Computer Assisted Audit Techniques and Tools (CAATTs)

Module 0: Computer Assisted Audit Techniques and Tools

(CAATTs)
Introduction
The purpose of this Auditing and Assurance Standard (AAS) is to establish
standards on procedures to be followed when an audit is conducted in a
computer information systems (CIS) environment. For the purposes of this
AAS, a CIS environment exists when one or more computer(s) of any type or
size is (are) involved in the processing of financial information, including
quantitative data, of significance to the audit, whether those computers are
operated by the entity or by a third party.
The overall objective and scope of an audit does not change in CIS
environment. However, the use of a computer changes the processing,
storage, retrieval and communication of financial information and may affect
the accounting and internal control systems employed by the entity.
Accordingly, a CIS environment may effect:

The procedures followed by the auditor in obtaining a sufficient

understanding of the accounting and internal control system
The auditors evaluation of Inherent risk and control risk through which
the auditor assesses the audit risk
The auditors design and performance of tests of control and
substantive procedures appropriate to meet the audit objectives.

Computer-Assisted Audit Techniques and Tools (CAATTs) are used to perform

different audit procedures. With the use of CAATTs, the auditor can, for
example:
a)
b)
c)
d)
e)

Perform various calculations on the data.

Perform various analytical procedures.
Identify unusual items, duplicate items, or missing items;
Compare data in one file to the equivalent data in another file, and
Determine a sample size, select the sample and evaluate the sample
results.

Analyze in CAATTs
To help the auditor analyze the data, most CAATTs enable an auditor to:
a) List transactions in chronological order, or in increasing/decreasing order of magnitude;

b) Group transactions according to various criteria, such as those with the same date or the
same supplier or customer number;
c) Search for fields with values greater than a reasonable amount;
d) Calculate aggregate figures for a particular period; and
e) Conduct various calculations on the data, such as the average payment amount for
acquisition for a particular service or payment.
Types of Audit in CAATTs
These procedures can be performed on all types of audits, such as financial audit, certification
audit, compliance audit, performance audit, compliance with authority audits and reviews of
internal control structures. In particular, CAATTs are a logical method for performing audits of
Information Technology systems.
The auditor needs to specify the procedures to be performed. After running the CAATTs
procedures, the auditor follows up the results and obtains explanations for any anomalies found.
STEPS TO USING CAATTs
There are basically seven steps involved:
a)
b)
c)
d)
e)
f)
g)

Determine objectives;
Determine Scope;
Understand the operating system;
Understand the characteristics of the data;
Access the data;
Apply the CAATTs; and
Follow up the results.

Consideration in the use of CAATTs

When planning an audit, the auditor may consider an appropriate combination of Computer
Assisted Audit Techniques (CAATTs). In determining whether to use CAATTs, the factors to
consider include:

The IT knowledge, expertise and experience of the audit team (Auditing and Assurance
Standards (AAS) 29)
The availability of CAATTs and suitable computer facilities and data;
The impracticability of manual tests.
Effectiveness and efficiency and
Time constraints

Module 1: Introduction to ACL

Effective decision making depends on timely access to information. This
information may be hidden within vast data files, scattered across multiple
databases, or stored in a variety of data types on different platforms.
Decision makers and data analysts need tools that can help them access to
various data types, process large files, and ask intelligent questions about
the data.
The Data Analysis has long dependency on statistical methods. Statistics
allows us to make useful categorization about data and rely on sampling to
analyze a small percentage of the population. Conventional software, such as
a spreadsheet application, analyzes only a limited number converted records
which are on recognizable formats. Most of the data remains unread.
The analysis requires more than a spreadsheet program to analyze data
effectively. ACL Analytics (khan, 2009) is a tool which makes it possible to
read and analyze data in any format and from any platform. ACL provides
access to virtually any data source, in most cases without advance
preparation or conversion. Queries and data manipulation on files that would
require extensive manual preparation and conversion with other analysis
software can be performed readily. ACL helps in combining data from
dissimilar systems for conversion, reconciliation, and control. It can also be
an integral component in system integration. A common view of data can be
created to view data in different files and analyze it as though it existed in
one file. ACL gives powerful data cleansing and manipulation abilities and
flexible reporting options.

Who Uses ACL?

ACL is used by Internal & External Auditors, Financial Managers, Operational
Managers, Information System Auditors, Chief Risk Officers, Fraud
Investigators, Audit Management, Data Analysts, Accountants, prospective
ACL users who need timely access to data and the means to analyze it
efficiently and effectively. The information ACL provides allows confident
management planning and decision-making.

What can we do with ACL?

Your use of ACL is limited only by your imagination. (university of yale)
Because ACL provides such a huge range of options, you can accomplish
almost any goal in the realm of data analysis. Some of the ways you can use
ACL Analytics to work with data include:

Ensure integrity of data

Identify trends and exceptions, and highlight potential areas of concern
or fraud
Identify control issues and ensure compliance with organizational and
regulatory standards
Age and analyze financial or time-sensitive transactions
Cleanse and normalize data from different systems or structures to
ensure consistent, accurate results
Analyze entire data population - not just samples - for complete
assurance
Automate analytic testing and receive immediate notification of results
Maintain a record of your work in order to review and document steps
taken
Ability to launch applications, URL's and operating system commands
and batch files through the Windows Shell

Understanding Database Concepts

Data
Data is distinct pieces of information, usually formatted in a special way.
Data can exist in a variety of forms -- as numbers or text on pieces of paper,
as bits and bytes stored in electronic memory, or as facts stored in a
person's mind. A key element of data analysis is "Knowing Your Data". Put
simply, data can comprise of letters, numbers or symbols that represent
information. For example, what might this data represent?

04092014
To work with raw data such as the above string of numbers, you must know
how to interpret it and what to do with it. The eight bytes of data could be
interpreted in various ways:

An Amount (NUMERIC) Rs. 4,092,014 or Rs. 40,920.14

An Invoice Date (DATE) April 9, 2014 or September 4, 2014
An Account Number (CHARACTER) 04092014

It is important to consider how different definitions (Meta data) affect how

raw data is interpreted. When defined as a numeric, leading zeros are
dropped which is often a critical component of the field.

Files, records, fields and bytes

Data structures are built from files, which are named collections of
information stored or processed as individual entities. A file is further
composed of a number of smaller units, called records, fields and bytes.
Whereas a record is a collection of related information grouped for
processing, a field is an area within a record where a particular class of data
is stored. Each field then has a start position and length that is measured in
bytes.
Let's consider the telephone directory which includes collection of
information about the telephone users in a particular city. The telephone
directory can be thought of as a file. Each entry for a telephone user is a
record and each type of information repeated in every record - the name,
address and telephone number - is a field.
Viewing ACL
ACL provides the means to access and analyze data through:
Multi-level organization within a project
Easy creation and manipulation of project elements
Analytical tools such as functions, commands, and scripts.
When ACL starts following application window appears which shows Welcome
Tab, Project Navigator and Status Bar. The application window also contains
Title Bar, Menu Bar and Standard Tool Bar.
Title Bar

Menu Bar

Standard Tool Bar

Status Bar

Project Navigator

Welcome Tab

Welcome Tab
The Welcome tab is a fast and easy way to navigate between your projects in
ACL. You can create a project, open a project, or access different links to the
ACL website. When online, you can download product enhancements, submit
support requests, and search the knowledge base.

Project Navigator
The Project Navigator has an Overview tab and a Log tab. The Overview tab
lets you organize items in your ACL project into folders and the Log tab
browse a chronological record of your past activities, view command results,
and save portions of the log to another files.

Status Bar
The Status Bar displays information about the active table, including the
table name, the number of records, and any active filter criteria.

Title Bar

The Title Bar displays the name of the active project and corner of the Title
Bar, an icon Control Box
is available, which can be used to change size
of the application window. In the right hand corner of the Title Bar, the icons
to:
Minimize;
Maximize (Restore); and
Close
The application window is also available.

Menu Bar

Below the Title Bar is the Menu Bar. It contains several command menus.
Each menu item can be selected by clicking on the same.

Standard Tool Bar

Standard Tool Bar provides an easy way to apply various commands

available in the ACL by just clicking on the related icon. It can also be
customized.

THE ACL PROJECT

The ACL Project folder is similar to a top-level folder in Windows, it uses to

store and organize your analytical work. An ACL project can include tables,
scripts, logs, workspaces, and folders. An ACL project is a single text file
consisting of a collection of Table Layouts, Scripts, Views, and Workspaces.
The Overview tab in the Project Navigator displays all the components of a
project. The standard extension for a project file is .ACL. The file can be
stored wherever you have read/write access. Projects do not contain source
data files. To create a new project, select File -> New -> Project. Select
destination folder, give a suitable name and click Save.

Tables

A table is the combination of a table layout and the data source to which the
table layout is linked. The data in a table is presented in a view.
Table Layout:
A table layout is a map describing the data fields in a source data file, and it
is used by ACL to read that source data file. It also contains any expressions
created for the table. Table layouts are stored in the project and do not have
an extension because they are not separate files. They can be listed, copied,
deleted, or renamed using right-click functionality in the Overview. You can
create new table layouts by selecting File > New > Table.

A table layout does not become part of the source data file; hence it can be
used to read other source data files that have an identical layout. Table
layouts include a path statement linking the table layout to the source data
file to be read.
Source data file:
A source data file is the source file containing the data you read with ACL.
This file can be stored anywhere your PC has access. There is no specific
extension needed; however, source data files created by ACL have the
extension .fil, which is a proprietary ACL's file type. Most of the time, when
you import a table into ACL, the ACL software creates this type of file, which
it then reads from.
However, there are three types of file that do not have a corresponding .fil
files after being imported into ACL:

DBF files.
Anything brought in via "Other file Format > Skip To Finish" in the
wizard.
AS/400 files.

With these types of files, the table layout in ACL looks directly at the original
file.

Scripts

A script is a series of ACL commands that can be executed repeatedly within

your project. Almost all commands can be executed in a script. Scripts can
be designed to run automatically or to prompt the user for input.

Logs

ACL automatically creates a log when you create an ACL project. The log is
an audit trail, recording the commands and results from your analysis. This
trail lets you retrace your steps and reproduce results without always having
to save your work. The log is also an excellent resource for generating
reports at the conclusion of your analysis.

Workspaces

A workspace is a set of field definition that has been saved for reuse with
other tables. When a workspace is activated, the field definitions within it are
available for use with the active table. Workspaces let you maintain and
reuse definitions of physical fields, computed fields, and filters, so you do not
have to define these elements more than one time.

Folders

Folders are used to organize your work in an ACL project. ACL folders are
similar to Windows folders.

Elements of Data Analysis:

The main elements of data analysis in ACL are commands, expressions,
functions, and variables.

Commands
ACL commands are means of executing standard analysis, such as statistical
analysis and data profiling. Results can be sent to file, screen, print, and in
some cases, graphs.

Expressions
Expressions are statements used primarily to create filters and computed
fields. They perform calculations, specify logical conditions, or create values
that do not exist in the data file. Expressions can be named and saved as
part of a project or else created just for immediate use.
Filters

A filter is a logical expression that lets you select the

kind of data you want to see and work with. For
example, you can create a filter that selects only
records that fall within a specified range of dates.

Computed
fields

A computed field, also known as a calculated field, is a

virtual field that uses data derived from an expression
or a specified constant. It does not contain physical
data. For example, you can create a new field that is the
product of the values in two other fields. You can also
insert into a table a specific value such as an interest
rate or a logical condition.

Functions
A function is a predefined routine that performs a computation on specified
data. A function uses variable to accept input data values. ACL currently
offers approximately 86 different functions.

Variables
A variable is a named memory space that stores data. The value stored in a
variable can be a character, numeric, date, or logical type. Variables are
widely used in functions, expressions, and scripts.

The Data Analysis Cycle

Every data analysis project follows a regular cycle of activities. Ensure that
the work is performed thoroughly, accurately and efficiently. The data
Analysis cycle has been divided into five phases.

Planning

Data
access

Data
integrity
verificati
on

Data
analysis

Reportin
g

Planning

Plan your work before you start a project. By formulating clear objectives
before you begin your analysis, you can develop concise strategies and
budget the right amount of time and resources.

Data Access

The next step is to access the data outlined in your strategic plans. This
requires locating, requesting, and transferring the data prior to reading it
with ACL.

Data Integrity Verification

Having received the data, it is necessary to test its integrity. If you start your
project without having first verified the datas accuracy and completeness,
your results may be unreliable or incorrect.

Data Analysis

In the analysis stage, you perform the tests necessary to achieve your
objectives. You are likely to use a combination of commands, filters, and
computed fields in your analysis.

Reporting Results
Depending on the project, you may need to create reports from your results.
ACL can create different types of reports, including multiline, detail, and
summary reports.

Module 2: Data Access (YOUSAF, 2011)

Data access is a critical part of any data analysis project. You need to find
and acquire necessary data in an efficient and effective manner. Because of
the variety of data sources and technologies, data access methods vary. ACL,

however, can access almost any kind of data. The data access process
involves the following steps:
1. Locate the data: Locating data requires understanding the individual
files available; the various file types and the technologies used to
access them. If you are to make an informed request to the data
provider, you need to learn what data is available to you and the
format in which it is stored. Effectively communicating your data needs
will save time for both you and your Information Systems (IS)
department.
2. Acquire the data: After developing an overview of the available data,
you need to acquire the data. To do that, you must do the following:
Determine your analytical objectives
Request the data
Transfer the data
3. Access the data: When the data has been made available in a usable
format, you can begin the process of accessing it with ACL. ACL reads
different file type in different ways and with varying degrees of
automation. Data from newer technologies requires less manual
processing than data from legacy systems.
There are two methods that ACL uses to access data:
Direct access

Import
copy

ACL reads the data directly from the source in its

native format without creating a copy of the data.
ACL creates tables with varying degrees of
automation depending on how much layout
information the source contains. ACL populates
tables with data read directly from the source.
and ACL imports the data as a flat file and copies it to a
local drive. Details on the organization and structure
of the data are maintained together with the
information. ACL reads the structure to define the
layout.

Bibliography
khan, k. (2009). guidelines on data inspection and analysis payroll (Vol. 1).
islamabad: yousof and sons.
SDS. (8009, 9 7). Retrieved from AXC: SADAS

university of yale. (2006, January 7). Retrieved from YALE: www.yLE.COM

YOUSAF, M. (2011). GUIDLINES. KARACHI: WALEED AND SONS.