Computer-Assisted Audit Techniques (CAATs)

Statistical sampling works well in a compliance audit because errors are assumed to occur randomly. Fraud is not random. A dishonest employee who understands how invoices are checked will route their scheme through the categories and value bands that audit sampling rarely touches. Purchase orders just below the approval threshold. Vendor payments to addresses that look legitimate. Payroll entries in the same range as legitimate wages.

Full-population testing removes that refuge. When every disbursement, every journal entry, and every payroll record is tested, there is no safe harbour. The examiner does not need to know in advance which transactions are suspicious. The test finds the pattern and surfaces the outliers. Human review then concentrates on the flagged subset, which is often a small fraction of the total, instead of a random sample that may miss the fraud entirely.

The following procedures are the workhorses of the data-analytics layer of a forensic accounting engagement. They are run on the same dataset in sequence, and their outputs are combined before the examiner moves to substantive document testing.

1. Stratification
   Group all amounts into bands (0-$500, $500-$1,000, $1,000-$5,000, and so on). A legitimate expense population should follow a roughly predictable shape. A heavy concentration just below the approval threshold is an immediate red flag for threshold-avoidance, as is a spike in an unusual value band that does not reflect the company's normal operations.
2. Duplicate detection
   Compare every record against every other using combinations of fields. Exact duplicates (same invoice number, vendor, and amount on the same date) flag payment errors. Near-duplicates (same vendor and amount on dates that differ by a day or two) flag recycled or slightly altered invoices. The test should be run on multiple key-field combinations to catch different duplication strategies.
3. Gap testing
   For any numbered series that should be consecutive, identify every missing number. In a check register or purchase-order log, gaps indicate either that the document was voided (which should be on record) or destroyed. In expense report systems with auto-generated reference numbers, gaps can indicate that records were deleted after the fact.
4. Sequence analysis
   Verify that numbers in a series run in ascending order and without unexpected reversals or repetitions. In accounts payable, invoices from a given vendor should generally increase in number over time. A vendor whose invoice numbers decrease or repeat may be fabricating invoices using templates.
5. Join-and-match (cross-file matching)
   Link data across tables using common keys. Matching vendor bank account numbers against employee bank account records detects ghost-vendor or self-dealing schemes. Matching approved supplier addresses against employee home addresses detects conflict-of-interest procurement. Matching payroll records against HR termination dates detects ghost employees still receiving wages.
6. Ratio analysis
   Compute ratios across periods or business units and flag deviations beyond a defined threshold. A subsidiary whose cost-of-goods-sold ratio jumped 8 percentage points when the rest of the group held steady warrants scrutiny. The baseline should be built from several years of data and from comparable units, so that genuine business changes can be distinguished from manipulation.

Getting the right data is often the hardest part of a CAAT engagement. ERP systems such as SAP, Oracle, and Microsoft Dynamics store transactions in complex relational schemas, and an extract that looks complete may be missing tables, have been filtered by the system administrator, or contain data that was archived or deleted before the export. Every export should be accompanied by record counts and hash totals so the examiner can verify completeness.

• Request data in flat file format (CSV or delimited text) with full field headers, or as a direct database extract with a data dictionary.
• Hash the source file immediately upon receipt and document the hash value. Any subsequent copy must be hashed again and the values compared. This is the chain-of-custody for digital data.
• Reconcile the extract to known totals: the total accounts payable disbursements in the extract should match the general ledger control account for the period. Discrepancies indicate an incomplete or filtered extract.
• Profile the data before running tests: count null values, check date ranges, verify that code values are within expected categories. Anomalies in the data structure sometimes are themselves evidence of manipulation.

Reproducibility is the standard that separates a CAAT result that can withstand cross-examination from one that cannot. Every step in the analytical workflow must be scripted or recorded in sufficient detail that an independent examiner, starting from the same data, arrives at the same output. In ACL and IDEA, commands are logged automatically. In Python or SQL, the script itself is the record. In Excel, a formula audit trail and worksheet notes are the minimum acceptable documentation.

CAATs sit at the beginning of the investigative funnel. A well-designed CAAT run on accounts payable might flag 300 transactions out of 50,000. Those 300 go to document review: the examiner pulls the underlying invoices, goods-received notes, and approval records. Of the 300, perhaps 40 have documentation problems. Of those 40, perhaps 12 involve the same vendor. The vendor is then subjected to beneficial-ownership analysis and, if warranted, subpoena.

The point is that CAAT output does not end the inquiry. It focuses it. A ghost-vendor scheme uncovered through join-and-match still requires document and interview evidence to prove that the vendor was fictitious, that the approver was complicit, and that the payments served no legitimate purpose. CAATs are the filter that makes the rest of the work feasible.