Computer Aided Audit Techniques | CAAT | Software in Audit | Computers in Audit | ACCA F8/P7

Introduction to CAAT

Computer Aided or Assisted Audit Techniques (CAAT) deals with how computers are to be considered while performing audit techniques, and how computers aid or assist us while performing audit procedures.

When you enter the organization of your client for an audit, they may maintain their accounting information on computers using software such as Tally, QuickBooks, Oracle, SAP, or Intuit. When computer systems or software systems are involved, there are two general approaches to plan the audit:

• Black box approach
• White box approach

Black Box Approach

The black box approach is also called audit around the computer. Under this approach, you do not look into the computer. You ask the client to generate reports using that accounting software, and you perform the audit on those reports.

You ask the client for printouts of journal transactions, ledgers, trial balance, profit and loss account, and balance sheet. Then you verify journals versus ledgers and trial balance using documentary evidence, supporting invoices, and other source documents. You perform the audit as if it were a manual accounting system. You take the printouts, generate reports from the system, and audit those documents rather than auditing the system itself.

The black box approach is more appropriate for small and medium entities. Costs are lower, and the required technical skills and human resources are minimal.

White Box Approach

Under the white box approach, you perform an audit through the computer. This means you verify the systems, the accounting package, and the accounting software being used by the client. Rather than just auditing the documents, you audit the software systems of the client.

To conduct an audit through the computer, the auditor requires technical skills, training, and specialized software to understand how the accounting package operates. When auditing through the computer, two main techniques are used:

• Test data
• Audit software

Accounting Software Types

Before looking at test data and audit software, consider the types of software clients use:

• Ready-made software (off-the-shelf or off-the-rack)
• Tailor-made software (custom-made)

Ready-made software is readily available in the market, such as Tally, QuickBooks, Oracle, or SAP. You can use it directly without modifications. When errors or regulatory changes occur, the software vendors release live updates or patch sets. For example, when Indian corporate reporting moved from Schedule 6 of the Companies Act 1956 to Schedule 3 of the Companies Act 2013, or when GST regulations changed, updated patches were released to adapt to those legal frameworks.

Tailor-made software is custom-built according to the specific requirements and convenience of the client. It can be developed in-house by internal teams or outsourced to software experts. Tailor-made software carries higher audit risk because when issues or errors arise, you have to manually identify, troubleshoot, diagnose, and resolve them. There is a higher risk that misstatements or processing errors remain undetected.

Test Data

Test data is data for which the outcome is predetermined and already known by the auditor. The auditor creates a set of transactions, such as one thousand or two thousand transactions, containing both:

• Appropriate data (accurate data)
• Erroneous data

Erroneous data includes unauthorized transactions, transactions above authorized limits, and arithmetic errors. Erroneous data is submitted to check whether the system detects and handles errors properly. Appropriate data is submitted to ensure the system processes and reports correctly.

Because the auditor already knows the predetermined outcome—such as how a cash sales entry debiting cash and crediting sales should affect revenue in profit and loss and current assets in the balance sheet—the auditor pushes the test data into the accounting software and compares the resulting output with the predetermined outcome to identify system errors.

Test data can be run in two forms:

• Live data
• Dead data

Live data is test data pushed into the client system while operational activities are actively running. This tests whether the system can handle large transaction volumes concurrently without crashing or generating incorrect reports under load, though it carries a risk of corrupting real client data.

Dead data is test data pushed into the accounting package after operations are halted, such as at the end of the day or during lunch breaks. This gives the system a rest and avoids interfering with active client processes.

Audit Software

Audit software automates many tasks an auditor would otherwise perform manually, including:

• Analytical procedures (ratio analysis and trend checks)
• Sampling (generating stratified audit samples)
• Identifying exceptional items (such as a receivable ledger showing a credit balance or a payable ledger showing a debit balance)
• Aging schedules (debtor and inventory aging across 30, 45, or 90 days)
• Communications (generating third-party external confirmation letters)
• Compliance checks (highlighting unfiled returns, late tax payments, and applicable interest or penalties)

Issues and constraints associated with using audit software include:

• Cost of acquiring and modifying software
• Training audit staff to operate it
• Compatibility with the client's system
• Availability of suitable software in the market
• Technical knowledge required to design extra procedures

Embedded Audit Software

Embedded audit software is an audit module built into, included in, or attached to the client's own accounting software.

As transactions are entered into the system, the embedded software carries out continuous audit checks and immediately alerts the auditor. For example, if a customer has an authorized credit limit of $100,000, and a sales transaction would push their outstanding balance to $105,000, the embedded audit software detects that a control limit has been overridden. It logs the event, date, customer, and transaction details into the auditor's notes so that it can be reviewed and factored into the audit opinion and procedures.

Need for Professional Skepticism

CAATs, test data, and audit software are only parts of an overall audit procedure; they do not comprise the entire audit. They cannot replace the auditor's professional judgment, professional skepticism, and due diligence. Substantive procedures such as vouching and verification cannot be substituted by software. The auditor must continue to perform essential substantive procedures manually.

Modern and upcoming auditors are expected to remain technically competent, understand emerging concepts such as data analytics, blockchain, distributed ledgers, and cryptocurrencies, and integrate these capabilities alongside core auditing procedures.