--- title: "IS audit and CAATs" subject: "Information System" chapter: 2 key: "semester_8/information_system:is-audit-caatt" source: https://www.bctengineer.com/q/semester_8/information_system/is-audit-caatt site: BCT Engineering --- # IS audit and CAATs Information System · Chapter 2: Control, Audit and Security of Information Systems - Asked in: 2073 Bhadra, 10 marks - Video: [Computer Assisted Audit Techniques CAAT's #ACCA#AA3F8#CAAT](https://www.youtube.com/watch?v=H_NFubC2WwY) — Concept clarity - Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14 - Page: https://www.bctengineer.com/q/semester_8/information_system/is-audit-caatt - Whole chapter: https://www.bctengineer.com/md/semester_8/information_system/chapter-2 ## Question What do you mean by the Information Systems audit? Explain the purpose of various Computer Assisted Auditing Techniques and Tools. ## Short answer An Information Systems audit is an independent review of IS controls to safeguard assets, ensure data integrity, efficiency, and compliance. CAATTs (Computer Assisted Auditing Techniques and Tools) automate analysis of large data volumes. Purposes include using generalized audit software for sampling and anomaly detection, test data and integrated test facilities to verify application logic, and embedded modules for continuous monitoring. ## Answer #### Information Systems audit An **Information Systems (IS) audit** is an independent, systematic examination of an organization's IS infrastructure, applications, data, operations and controls to decide whether they safeguard assets, maintain data integrity, achieve organizational goals efficiently, and comply with laws and policies. Objectives: - Check that assets (hardware, software, data) are protected. - Check data integrity, accuracy and completeness. - Check the system's effectiveness and efficiency. - Verify compliance and the adequacy of internal controls. Types: audit of general controls (access, operations, change management, backup), application controls (input, processing, output), network and security audit, and system development audit. Audit may be *around* the computer (ignoring processing), *through* the computer (testing the logic) or *with* the computer (using tools). #### Computer Assisted Audit Techniques and Tools (CAATTs) CAATTs are software tools and methods that auditors use to examine large volumes of electronic data and test system controls instead of manual sampling. Purposes of the main techniques: 1. **Generalised audit software (GAS)** - e.g. ACL, IDEA. Reads and analyses data files: sampling, totalling, duplicate and gap detection, recalculation, comparison, stratification. 2. **Test data (test deck)** - fictitious valid and invalid transactions are processed to see that the application accepts or rejects them correctly. 3. **Integrated Test Facility (ITF)** - a dummy entity is built into the live system; test transactions are processed with real ones and the results are checked. 4. **Parallel simulation** - the auditor builds a program that imitates the application and compares its results with the real output. 5. **Embedded audit module / SCARF** - audit code inside the application continuously records exceptional or sample transactions. 6. **Snapshot** - captures a transaction's path through the program for review. 7. **Program tracing and mapping** - shows which program instructions are executed or not executed. 8. **Utilities and query tools** - SQL, spreadsheets, data mining and log analysers for data extraction and checking. 9. **Security tools** - vulnerability scanners and network analysers. Advantages: whole population can be tested, higher accuracy and speed, lower audit cost over time, detection of fraud patterns, and repeatable work. The auditor must ensure the tool itself is reliable and data extracted is complete. ## Check yourself The answer's key points as multiple-choice questions, with the correct option and why. 1. What is an Information Systems audit? A. Installing new servers B. A purchase of audit software C. An independent systematic examination of IS infrastructure, data and controls D. A staff recruitment process Answer: C. It decides whether assets are safeguarded and controls adequate. (Key point: IS audit) 2. How does the test data (test deck) technique work? A. Fictitious valid and invalid transactions are processed to see if the application handles them correctly B. Dummy entity is permanently built into live system C. Audit code records transactions continuously D. Auditor reads data files with sampling software Answer: A. Test data checks that the application accepts or rejects transactions correctly. (Key point: Test data) 3. What distinguishes the Integrated Test Facility? A. Auditor writes a program that imitates the application B. A dummy entity in the live system processes test transactions alongside real ones C. Captures a transaction path through the program D. Uses fictitious transactions in a separate test environment Answer: B. ITF tests within the live system without affecting real records. (Key point: ITF) 4. What is parallel simulation? A. Embedded audit code logs exceptional transactions B. A dummy entity is created in the live system C. Auditor builds a program that imitates the application and compares results D. A spreadsheet totals data Answer: C. Outputs of the simulation are compared with the real output. (Key point: Parallel simulation) ## Related in Information System - [Information audit and its benefits](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ainformation-audit-benefits) — Information System, chapter 2 - [Security audit and security protocols](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-audit-role-protocols) — Information System, chapter 2 - [Strategic information system and benefits](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Astrategic-is-benefits) — Information System, chapter 1, asked 2× - [MIS vs DSS information and processing](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Amis-vs-dss-information-processing) — Information System, chapter 4 - [Geographic Information System](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Agis-characteristics-uses) — Information System, chapter 1 - [Enterprise systems architecture](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Aenterprise-systems-architecture-motivation) — Information System, chapter 3, asked 2× ## Related in other subjects - [Tools and techniques for risk identification](https://www.bctengineer.com/question.md?key=semester_7%2Fproject_engineering%3Arisk-identification-tools-techniques) — Project Engineering, chapter 5, asked 2× - [Animation techniques and software tools](https://www.bctengineer.com/question.md?key=semester_8%2Fmultimedia_system%3Aanimation-techniques-tools) — Multimedia System, chapter 4 - [Purpose of PID tuning; computer control benefits](https://www.bctengineer.com/question.md?key=semester_6%2Fembedded_system%3Apid-tuning-purpose-benefits) — Embedded System, chapter 7 - [Types of information systems; decision support](https://www.bctengineer.com/question.md?key=semester_7%2Forganization_and_management%3Amis-types-decision-making) — Organization and Management, chapter 9