UNIVERSITY OF WATERLOO

School of Accountancy
ACC 626

Computer Assisted Audit Techniques: A Study of the Tools, their Usage

and Future Initiatives

Waterloo, Canada

prepared by

Jonathan Suen

July 5, 2009
1. INTRODUCTION
PC-based computer-assisted audit tools (CAATs) have been available since late
1980s (Brodie, 1990; ACL, 2009). Before that, there were CAATs that run on
client’s mainframe. One advantage of PC-based CAATs is that clients do not
have to worry about the auditors changing their data. PC-based CAATs are also
less costly (Brodie, 1990). With lower cost and lower risk, advocates expected
auditors to maximize the use of CAATs. This research paper will look at:
how prevalent the use of CAATs is among internal and external auditors,
major CAAT offerings, and
future initiatives.
This paper shall focus on the application of CAATs in financial statement
audits. Note that CAATs can be broadly classified as data analysis software,
network security evaluation software, operating systems and database
management system security evaluation software, and software and code testing
tools (Sayana, 2003). For the rest of this paper, the term CAATs will refer only to
data analysis software, as procedures involving the other tools are beyond the
scope of financial statement audits.

2. Trend in Use of IT in Clients and Auditors’ Use of CAATs

Accounting information systems (AIS), used loosely here to include
accounting software such as QuickBooks, are now widely used in organizations
of all sizes. As most AIS come with the function to export data, it has become
easier for client staff to provide auditors with data in electronic form. Transferring
data to auditors’ computers are also easy, with the ever-increasing storage
capacity of removable media such as DVDs and USB drives. Despite having the
means to download and analyze data, many firms did not use CAATs as much
as they should (Gascoyne, 1992).
Reasons for underutilizing CAATs may include:
cost constraints (Gascoyne, 1992). CAATs often take longer to use during the
first year of implementation, since auditors need to take time to explain data
needs to clients and understand the data. Many practitioners claim not to

1
 consider an extended budget period when evaluating the value of CAATs
because prior experience has showed that savings are not realized in year
two (KPMG, 2005);
the misconception that CAATs are cost effective only for larger jobs, thus
limiting their use to jobs “whose profiles demand it” (Gascoyne, 1992); and
insufficient planning. Decisions regarding where to use CAATs are made too
early in the audit process, and without adequately considering risk
(Paukowits, 2000). Firms are simply looking to automate old tests (Gascoyne,
1992), and the use of CAATs is often limited to the more popular functions
(Paukowits, 2000).
User resistance is no longer an issue, as today’s auditors are very technology
savvy and readily accept most audit tools (KPMG, 2005). If it were, training is
effective at reducing staff’s unwillingness to be innovative with technology.
Nevertheless, auditors are known to use CAATs for fraud detection (such
as journal entry testing) and ad hoc testing, rather than substantive testing, and
even more rarely for control testing. CAATs are often used in selecting samples
for confirmations, preparing aged receivables reports, and to quantify findings. In
addition, they are required when large volume of data rendered manual vouching
and recalculation inadequate, if not impossible, to gather sufficient audit
evidence.

2.1 Benefits of CAATs

The costs of common CAATs (to be introduced later) can be justified by
the following benefits:
Cost savings. This can be achieved by replacing manual audit activities such
as selecting statistical samples (Lanza, 1998), or by analyzing large volume
of data.
Achieving 100% coverage of transactions, potentially allowing auditors to
detect more misstatements than sampling (Lanza, 1998). This offers value to
clients, and lowers risk of restatements. Auditors can also quantify
misstatements precisely, rather than extrapolating misstatements from errors

2
 (Lanza, 1998). This gives auditors more ground in requesting clients to adjust
its accounts.
Macros and preprogrammed routines can further enhance audit efficiency
(Sayana, 2003).
Having the right technology, including CAATs, and using them the right way
can facilitate staff in understanding client business and performing a more
efficient audit. It also represents learning opportunities for staff. These lead to
happier staff, which in turn leads to lower staff turnover (Heveron, 2007).

2.2 Ways to increase the use of CAATs among auditors

CAATs should be used whenever they lead to improved audit efficiency
and audit quality. The following ways can increase the use to CAATs among
auditors:
To achieve cost savings, adequate training that includes real-life exercise with
audit software is essential (Sayana, 2003).
As auditors with shorter-term budget and evaluation periods are less likely to
implement technology such as CAATs, evaluate the effectiveness of the use
of CAATs using longer-term budget that is more than 2 years (KPMG, 2005).
Budget for year one should be extended to accept a reasonable increase in
time.
External auditors need senior management support for CAAT use (KPMG,
2005), and internal auditors need support from audit committee,
management, and the IT department.
To decrease the time spent on data acquisition, audit managers should obtain
the support of client superiors (KPMG, 2005). The audit team should define
the output requirements, and document how reports or data extractions were
obtained as well as the queries used (ISACA, 2008).
Audit team should link CAATs with high risk areas during planning to take
advantage of the ability of CAATs to test specific risks and audit 100% of
large volume of data easily.

3
 Audit team should consider using CAATs for more than ad hoc tests and
fraud procedures.
Ultimately, whether CAATs can improve audit efficiency and strength of audit
evidence depends on the audit team’s understanding of the client’s business
processes and experience with the audit tools.

2.4 Situations in which CAATs can be used to test controls

The U.S. Statement on Audit Standard 94 states that “it is not practical or
possible to restrict detection risk to an acceptable level by performing substantive
tests,” given the increased prevalence of paperless processes (Gallegos et al,
2004). Certain situations require auditors to test IT controls. Examples of these
situations include:
Applications or systems involving electronic data interchange (EDI) (Gallegos
et al, 2004);
Electronic payment systems (Gallegos et al, 2004);
Decision support systems that involves automatic reasoning where they
support decision-making within the client organization (Gallegos et al, 2004);
In systems that provide electronic services to customers (Gallegos et al,
2004); and
Applications that perform complex calculations that leads to financial
decisions (Gallegos et al, 2004).
Since the data is in electronic form, CAATs can be used to help.

3. GAS offerings
GAS has come to refer to data analytic software specifically designed for
auditors. They can be classified into two groups: standalone software and add-
ons to Microsoft Excel. Auditors also use other software. While there is little
public data on the software used by external auditors, many audit firms have not
implemented GAS, citing ease of use and learning requirements as reasons
(Lanza, 2009).

4
 Meanwhile, there were surveys on the software used by internal auditors.
Figure 1 shows the trends in software use among internal auditors. Note that
while 2001 and 2005 figures are mostly comparative, 2009 figures may not be
comparative because they were released in a different survey.
Figure 1

Trends in software use among IA

SAS
Data Analysis Tools

Other
Internally developed software 2001
IDEA 2005
Excel 2009

Database software
ACL

0% 10% 20% 30% 40% 50% 60%

Percentage

Notes to chart:
2001 and 2005 numbers are based on surveys conducted by the Institute of Internal Auditors on
US and European countries, while 2009 numbers are based on a survey by KPMG, which
samples only companies from Europe, the Middle East, and Africa.
The category “Other” includes Business Intelligence software (Business Objects, Cognos, Crystal
Reports, etc.) and data retrieval tools (Easytrieve).
The category “Database software” includes Access, SQL, and AS/400 query.

Excel remains the most popular data analysis tools. Possible reasons include
user familiarity with the interface and functions, and low costs since spreadsheet
software has long been used by organizations. It is also interesting to note that 1)
business intelligence tools are not gaining popularity despite their increased
sophistication and deployment, 2) the decline in relative use of ACL, and 3)
internally developed software are becoming less popular, possibly due to the
availability and ease of maintenance with commercial solutions. Furthermore, the
KPMG report found that
audit tools “were not commonly used in areas such as planning and risk and
controls analysis”

5
 33% of organizations do not use any data analysis or sampling tools.

3.1 Standalone GAS: ACL vs. IDEA

Standalone GAS are more commonly used by organizations and audit
firms than Excel add-ons. Two main solutions are Audit Command Language
(ACL) and Interactive Data Extraction and Analysis (IDEA). Both companies are
headquartered in Canada.
3.1.1 History of ACL and IDEA
ACL “was first developed as a teaching tool at the University of British Columbia
in the early 1970s and was released commercially in 1987” (CGA-Canada,
2004). It was supported by the Institute of Internal Auditors (Mattila, 2009), and is
the most commonly used data extraction and analysis tool, used by “85 percent
of the Fortune 500 companies and over two-thirds of the Global 500, … and
hundreds of national, state, and local governments” (ACL, 2009). There is
evidence that Deloitte and Ernst & Young use ACL, as both firms offer ACL
training courses (Deloitte, 2009; Ernst & Young, 2009).
On the other hand, IDEA was first developed by the Office of the Auditor
General of Canada in 1986, acquired by the CICA in 1987, and finally acquired
by Caseware in 2000 (Mattila, 2009; CGA-Canada, 2004). Initially, it was mostly
a sampling tool, reportedly slower than ACL (Mattila, 2009) and lack data
manipulation features such as joining files and data stratification (Jacobson,
1990). It has since increased its market shares, and is known to be used by
accounting firms such as BDO, Grant Thornton, KPMG,
PricewaterhouseCoopers, RSM McGladrey & Pullen, and others (Caseware,
2008).
Lastly, the GAS that schools expose students to may impact firms and
organizations when choosing which product to implement. A survey conducted in
2004 found that ACL is more often used in universities than IDEA (Weidenmier,
2004). Since industry leadership is the most cited reason for choosing ACL,
whether ACL or IDEA is used may be location-specific (e.g. IDEA may be more
widely used in Canada than the U.S.)

6
3.1.2 Comparison based on user feedbacks found on the Internet
Overall, users found little difference in functionality between ACL and
IDEA. The main difference is that ACL uses SQL conventions when building
queries, while IDEA incorporates many Visual Basic Applications components
used in Excel (IIA user forum, 2009). As a result, many Excel macros are
portable to IDEA (Mattila, 2009). The following are highlights of other user
comments:
Pros of ACL:
Bigger online support community (IIA user forum, 2009)
More companies use ACL. Therefore, candidates with ACL experience are
easier to find. This has hiring implications for organizations and firms (IIA user
forum, 2009).
ACL create virtual tables while IDEA creates a new file with every command
(Texas ACL User Group, 2009). The main advantage with virtual tables is that
auditors just have to move one file to the working paper.
ACL “allows users to SET LOG or SET SESSION to log specific periods of
execution.” This leads to more concise working papers for review (Texas ACL
User Group, 2009). Users can also delete logs, although this might not be a
desirable feature for auditors to ensure documentation completeness.
Pros of IDEA:
IDEA’s Import function has some key advantages. IDEA allows you to save
how you interpret files as templates so that you can use it to import other files.
IDEA also imports PDF files better (Texas ACL User Group, 2009).
If you delete a file in IDEA, you can get it back from the recycle basket, while
deleting files in ACL is final unless you have them backed up.
IDEA allows for multiple data extractions at one time, while ACL doesn’t.
A user found IDEA easier to user (IIA user forum, 2009). Examples given:
When joining files, key fields do not need to be of the same length in
IDEA, while this is required in ACL.
IDEA does not require users to index files, while this is required in ACL.

7
 In IDEA, users do not need to give names to a filter and an index, while in
ACL they must.
As a result, the user found it easier to learn IDEA.
Nevertheless, overall user satisfaction with both solutions is highest among
software used by internal auditors (IIA, 2006).

3.2 CATTS: Excel add-ons

Cost and user acceptance are often why auditors either don’t use GAS or
don’t use them to its potential (Auditsoftware.net, 2009). Excel based GAS are
both cheaper and easier for users to accept. Two major offerings of Excel based
GAS are ActiveData and TopCAATs. The former is based in Canada, and the
latter is based in the UK. Both solutions offer most of the main capabilities of
standalone GAS. They have an advantage from an audit efficiency standpoint -
auditors do not have to export results to Excel for further documentation. They
also an advantage from a usability standpoint – since they are based on Excel,
all Excel functions can be used simultaneously.

3.3 Excel macros and SQL

Excel macros and SQL combined make a cost-effective substitute for
GAS. Excel macros can be programmed to perform many data analysis functions
of the aforementioned GAS, such as random sampling and testing compliance
with a set of user-determined attributes (Burnett, 2005). Downsides include
requirement of Excel know-how and testing before implementation. Nevertheless,
Excel macros can be used across audits if data structure is the same.
SQL substitutes GAS in many data extraction and manipulation functions.
For example Auditors can use SQL to perform data classification (frequency
distribution, outlier and trend identification, etc), data extraction, sampling, and
audit tests (recalculation, Benford’s Law analysis, etc) (Blakley, 2008).
There are three major advantages with using SQL (Blakley, 2008):
1. Auditors can interrogate the system directly, crafting queries to suit a number
of audit tests.

8
2. Many audit procedures such as subtotals and use of selection criteria are
already built into SQL.
3. Since SQL is a universal language, SQL commands can be used across
audits.
Drawbacks include learning curve of SQL and risk of unintentionally
changing client data. These drawbacks can be mitigated, however. Firstly, the
cost and time required to teach auditors SQL is reduced by the fact that “20% of
the SQL statements and syntax can provide 80% of all commonly needed audit
functionality” (Blakley, 2008). Secondly, there are techniques to restrict
modification of data, such as working with virtual tables called views, rather than
actual tables.

3.4 Overall comparison

Appendix I contains a comparison of ACL, IDEA, ActiveData, TopCAATs, and
Excel and SQL. The comparison is based on similar comparisons done by
Auditsoftware.net and the research paper “Selecting an Audit Software Package
for Classroom Use” (Weidenmier, 2004), as well as Internet search.
To summarize, Excel add-ons such as TopCAATs and ActiveData are
capable substitutes of the more expensive standalone GAS. However,
robustness and user support base are not as proven as standalone GAS. ACL
and IDEA also have better import capabilities. For these reasons, the best
recommendation seems to be a two product approach (Lanza, 2009):
1) Use one of the Excel add-ons, which will probably cover most of auditors’
needs with minimal training, and
2) Purchase one or two ACL / IDEA licenses (per office) and invest in training a
couple of experts “for those occasions where a little more is needed”, such as
importing a difficult file.

4. How ACL and IDEA have changed in recent versions

One way to get a sense of where GAS are heading is by looking at past
improvements. Back in 1988, ACL was already able to import various file

9
formats, perform data extraction and sampling (including MUS), summarize,
compile summary statistics, insert virtual fields, and log activities (Stanley, 1988).
Appendix 2 contains a list of enhancements and new features to IDEA
since version 6. Improvements are continually made to documentation, GUI, and
import capability. New functionality includes data analysis capabilities,
standardized tests, and Equation Editor functions. Overall, continual additions of
functions, improvements to GUI, and user customization are ways IDEA are
using to increase value to organizations and firms.

4.1 Future Initiatives with GAS

Practitioners can expect software makers to continue to introduce new data
interrogation functions in their software, as well as offer user customization. As
most accounting information systems have the ability to export files as CSV or
Excel files, Excel-based GAS has the potential to compete with standalone GAS
and drive price down. Nevertheless, adoption of Excel-based GAS might be
opposed by users, who may have developed expertise with ACL and IDEA.
As CAATs become more widely use, there is potential for users sharing
customized scripts. Such collaboration might improve audit efficiency and further
boost the use of CAATs. As continuous auditing becomes more widely
practiced, CAATs may also become more widely used.

5. Conclusion
While ACL and IDEA are becoming more widely used by organizations and firms,
Excel-based GAS is a viable substitute. In additional, Excel macros and SQL are
serviceable substitutes to GAS for auditors with limited budgets and who are
open to learning new techniques. Auditors should consider whether the cost
savings and added competency warrant the training and commitment necessary
to realize the potential of the two techniques. Regardless of what GAS is
implemented, auditors should adopt best practices in using CAATs, such as
documenting data acquisition process, and using CAATs in high risk areas.

10
Works Cited
Audimation. "IDEA v7 Enhancements." Caseware IDEA June 2006. 5 July 2009
<http://www.audimation.com/pdfs/IDEA%20D.A.S-Enhancements-2006-
AUDIMATION.pdf>.

Brodie, Grant. "CAATs scan." CA Magazine Apr. 1990: 32-24. 5 July 2009 <ABI/INFORM>.

Caseware IDEA. "IDEA v8 Enhancements." Caseware IDEA Mar. 2009. 5 July 2009
<http://www.caseware.com/products/idea/IDEAEnhancements.pdf>.

Caseware. "CaseWare IDEA Inc. Releases IDEA 2004." n/a Jan. 2004. 5 July 2009
<http://www.casewareidea.com/caseware/about-us/news-reviews/caseware-idea-inc.-
releases-idea-2004>.

Caseware. "CaseWare IDEA announces 1st North America IDEA User Conference ." n/a May
2008. 5 July 2009 <http://www.caseware.com/about-us/news-reviews/1st-north-
american-idea-user-conference>.

Deloitte. "Audit Command Language Program." n/a Mar. 2009. 5 July 2009
<http://www.deloitte.com/dtt/article/0,1002,cid%253D256833,00.html>.

Ernst & Young. "Workshop Managing Risk and Business Improvement with Analytics." n/a Feb.
2009. 5 July 2009
<http://www.ey.com/Publication/vwLUAssets/Workshop_Managing_risk_and_business_i
mprovement_with_analytics_20090812/
$FILE/Workshop_Managing_risk_and_business_improvement_with_analytics_2009081
2.pdf>.

Gallegos, Frederick, Sandra Senft, Daniel P Manson, and Carol Gonzales. Information
technology control and audit. n/a: ISACA, 2004.

Gascoyne, Rodney J. N.. "CAATs it if you can." CA Magazine June 1992: 38-40. 5 July 2009
<ABI/INFORM>.

Heveron Jr., John F. "Technology As a Tool for Recruiting and Retaining Staff." CPA Practice
Management Forum 3.12 (2007): 12,22. ABI/INFORM. 5 July 2009.

IIA. "Opening the door: new possibilities await auditors who can tie software tools into their
organization's existing systems.." IIA Aug. 2005. 5 July 2009
<http://findarticles.com/p/articles/mi_m4153/is_4_62/ai_n15890727/pg_6/?tag=content;c
ol1>.

IIA. "Tools of the Trade - internal audit software survey." IIA Aug. 2001. 5 July 2009
<http://findarticles.com/p/articles/mi_m4153/is_4_58/ai_78403693/?tag=content;col1>.

ISACA. "Use of CAATs." ISACA Dec. 2008. 5 July 2009

<http://www.itgi.org/AMTemplate.cfm?Section=Standards,_Guidelines,_Procedures_for_
IS_Auditing&Template=/ContentManagement/ContentDisplay.cfm&ContentID=39261>.

Jacobson, Scott D, and Wolfe Christopher. "Auditing with Your Microcomputer." Journal of
Accountancy 169.2 (1990): 70-80. ABI/INFORM Global. 5 July 2009.

King, Susan. "Tools to Manipulate Data." CGA Magazine Jan. 2004. 5 July 2009
<http://www.cga-canada.org/en-ca/AboutCGACanada/CGAMagazine/2004/Jan-
Feb/Pages/ca_2004_01-02_dp_doubleclick.aspx>.

11
Lanza, Rich. "Comparison of Generalized Audit Software." Auditsoftware.net n/a.n/a (2009): n/a.
5 July 2009 <http://www.auditsoftware.net/documents/GeneralizedAuditSoftware.pdf>.

Lanza, Richard B. "Take my manual audit, please." Journal of Accountancy 185.6 (1998): 33-36.
ABI/INFORM Global. 5 July 2009.

Martin, Gary. "How Audit Software Can Help Improve Data Analysis & Data Mining." Mid-Atlantic
Intergovermental Audit Forum n/a.n/a (2007): n/a. 5 July 2009
<http://www.auditforum.org/speaker%20presentations/mid%20atlantic/maiaf%2006%20
2007/martin.pdf>.

Mattila, Matti. "IDEA a Generalized Audit Software in CAATs." IDEA. 5 July 2009
<http://www.saunalahti.fi/mmla/ide01.html>.

Paukowits, Frank, and Ken Paukowits. "Bridging CAATs and Risk." The Internal Auditor 57.2
(2000): 27. ABI/INFORM Global. 5 July 2009.

Rich, Lanza. "TopCAATs - Audit software for the masses." Auditsoftware.net n/a (2009). 5 July
2009 <http://www.auditsoftware.net/documents/TopCAATs.pdf>.

Rowe, Rob. "An Examination of Contextual Factors and Individual Characteristics Affecting
Technology Implementation Decisions in Auditing." UWCISA Comments n/a.n/a (2005):
n/a. 5 July 2009 <http://artsms.uwaterloo.ca/accounting/UWCISA-
new/symposiums/symposium_2007/Curtis%20and%20Payne%20-
%20Oct%202007.ppt>.

Sayana, S. Anantha. "Using CAATs to Support IS Audit." ISACA 1 (2003). 5 July 2009
<https://www.isaca.org/Template.cfm?Section=IT_Audit_Basics&Template=/ContentMa
nagement/ContentDisplay.cfm&ContentID=15894>.

Stanley, Philip. "ACL (Audit Command Language)." Modern Office Feb. 1998. 5 July 2009
<ABI/INFORM>.

Weidenmeir, Marcia L, and Terri L Herron. "Selecting an Audit Software Package for Classroom
Use." Journal of Information Systems 18.1 (2004): 95-110. ABI/INFORM. 5 July 2009.

And all the works cited in the annotated bibliography.

12
Appendix 1 – Comparison of Features among major CAATs
Note: The best product for each feature is highlighted.
Feature ACL IDEA Excel and SQL TopCAATs ActiveData
Cost $2,895 per user1 $2,750 per user1 $02 ~$3803 ~$2904
Ease of Use5 4 3 5 1 2
(1 = easiest, 5 =
hardest to learn)
Frequency of updates ~ every 3 years6 ~ every 2 years7 ~ every 4 years8 N/A since new ~ every 2 years9
Import capability10:
- Excel, Access, Y Y Y13 (except Y Y
Dbase, Delimited, Dbase)
Fixed-Width
- Mainframe format Y Y (as AS400 file)
(EBCDIC and ASCII)
- PDF Y Y
- ODBC Y Y Y14 Y14 Y14
- accounting Y12 Y15 Y Y
software11

1
As of February 2004, per CGA Magazine Article “Tools to Manipulate Data”
2
Cost does not consider cost of Microsoft Excel and database implementation and maintenance based on the assumptions that Excel cost is sunk
cost for firms, and database costs are sunk cost for clients.
3
199 British pounds, translated to CAD on July 5, 2009
4
249 USD, translated to CAD on July 5, 2009
5
Subjective rating, based on comparison done by Auditsoftware.net and assumption that the audit team does not know any SQL
6
ACL 9 was released in 2006, 3 years after the release of ACL 8. ACL 9.1 is the most current version as of July 5, 2009.
7
IDEA has been releasing a new version every 2 years since IDEA 2002. IDEA v8 is the most current version as of July 5, 2009.
8
Based on the period between Office 2003 and Office 2007
9
ActiveData was first released in 2005 <http://www.informationactive.com/?x=show&f=news>. A new version was released in 2007 that is
compatible with Office 2007 and Windows Vista. I assume that ActiveData will release a new version more frequently than updates to Excel.
10
Based on comparison done by Auditsoftware.net

13
Feature ACL IDEA Excel and SQL TopCAATs ActiveData
Processing16:
- Aging Y Y Y (using SQL) Y Y
- Append files Y Y Y Y Y
- Calculate Field Y Y Y Y Y
- Benford’s Law Y Y Y (using SQL) Y Y
- Duplicates Y Y Y Y Y
- Extract / Filter Y Y Y Y Y
- Gaps Analysis Y Y Y Y
- Index / Sort Y Y Y Y Y
- Join / Relate Y Y Y Y Y
- Regression Y
- Sample Y Y Y (using SQL) Y
- Statistics Y Y Y Y Y
- Stratify Y Y Y (using SQL) Y Y
- Summarize Y Y Y Y Y
- Highlight differences Y
- Outlier extraction Y
Output:
- Export results Y Y Y Y Y
- Log Y Y ? Y

11
This includes QuickBooks, Simply Accounting MYOB, AccPac, etc. Ability to import these files has implications for auditors of smaller
organizations.
12
Compatibility utility available for download from Caseware IDEA, per CGA Magazine Article “Tools to Manipulate Data”
13
Users can export Access data to Excel, per http://office.microsoft.com/en-us/access/HP010950951033.aspx.
14 rd
There are 3 party products that allow users to import PDF to Excel, per comparison by Auditsoftware.net.
15
Users can access data within an Excel file by specifying an ODBC Data Query connection to an Excel file using the Excel ODBC driver, per
http://www.adeptscience.co.uk/products/dataanal/genstat/htmlhelp/spread/HowtoAccessExcelData.htm.
16
Technically, Excel and SQL have all these features if macros are considered. Given the technical nature of macros and time to develop them,
macros are excluded for this comparison.

14
Appendix 2 – Changes to IDEA from the last two version updates
The following version updates are compiled from Caseware IDEA media releases and product brochures.
Rows with changes in 2 or more versions are highlighted.
IDEA v6 (released in 2004) IDEA v7 (2006)
Enhancements: No data
Customization Completely redesigned
IDEAScript
Data Analysis Enhancements to Pivot Table
- more functions to view
results
Documentation History is better organized
Export
GUI Separate tabs for each file
More space to view data, as
File Explorer and Database
Properties windows now can
be hidden and triggered by
pointer
Improved drill-down
Import Bad data handling
Capability Complex file assistance
15
IDEA v8 (2008)
Report name now based on
Result name
Include field names as first
row when exporting to Text
Delimited or Fixed Length
Ability to save selected
records only
Allow users to Sort data
Improved readability – can
now assign an alternating
row color
Field selection toolbar –
useful for databases
containing more fields than
can be displayed
Display Criteria history
Drag and Drop
Rerun now supported
IDEA Server imports now
 IDEA v6 (released in 2004) IDEA v7 (2006) IDEA v8 (2008)
include ODBC and Excel
Report Reader: 4GB limit
removed
Create or modify a record
definition without having to
open a data file
Licensing Network and standalone
licensing
Sampling MUS now allow use of % for
Tolerable Error and Expected
Error
Software IDEA will now automatically
updates look for new updates;
quarterly updates to improve
reaction to user needs
New
Functionality:
Customization Visual Script – allow users to
build own automation without
any coding
Custom Functions – allow
users to create and share
custom functions
Data analysis full text searching across top record extraction
multiple fields insert and delete fields
without doing an extraction or
import
Summarization now includes
stats such as average, max,

16
 IDEA v6 (released in 2004) IDEA v7 (2006) IDEA v8 (2008)
min
From Field Manipulation you
can add field tags to facilitate
standardized tests in IDEA
Smart Analyzer
Documentation field statistics and charting Project Overview – a
graphical representation of
work done on all files in a
Working Folder
Equation editor support and functions for new “@” functions new “@” functions
time data types (LastDayofMonth,
enhanced functionality for the StripAccent, etc.)
Equation Editor
Export Support for export of Results
to custom document formats
(Excel, Caseware Working
Papers)
GUI Action Fields to allow drill Group records by key
down across multiple files Text wrapping for character
fields
New conclusion window
Import XML import all invalid field data will be
Capability importing a print file marked “Error”
Sampling Classical Variables Sampling

17
Annotated Bibliography

Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Burnett, Royce Excel Macros to The Journal of Vol. 16, Iss. 5 Jul/Aug 2005 p. 47 – 58 May 30, 2009 ABI Inform
D. and Mark Quicken SOX Corporate
Friedman Auditing Accounting &
Finance
Annotation
The authors suggested the introduction of Excel-based macros to:
- randomly select a sample from the population;
- employ a set of attributes to identify if a transaction is in compliance;
- automatically place compliant transactions in a compliant file (spreadsheet) and generate relevant mathematical relationships about the compliant subsample;
- automatically place non-complaint transactions in a non-compliant file and generate mathematical relationships about the subsample;
- automatically separate the non-compliant transactions based on attribute parameters

Specific examples given include:

- control test of depreciation;
- selection and testing of Accounts Payable;

The majority of the article provides step-by-step instructions for setting up macros for the purposes mentioned above.

18
Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Debreceny, Employing Managerial Vol. 20, Iss. 6 2005 p. 605 – 618 May 30, 2009 ABI Inform
Roger et al. generalized audit Auditing Journal
software in the
financial services
sector – Challenges
and opportunities
Annotation
The study establishes the nature and extent of use of GAS by bank internal and external auditors. Limitations of GAS includes: a) potentially costly, with
licensing fees and maintenance contracts, b) too technical and complex for non-IT auditors, evening if training is provided (note that this study was conducted
prior to 2005), c) auditors feel more comfortable manually reviewing records, and d) clients are worried that their systems and data might be compromised.

The study is conducted with 2 large local and 1 international commercial banks in Singapore (Bank A, B, and C respectively).
Internal auditors:
- Bank A and C do use GAS for substantive tests. They use ACL, for 1) sampling, and 2) identify reactivation of dormant accounts;
- Banks often have in-house customized banking systems whose capabilities are similar to those of GAS. GAS, with more advance analytical capabilities, are
used primarily for special investigations rather than a foundation for their regular annual work;

External auditors:
- as external auditors are more concerned with testing internal controls, they generally do not use GAS, except when there are there are significant changes (e.g.
rollout of a new system by the bank, or an accrual or interest rate computation error is detected);
- GAS is mostly used for ad hoc testing and fraud detection, rather than substantive testing.
- Creating GAS queries require auditors to select correct samples and create their own queries, which are time-consuming. It is easier for the IT department to
extract the data into Excel for auditors.

The study also highlights suggested improvements of GAS. Lastly, examples of GAS in the study include ACL, IDEA, and Panaudit Plus.

19
Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Lungu, Ion and Computer Assisted Annals of the Vol. 7 2007 Pg. 217 – 224 May 30, 2009 Google
Teodora Audit Techniques University of
Vătuiu Petroşani,
Economics
Annotation
CAATs can be defined as “tools that have…as a purpose the improvement of the efficiency and efficacy of the audit process.” With the increasing use of ERP
systems and the large volume of transactions processed by them, CAATs are replacing manual, classic audit techniques. The usage of CAATs must be planned
and used only if it adds value to the audit or if manual procedures prove to be useless or less efficient. Five CAAT used in international audit offices include:
1. ACL, which is unanimously accepted as leader due to flexibility, simple usage and trust that it offers. It allows auditors to connect their laptops to the
client’s system and download necessary data.
2. IDEA
3. Pentana is a “management integrated system of risks and audit, which allows the user to develop a variety of activities, assisting him in the important
steps of its mission.” The unique aspect about Pentana is that rather than detailed analysis of data, it emphasizes documentation of every step of the
audit. At the Planning step, Pentana offers a global evaluation of the entity’s risks and the planning of the audit work. At this step, users are allowed to
evaluate specific risks and the corresponding controls. Every risk is associated with a score consisting of a) the probability of risk accomplishment and
b) associated impact. Results from the Execution step will lead to an audit report in which the necessary recommendations are stressed.
4. AutoAudit is similar to Pentana. It documents the entire audit process as well as facilitates an analysis of the client’s data.
5. ProAudit Advisor is another similar software to Pentana. It facilitates the determination of the audit approach and risk and control evaluation.
Therefore, there are two types of CAATs: one type that focuses on data analysis (i.e. ACL and IDEA), and another type that maintains a historic for each audit
stage, and facilitates the identification and evaluation of risks at an organization’s level.

20
Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Pennington, The Effects of Journal of Vol. 20, No. 2 Fall 2006 Pg. 25 – 36 May 30, 2009 ABI Inform
Robin R. et al Qualitative Information
Overload on Systems
Technology
Acceptance
Annotation
Qualitative overload refers to pressure felt by workers when there is a perception that the task at hand is too complex and that adequate training has not been
provided. The study was conducted with graduate accounting students, who were required to complete a class assignment using ACL. The study showed that the
lower the perceived ease of use, the more qualitative overload the students felt. It also found that the more qualitative overload students feel, the lower their
intention to use an information system will be.

Negative effects of qualitative overload range from job dissatisfaction and unwillingness to be innovative with technology to turnover intentions. Qualitative
overload can be reduced with training or changes in assignments or hiring practices.

Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Winters, Bruce Choose the Right Journal of Vol. 199, No. 3 Mar 2005 Pg. 10 May 30, 2009 ABI Inform
I. Tools for Internal Accountancy
Control Reporting
Annotation
One type of tool that can help companies monitor internal control compliance is “data mining, file retrieval, pattern recognition, and business intelligence tools.”
Some of the considerations of CPAs when deciding which software offering to buy include:
- the vendor’s viability as a going concern;
- the vendor’s support plans and their cost;
- the product’s ongoing compatibility with the company’s O/S and its scalability;
- whether customization of the product is available or required;
- the level of training the vendor provides; and
- the extent of integration with other tools;

21
Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Zhao, Ning et Auditing in the e- Information Vol. 12, No. 5 2004 Pg. 389 – 400 May 30, 2009 ABI Inform
al. commerce era Management &
Computer
Security
Annotation
CAATs are required in order to implement continuous auditing. Tools described are:
embedded audit modules – perform audit procedures while an application is running. They are ideal for “high-volume, online, real-time systems where the
timeliness, completeness, accuracy, and validity of transactions are essential.”
exception reporting – extraction of data from the audit file to another file using criteria specified by the auditor;
transaction tagging – allows auditors to follow a transaction through the system step by step until the problem is identified. Certain transactions are tagged
with a special identifier so that they can be recorded as they pass through the information system.
Two popular software provide some of the above CAATs are:
ACL: It offers a tool, namely ACL for MVS, which allows auditors to extract information from mainframe data files. ACL for Windows can then be used for
processing and analyzing the extract.
IDEA: A tool developed by the CICA to help users sample and analyze data. There is no mention of embedded audit modules capability.

22
Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Blakley, Mike SQL as an Audit The EDP Audit, Vol. XXXVII, June 2008 1-16 May 30, 2009 ABI Inform
Tool Controls, and No. 6
Security
Newsletter
Annotation:
Knowledge of SQL will allow auditors to obtain data directly from the client system and perform their audit tests independently. The cost and time required to
teach auditors SQL is reduced by the fact that “20% of the SQL statements and syntax can provide 80% of all commonly needed audit functionality.” There are
at least four major advantages of SQL:
1. The auditor specifies what info is needed, rather than how the info is to be obtained.
2. Many of the audit needs for info such as subtotals and use of selection criteria are already built into SQL.
3. Since SQL is a universal language, SQL commands can be used across different audits.
4. Auditor can interrogate the system directly, crafting simple queries to suit a number of audit tests.

Auditors need to assess whether risks outweigh the potential benefit.

There are four major audit areas where SQL can provide significant support:
1. Data classification: population statistics, frequency distributions, outliers, trend identification
2. Data extraction: based on selection criteria, “drill-down” capabilities
3. Sampling: random sampling, interval sampling, stratified sampling
4. Audit tests: fuzzy matching, recalculations, Benford’s Law, Day of week testing, Top/bottom 10, Round number testing

23
Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Chennai IT edge to auditing Businessline N/A 4 Sep. 2006 Pg. 1 May 30, 2009 ABI Inform
Annotation:
The article describes a CAAT developed by Astral Consulting to aid in performing Internal Audit services to clients. The CAAT allows the auditors to access
client’s data independent of the system, tests the reliability of the software and perform audit checks more efficiently. It also helps the auditors analyze and
interpret the data.

More specifically, CAAT is used in tests of details of transactions and balances, “for identifying inconsistencies or significant fluctuation tests of general
controls,” and recalculation.

Auditors should set the objective of CAAT procedures, determine the integrity and accessibility of the entity’s files, identify specific files or databases to be
examined, define output requirements, ensure that the use of the tool is properly controlled and refine estimates of costs and benefits.

The article also describes the software. It uses VC++ with Microsoft SQL Desktop Engine as the backend database. Data to be analyzed is imported into this
database. Source data is accessed in read-only mode to preserve its integrity. The firm also implements hardware lock to keep away unauthorized persons from
using this tool.

Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Stimpson, Jeff Audit Tools Adapt The Practical Vol. 40, No. 8 Aug. 2007 40 – 42 May 30, 2009 ABI Inform
to Changes Accountant
Annotation
Accounting firms are implementing CAATs to increase efficiency and extent of coverage in data analysis. Roger Hodskins, VP of alliances and marketing at
Lumigent (a software vendor), expects the following changes with audit tools in general:
- Instead of focusing on only one component of the audit process (e.g. data analysis), new service offerings will take care of multiple components.
- With internal controls testing being more important post-SOX, more time will be spent on verifying the controls rather than on solving technical issues related
to data gathering.

The article also talks about different audit tools and how they have tried to address new needs. However, IDEA is the only CAAT software discussed:
- Smart Analyzer: a collection of data analysis tests on major financial statement items, providing firms with a standardized approach to all audits;
- 3 tests to help auditors in their compliance with SAS 99 – Consideration of Fraud in a Financial Statement Audit. The 3 methods are:
- Correlation: measure the degree of association between revenue and related accounts such as raw materials usage, sales commissions, and other.
- Trend Analysis: create forecasts based on past data, for comparison with current period actual.
- Time Series: also designed for preparing forecasts, taking into account trends and seasonal fluctuations in past data.

24
Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Qiu, Robin et Study on database Application Vol. 25, No. 6 June 2008 Not provided May 30, 2009 Google
al. technologies used Research of
in computer-aided Computers
audit
Annotation (Note that the article is in Simplified Chinese. I found the article to be interesting, but had to guess a large number of words.)
3 ways that practitioners extract data are:
1) Some database has native exporting capabilities.
2) MS Access and MS SQL Server have more advance exporting capabilities.
3) Through ODBC connection

Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Bulter, Ray Introducing www.isaca.ee N/A N/A http://www.isaca.ee/706 May 30, 2009 Google
Computer-
Assisted Audit
Techniques
Annotation
Generalized Audit Software (GAS) mostly works on copy data and is used for data analysis as well as testing. With GAS, auditors can test completeness,
accuracy, authorization, and can perform compliance as well as substantive tests. GAS also allows auditors to sample transaction data for testing or analysis.
Latest developments that have an impact on GAS are:
- Continuous audit tools can help log unusual activities or exceptions. Examples are ACL, Ernst & Young CARS, and Audicon Tool.
- XML / XBRL can be a data source.
- Web logs can be a data source.
Auditors can consider using CAATs to test controls, or analyze a possible weakness. To be successful with CAATs, questions auditors should ask are:
- What are you trying to achieve?
- What tool is best?
- Regarding the data:
- Do you understand the data? Have you got everything? What’s between you and the real data? Reconcile. Summarize on important fields. Do you need
supporting tables?

Examples of GAS include ACL, IDEA, Filetab, and Panaudit. Other CAAT tools include ODBC links & MS Query and report files (Monarh / DataImport).

25
Author Title of Periodical / Vol. / Year Pages Date Location,
Article Website No. / published accessed database,
Edition website,
link
Head, Adapting tampabayiia.org N/A 2002 http://tampabayiia.org/Worddocs/COSO_and_ACL_302.doc May 30, Google
Kate your audit 2009
philosophy
to COSO
utilizing
CAATS
Annotation
CAATs help facilitate a shift to COSO. Using CAATs has forced auditors to spend more time understanding the information system to be reviewed. CAATs can
also help in the following ways:
- Monitoring reports generated by monitoring systems can be analyzed in more detail using CAATs.
- Data mining activities used in CAATS allow for a more comprehensive assessment of risk.

Tools like ACL are powerful because they can test 100% of transactions in high risk areas. In an example provided, the auditors used ACL to extract unusual
activity as well as calls made by terminated employees, and in turn were able to recalculate the phone bills and ensure management that the system was rating
and billing calls properly.

Author Title of Periodical / Website Vol. / No. Year Pages Date Location,
Article / Edition published accessed database,
website,
link
KPMG KPMG’s http://www.kpmg.eu/SucceedingInTurbulentTimes/6915.htm N/A 2009 N/A May 30, ABI Inform
Advisory 2009 IT 2009
Internal
Audit
Survey –
The status
of IT Audit
in Europe,
the Middle
East and
Africa
Annotation
Tools used for audit tests include data analysis and sampling, information security, dashboard monitoring, and specific tools for ERPs. While data analysis tools
are the most commonly used tool, 33% of the organizations surveyed do not actually use data analysis or sampling tools. Data analysis tools used, from most
commonly used to least, are: 1) Excel, 2) ACL, 3) Access, 4) SQL, 5) Other, 6) IDEA, 7) SAS, and 8) Easytrieve.

26
Author Title of Article Periodical / Vol. / No. / Year published Pages Date accessed Location,
Website Edition database,
website, link
Mayberry, CAATTS Ideal for infotech.aicpa.org N/A 2008 N/A May 30, 2009 Google
Mark D. Efficient Audits
Annotation
CAAT can help with the Planning and Execution phase of audits:
Planning:
- Auditors can consider using CAATs for procedures that include certain terms, such as analyze, re-compute, calculate, sample, age, scan and compare. Then
auditors can determine which of these procedures are time-consuming and focus on those they can perform in a different way.
- After auditors identify which procedures you can use CAATs for, auditors must identify which data files they need and how to obtain them from the accounting
or IT group. Common export file types are comma or tab delimited ASCII, dBase, Excel, Access, PDF and XML.
Execution:
- Auditors can perform generic CAAT procedures such as scanning for duplicate entries, extracting entries posted on unusual dates, etc.
- Two common usage of CAAT routines are journal entries review and accounts receivable.

27
Author Title of Periodical / Website Vol. / Year Page Date Locatio
Article No. / publishe s accesse n,
Editio d d databas
n e,
website,
link
Mayberr Computer http://infotech.aicpa.org/Events/February+2008+Top+Technology+Initiatives+Info N/A 2008 N/A May Google
y, Mark Assisted cast.htm 30,
D. Auditing 2009
Tools and
Techniqu
es
Annotation
According to Mark Mayberry, National Director of Assurance Automation for BDO, internal and external audit teams can leverage CAATTs to:
- increase audit coverage;
- enhance management and planning of the audit function;
- focus on risk areas;
- increase cost-effectiveness;
- improve audit credibility;
- improve integration of IT and Financial audit skills;
- encourage auditor independence from IT & Finance

28
Author Title of Periodical / Website Vol. / No. / Year Pages Date Location,
Article Edition published accessed database,
website, link
Texas ACL ACL vs. http://texasacl.financial.officelive.com/IDEA.aspx N/A N/A N/A May 30, Google
User Group IDEA 2009
Annotation
Advantages of ACL over IDEA:
- If auditors want to copy the scripts of a test for reuse on a different audit, ACL’s code would be easier to read, as IDEA is based off Visual Basic.
- ACL “allows the user to SET LOG or SET SESSION to create specific working papers that capture only specific periods of execution.” This leads to more
concise work papers.
- IDEA creates a new file with every command while ACL create virtual tables. The negative part of creating a new file is storage space and processing speed.
- ACL has a bigger online support community.
- ACL is used by more companies.
- ACL has numerous user groups meeting on a monthly basis while IDEA is working on establishing user groups that meet yearly.
Advantages of IDEA over ACL:
- When loading a file, IDEA automatically performs a statistics command on key fields.
- IDEA’s Import to Print functionality has some key advantages. IDEA allows you to save how you interpret files so that you can reuse it in reading another file.
IDEA also imports PDF files better.
- IDEA’s ability to APPEND databases is better.
- IDEA’s navigator display parent-child relationship of databases better.
- IDEA's JOIN function has a visual representation explaining what the results are when dealing with PRIMARY/SECONDARY tables matching or not
matching.
- IDEA's GUI also allows for multiple data extracts at one time.
- It is easier to do testing directly in IDEA, as users can create editable fields to add comments to the IDEA file directly. IDEA also has a "tickmark" editable
field.

29