Internal and Forensic Audit · Internal Audit Tools and Techniques

Computer Assisted Audit Techniques (CAATs) in Internal Audit

Updated 11 October 2026 · Fact-checked

Computer Assisted Audit Techniques (CAATs) are tools that let an auditor use the computer to test systems and data. They include generalized audit software, test data, data analytics and continuous auditing. In an exam, define the technique, say how it works, state its use and name its limits.

Understand Computer Assisted Audit Techniques (CAATs)

In a manual system, an auditor reads vouchers and ledgers. In an IT environment, records are stored as electronic data, often in millions of lines. Sampling a few entries by hand is weak here. CAATs let the auditor use the computer itself to examine the data and the controls.

CAATs fall into two broad groups. The first group tests the data: the auditor runs software over the full file to sort, total, match, find gaps or duplicates, and select items. The second group tests the system: the auditor feeds in dummy transactions and checks whether the programme processes them correctly.

The main techniques are:

Generalized audit software (GAS): ready-made software that reads the entity's files and performs audit tasks such as footing, ageing, duplicate detection, gap detection, stratification and sample selection.
Test data: the auditor submits dummy transactions, both valid and invalid, through the entity's system. The auditor compares the results with results worked out in advance.
Data analytics: analysing whole populations to find patterns, outliers and exceptions, for example payments just below an approval limit or the same vendor bank account under two names.
Continuous auditing: automated tests that run at regular intervals or in near real time and raise alerts on exceptions, instead of one review after the year ends.

Other tools you may see named are embedded audit modules, integrated test facility, parallel simulation and snapshots. Know each in one line.

CAATs do not replace judgement. Software finds exceptions; the auditor decides whether they matter. The data must also be reliable. The auditor should confirm that the file given is complete and agrees with the books, otherwise the results mean nothing. In India, ERP systems such as SAP and Tally, GST data and bank files make analytics highly practical for internal auditors.

Key rules to remember

Test data logic: Expected result (worked out by auditor) vs Actual result (from system) → difference = control or processing weakness; Include both valid and invalid transactions so you test whether the system accepts correct items and rejects wrong ones.
Coverage with GAS: Population tested = 100% of records (not a sample); This is the main advantage over manual sampling. It is valid only if the file is complete and reconciled to the books.
Data completeness check: Control total of file extracted = Control total in books; Do this before running any analysis. Compare record count and value.
Parallel simulation: Auditor's programme output = Entity's programme output on the same data; Differences point to errors in the entity's programme logic.

How to solve Computer Assisted Audit Techniques (CAATs) questions

Use this method for any question on CAATs, whether it asks for meaning, comparison, application to a case or advantages and limits.

1Identify what is asked: define, compare, apply to a scenario, or evaluate.
2Name the correct technique for the facts. Large data to scan means GAS or analytics. Checking whether a programme processes correctly means test data. Ongoing monitoring means continuous auditing.
3Explain how the technique works in two or three lines, using the case facts.
4State the audit objective it serves, such as completeness, accuracy, existence, authorisation or fraud detection.
5List the practical steps: obtain data, check completeness, run tests, follow up exceptions, document.
6Give advantages and limitations in brief.
7Conclude with a clear recommendation or answer tied to the question.

Quickest way: Match technique to need

When to use it: When you have little time and the question asks which CAAT to use or how to compare two of them.

Ask: am I testing data or testing the system?
Data: write GAS or data analytics. System: write test data, integrated test facility or parallel simulation.
Ongoing or real-time monitoring: write continuous auditing.
Add one example from the case, one benefit and one limitation.
Close with the need to confirm data integrity and to document the work.

Common mistakes in Computer Assisted Audit Techniques (CAATs)

Treating CAATs as a replacement for the auditor's judgement.
Students focus on the tool and forget that output is only a list of exceptions.
Fix: State that the auditor interprets exceptions, investigates them and concludes.
Mixing up test data and generalized audit software.
Both are called CAATs and both use computers.
Fix: Remember: test data checks how the system processes dummy transactions; GAS examines the entity's real data files.
Running analytics without checking that the data file is complete.
Students assume the extract is correct.
Fix: Always mention reconciling record counts and control totals to the books first.
Writing only definitions with no example.
Students memorise theory but skip application.
Fix: Add a practical example, such as duplicate vendor payments or invoices just below an approval limit.
Ignoring limitations such as cost, skills and data security.
Students list only advantages.
Fix: Add a line on set-up cost, need for IT skills, risk of altering live data and data confidentiality.
Confusing continuous auditing with a year-end audit using software.
The word audit suggests a periodic review.
Fix: Stress that continuous auditing is automated, frequent or near real time, and produces alerts on exceptions.

Worked examples

Example 1

Sharma Textiles Ltd has about 4,00,000 purchase invoices in its ERP. The internal auditor suspects duplicate payments and payments to unapproved vendors. Advise which CAAT to use and how to proceed.

Show the solution

The population is large and the objective is to find duplicates and unauthorised vendors. Generalized audit software or data analytics suits this.
Obtain the purchase invoice, payment and vendor master files. Reconcile record counts and total value to the books so the data is complete.
Run a duplicate test on vendor code, invoice number, date and amount. Also test for the same amount paid to one vendor on close dates.
Match vendors in payments against the approved vendor master and flag payments to vendors not on it. Also compare vendor bank accounts to employee bank accounts.
Investigate each exception with the underlying documents. Not every flagged item is an error.
Document the tests, results and conclusions in the working papers, and report to management.

Answer: Use generalized audit software or data analytics on the full population, after reconciling the data to the books, to detect duplicates and unapproved vendors. Follow up exceptions manually and document the work.

Example 2

Distinguish test data from generalized audit software, with one use of each.

Show the solution

Test data: the auditor enters dummy valid and invalid transactions into the entity's system and compares the output with pre-calculated results. It tests the programme's processing and controls.
Generalized audit software: the auditor uses software to read and analyse the entity's actual data files, performing tasks such as ageing, sorting, duplicate detection and sample selection. It tests the data.
Test data covers only the conditions the auditor builds into it. GAS can cover the whole population.
Test data is limited by the risk that the tested programme is not the one used in live processing. GAS is limited by the completeness and reliability of the data extracted.
Use of test data: checking that the payroll system rejects a leave entry beyond the balance. Use of GAS: finding duplicate salary payments to the same bank account.

Answer: Test data tests how the system processes dummy transactions; GAS tests the entity's real data. For example, test data checks that payroll rejects invalid leave entries, and GAS finds duplicate salary payments in the payroll file.

Exam tips

Write the definition in one line, then spend the rest on application and use, since the paper is case-based.
Use a small table-like comparison in bullets when asked to distinguish test data and GAS: purpose, what is tested, coverage, limitation.
Always mention data integrity checks and documentation; examiners look for them.
Link CAATs to the audit objective in the case, such as completeness, accuracy or fraud detection.
Mention continuous auditing and analytics as emerging trends if the question is about modern internal audit.

Practice questions from Internal Audit Tools and Techniques

Computer Assisted Audit Techniques (CAATs) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Computer Assisted Audit Techniques (CAATs): frequently asked questions

What are CAATs in internal audit?

CAATs are techniques that use computers to carry out audit procedures. They include generalized audit software, test data, data analytics and continuous auditing. They help the auditor test large volumes of data and system controls.

What is the difference between test data and generalized audit software?

Test data checks whether the entity's system processes dummy transactions correctly. Generalized audit software reads and analyses the entity's real data files. One tests processing logic and the other tests the data.

What is continuous auditing?

It is the use of automated tests that run frequently or in near real time and flag exceptions as they occur. It shortens the gap between an event and the audit finding. It needs reliable data and well-designed rules.

Do CAATs remove the need for sampling?

Not always. CAATs can test a whole population when data is complete and suitable. Manual checking of documents is still needed to investigate exceptions and to test items not held in electronic form.