the participant paid their premium. The insurance company, having received a payment, paid the claims. Then after paying the claim the participant's check bounced. When the check bounced, the participant's policy was retrospectively terminated, but the claim was still paid costing the company hundreds of thousands of dollars per year.
Which looks better in an audit report:
"Audit reviewed 50 transactions and noted one transaction that was processed incorrectly"
or
"Audit utilized CAATTS and tested every transaction over the past year. We noted XXX exceptions wherein the company paid YYY dollars on terminated policies."
However, the CAATTs driven review is limited only to the data saved on files in accordance with a systematic pattern. Much data is never documented this way. In addition saved data often contains deficiencies, is poorly classified, is not easy to get, and it might be hard to become convinced about its integrity. So, for the present CAATTs is complement to an auditor's tools and techniques. In certain audits CAATTs can't be used at all. But there are also audits which simply can't be made with due care and efficiently without CAATTs.
Specialized software
In the most general terms, CAATTs can refer to any computer program utilized to improve the audit process. Generally, however, it is used to refer to any data extraction and analysis software. This would include programs such as spreadsheets (e.g. ExcelMicrosoft Excel
Microsoft Excel is a proprietary commercial spreadsheet application written and distributed by Microsoft for Microsoft Windows and Mac OS X. It features calculation, graphing tools, pivot tables, and a macro programming language called Visual Basic for Applications...
), databases (e.g. Access
Microsoft Access
Microsoft Office Access, previously known as Microsoft Access, is a relational database management system from Microsoft that combines the relational Microsoft Jet Database Engine with a graphical user interface and software-development tools. It is a member of the Microsoft Office suite of...
), statistical analysis (e.g. SAS
SAS System
SAS is an integrated system of software products provided by SAS Institute Inc. that enables programmers to perform:* retrieval, management, and mining* report writing and graphics* statistical analysis...
), business intelligence
Business intelligence
Business intelligence mainly refers to computer-based techniques used in identifying, extracting, and analyzing business data, such as sales revenue by products and/or departments, or by associated costs and incomes....
(e.g. Crystal Reports
Crystal Reports
-External links:*****Reviews:****...
and Business Objects
Business Objects (company)
SAP Business Objects is a French enterprise software company, specializing in business intelligence . Since 2007, it has been a part of SAP AG. The company claimed more than 46,000 customers worldwide in its final earnings release...
), etc.
There are, however, companies that have developed dedicated specialized data analytic software specifically for auditors.
| Product Name / Brand | Company |
|---|---|
| Audit Command Language Audit Command Language ACL Services Ltd. is a company providing audit analytics and continuous monitoring software. It is "the most widely used data extraction and analysis product" and "the most widely used product for fraud detection and prevention" used in audit profession.... (ACL) |
ACL Services Ltd. http://www.acl.com |
| Interactive data extraction and analysis (IDEA) http://www.caseware.com/products/idea | CaseWare International CaseWare International CaseWare International Inc. develops software for accounting, audit, finance, risk and governance professionals.-History:CaseWare International started in 1988, when founder and chartered accountant, Dwight Wainman, expanded his accounting practice and developed software tools to make taxation and... http://www.caseware.com |
| ESKORT Computer Audit (SESAM) http://eskort.eu/sesam | Intracom IT Services Denmark A/S http://www.intracom-it.dk |
| ActiveData For Excel http://www.informationactive.com/index.php?option=com_content&view=article&id=144&Itemid=489 | InformationActive Inc http://www.informationactive.com |
| CorpSystem ActiveData http://tax.cchgroup.com/data-analysis/default | CCH CCH (Commerce Clearing House) CCH , a Wolters Kluwer business, is a provider of software and information services for tax, accounting and audit workers.-History:... / Wolters Kluwer Wolters Kluwer Wolters Kluwer N.V. is a global information services and publishing company. The company provides products and services for professionals in the health, tax, accounting, corporate, financial services, legal and regulatory sectors... |
| Monarch Monarch (software) Monarch is a desktop report mining tool used to extract data from human readable report files, such as text, PDF, XPS and HTML. The first version of Monarch was released in 1991. The latest release is version 11. The program is developed by Math Strategies and the software is published by Datawatch... |
Datawatch Corporation http://www.datawatch.com |
| TopCAATs for Excel http://www.topcaats.com | Reinvent Data Ltd |
| Picalo http://www.picalo.org | Partly Open Source |
| qzCAATT | QuadZero LLC http://www.quadzero.com |
| countTXT | Bollingen Software, LLC http://www.countTXT.com |
| DB Secrets | Soft Magnet Technologies http://www.softmagnet.in |
| Find Duplicate Records (FDR) | Bollingen Software, LLC http://www.FindDuplicateRecords.com |
Benefits of audit software include:
- They are independent of the system being audited and will use a read-only copy of the file to avoid any corruption of an organization’s data.
- Many audit-specific routines are used such as samplingSamplingSampling may refer to:*Sampling , converting a continuous signal into a discrete signal*Sampling , converting continuous colors into discrete color components*Sampling , re-using portions of sound recordings in a piece...
. - Provides documentation of each test performed in the software that can be used as documentation in the auditor’s work papers.
Audit specialized software can easily perform the following functions:
- Data queries.
- Data stratificationStratified samplingIn statistics, stratified sampling is a method of sampling from a population.In statistical surveys, when subpopulations within an overall population vary, it is advantageous to sample each subpopulation independently. Stratification is the process of dividing members of the population into...
. - Sample extractions.
- Missing sequence identification.
- Statistical analysis.
- Calculations.
- Duplicate inquires.
- Pivot tablePivot tableIn data processing, a pivot table is a data summarization tool found in data visualization programs such as spreadsheets or business intelligence software. Among other functions, pivot-table tools can automatically sort, count, total or give the average of the data stored in one table or spreadsheet...
s. - Cross tabulationCross tabulationCross tabulation is the process of creating a contingency table from the multivariate frequency distribution of statistical variables. Heavily used in survey research, cross tabulations can be produced by a range of statistical packages, including some that are specialised for the task. Survey...
Other uses of CAATTS
In addition to using data analysisData analysis
Analysis of data is a process of inspecting, cleaning, transforming, and modeling data with the goal of highlighting useful information, suggesting conclusions, and supporting decision making...
software, the auditor uses CAATS throughout the audit for the following activities while performing data analysis:
Creation of electronic work papers
Keeping electronic work papers on a centralized audit file or database will allow the auditor to navigate through current and archived working papers with ease. The database will make it easier for auditors to coordinate current audits and ensure they consider findings from prior or related projects. Additionally, the auditor will be able to electronically standardize audit forms and formats, which can improve both the quality and consistency of the audit working papers.Fraud detection
CAATTs provides auditors with tools that can identify unexpected or unexplained patterns in data that may indicate fraud. Whether the CAATS is simple or complex, data analysis provides many benefits in the prevention and detection of fraud.CAATTs can assist the auditor in detecting fraud by performing and creating the following,
Analytical tests
Evaluations of financial information made by studying plausible relationships among both financial and non-financial data to assess whether account balances appear reasonable (AU 329). Examples include ratio, trend, and Benford's LawBenford's law
Benford's law, also called the first-digit law, states that in lists of numbers from many real-life sources of data, the leading digit is distributed in a specific, non-uniform way...
tests.
Data analysis reports
Reports produced using specific audit commands such as filtering records and joining data files.Continuous monitoring
Continuous monitoring is an ongoing process for acquiring, analyzing, and reporting on business data to identify and respond to operational business risks. For auditors to ensure a comprehensive approach to acquire, analyze, and report on business data, they must make certain the organization continuously monitors user activity on all computer systems, business transactions and processes, and application controls. The Institute of Internal Auditors recently published a GTAG on Continuous Monitoring. See also Continuous AuditingContinuous auditing
Continuous auditing is the independent application of automated tools to provide assurance on financial, compliance, strategic and operational data within a company. Continuous auditing uses a set of tools to assure the internal control system is functioning to prevent fraud, errors and waste...
.
Curb stoning in surveys
Curb stoning is the term for instances where a surveyor completes a survey form by making up data. Because some of the data should conform with Benford's law, this practice can be detected using CAATTs which provide the capability of performing such tests. An example case study is provided at http://www.ezrstats.com/CS/Case_Studies.htm to illustrate.Note on the acronyms CAATTs vs CAATs
CAATTs and CAATs are used interchangeably. While CAATs has emerged as the more common spelling, CAATTs is the more precise acronym. The acronym CAATTs solves one of the two problems with defining the acronym. CAATs means:Computer Aided (or Assisted) Audit Tools (or Techniques)
The first "A" and the "T" can have two different meanings depending on who uses the term. By using the term CAATTs, one is clearly incorporating both "Tools" AND "Techniques."
CAATTs and other BEASTs for auditors by David Coderre
CAATTs and Other BEASTs for Auditors by David CoderreDavid Coderre
David Coderre is the best known advocate of Computer Assisted Audit Tools and Techniques in the world. CAATTs are computer tools that assist auditors in their profession. In three books, a package of prewritten scripts, and over 20 published articles David Coderre has garnered a reputation in a...
is the seminal work on CAATTs. David Coderre argues that the term CAATTs is much more appropriate because there is no purpose in having techniques if you don't have the tools, or the tools without the techniques. Coderre attempts to differentiate the use of CAATTs for any computer program used to improve the audit with the acronym "BEASTs." BEASTs stands for, "Beneficial Electronic Audit Support Tools." While CAATTs has become a household term in audit units, BEASTs remains relatively unused. BEASTs includes electronic work papers, Microsoft suite of products, and non-analytical programs/applications.
See also
- Generalized audit softwareGeneralized Audit SoftwareGeneralized audit software is a software designed to read, process and write data with the help of functions performing specific audit routines and with self-made macros. It is a tool in applying computer-assisted auditing techniques. Functions of generalized audit software include importing...
- Information technology auditInformation technology auditAn information technology audit, or information systems audit, is an examination of the management controls within an Information technology infrastructure. The evaluation of obtained evidence determines if the information systems are safeguarding assets, maintaining data integrity, and operating...
- Separation of dutiesSeparation of dutiesSeparation of duties is the concept of having more than one person required to complete a task. In business the separation by sharing of more than one individual in one single task shall prevent from fraud and error. The concept is alternatively called segregation of duties or, in the political...