Using CAATs to Support IS Audit

Copyright © 2003 Information Systems Audit and Control Association. All rights reserved. www.isaca.org.Using CAATs to Support IS AuditS. Anantha Sayana, CISA, CIACAAT refers to computer-assisted audit technique. This ing personnel. At the end of this phase the IS auditor could haveimplies that an auditor’s use of a computer-assisted audit tech- observations about some controls that exist and are operatingnique is something special—normally the techniques used by satisfactorily or some controls that are nonexistent, badlyan auditor are not computer assisted. Today, in most large and designed or not in compliance. medium-sized enterprises, there are few business processes The following is an example of an IS auditor performing athat are not driven by computers. The business does not refer payroll review. While doing an application review, the IS audi-to them as computer-assisted business processing. The use of tor observed that many of the required validations relating to thecomputers and information technology for doing business is salary ranges and admissible allowances and perks were nottaken for granted, so why should auditors talk about some- built into the application software and concluded that it wasthing special called CAAT? possible to process values that did not meet the rules. When per-Performing audits without using information technology is forming compliance testing, the auditor also observed that thehardly an option. When all the information ...