IT audit training for Types of CAATs Session

IT audit training for Types of CAATs Session 3 March 2007 CAAT S 3/1

IT audit training Categories of CAATs for F CAATs for program validation V F CAATs for data analysis V March 2007 Verification of different processes in programs Ignore programs used to generate data; focus exclusively on data CAAT S 3/2

IT audit training Program vs. Data Analysis CAATs for F F F Program validation tools generally only for compliance and financial audits Data analysis tools for performance and investigative audits also Use of program-oriented CAATs requires higher level of technical expertise (Level 3 expert IT auditors) V March 2007 May not be feasible for many SAIs CAAT S 3/3

IT audit training CAATs for Program Analysis for F F March 2007 Tools for examining data flows Tools for verifying data and file integrity Embedded Audit Modules Other Tools CAAT S 3/4

IT audit training Examining Data Flows for F Snapshot V V F Tracing V V V March 2007 Freeze a program at a given point, and check on processing and transaction values E. g. debug facility Complete audit trail tracing transactions through processing of program code Useful for highlighting errors Requires knowledge of programming CAAT S 3/5

IT audit training Examining Data Flows (Contd. ) for F Mapping V V March 2007 Monitoring program execution for statistical information Used for highlighting redundant / fraudulent code CAAT S 3/6

IT audit training Verifying data and file integrity for F F March 2007 Parallel simulation Test Data Generators and Integrated Test Facilities CAAT S 3/7

IT audit training Parallel simulation for F F F March 2007 Independently create routines to simulate/ re-perform parts of application program Useful for checking accuracy of calculations Programming and system knowledge required CAAT S 3/8

Test data generators and Integrated Test Facilities IT audit training for F F March 2007 Generation of fictitious test data for testing application controls Test data generators are independent software programs; while Integrated Test Facility is a part of the application program Test results to be removed from system / reports Difficult to create all possible combinations of test data CAAT S 3/9

IT audit training Embedded Audit Modules for F F Used to extract data meeting auditorspecified criteria into a separate file Volatile data can also be captured Needs to be integrated into the auditee IT system SCARF V V F March 2007 System Control Audit Review File Extracting transactions falling outside auditordetermined reasonable limits SARF (Sample Audit Review File) CAAT S 3/10

IT audit training Other Tools for F Source code review V F Program library analysis V F Compare production version of code with master copy User log analysis V March 2007 Review changes to program software Code comparison V F Review of sections of source code Identify unauthorised entry attempts and password violation CAAT S 3/11

IT audit training CAATs for Data Analysis for F Predominant approach followed by auditors V V V V V March 2007 Totalling Stratification Data mining Sampling Exception Reporting Duplicate Record Checks Ageing Gap Detection Re-performance of calculations CAAT S 3/12

IT audit training Data Analysis – Issues for F F Potential risks from reliance on data analysis Issues V V V March 2007 Exclusive reliance on data analysis Prior IT Controls Review Verification of integrity of downloaded data Understanding of IT System and Data Knowledge of CAAT Tool Quality Assurance Methodology CAAT S 3/13