THROUGH and WITH +BENFORD-LAW

Auditing Through vs. With the Computer

Auditing in a computerized environment requires shifting from manual, paper-based verification to evaluating the integrity of automated processes.

1. Auditing THROUGH the Computer

This approach focuses on the internal logic and controls of the application software itself. You are testing the "black box" to ensure the programmed rules execute correctly.

• Logic Verification: Reviewing source code and flowcharts to confirm business logic.
• Input/Output Controls: Verifying data validation rules at the point of entry.
• Processing Integrity: Ensuring transactions occur without unauthorized modifications.
• Common Techniques: Test Data Method and Integrated Test Facility (ITF).

2. Auditing WITH the Computer

This approach uses the computer as a tool to perform the audit on data already produced. You are treating the system as a "black box" and focusing on the output.

• Data Analysis: Extracting and cleaning large volumes of data for testing.
• Re-performance: Using scripts or software to recalculate balances and verify accuracy.
• Trend Identification: Scanning for anomalies, outliers, or suspicious patterns.
• Common Techniques: Generalized Audit Software (GAS) and Computer-Assisted Audit Techniques (CAATs).

Comparison Summary

Feature	THROUGH the Computer	WITH the Computer
Focus	Application logic and controls.	Data/Output accuracy.
Goal	Ensure software processes correctly.	Ensure results are valid.
Method	Examine code/processing paths.	Analyze and recalculate data.

---

Practical Examples of CAATs

CAATs allow auditors to move beyond manual sampling to testing entire populations of data. Here are common techniques used in practice:

• Data Stratification: Categorizing data into groups (e.g., sorting invoices by dollar amount) to focus audit efforts on high-risk transactions.
• Gap and Duplicate Detection: Automatically scanning sequential data (like check numbers or invoice IDs) to find missing items or unauthorized duplicate payments.
• Benford’s Law Analysis: Using statistical patterns to detect potential fraud by identifying anomalies in the frequency of leading digits in financial data.
• Data Matching: Comparing two separate datasets (e.g., matching a payroll file against an HR employee list) to identify ghost employees or unauthorized changes.
• Sample Extraction: Using software to generate statistically valid random samples, removing human bias from the selection process.

Common Industry Tools

While basic audits can be performed with Excel or Access, professional auditors often use specialized software:

• ACL (Galvanize): A powerful tool for data analysis and continuous monitoring.
• IDEA (CaseWare): Widely used for data extraction, manipulation, and audit-specific reporting.
• TeamMate Analytics: An Excel-based suite that brings audit-specific functionality directly into the spreadsheet environment.

---

Deep Dive: Benford's Law Analysis

Benford's Law, also known as the "First-Digit Law," is a statistical principle used by auditors to detect potential fraud or errors in financial data.

How it works: In many naturally occurring sets of numerical data (like expenses, sales, or accounts receivable), the leading digit is not distributed evenly. Instead, the digit '1' appears as the first digit about 30% of the time, while the digit '9' appears less than 5% of the time.

Why Auditors Use It:

• Identifying Anomalies: Significant deviations from the expected Benford’s curve serve as a "red flag" that data may have been manipulated.
• Non-Intuitive Fraud Detection: Fraudsters often struggle to manually invent numbers that conform to this specific logarithmic distribution.
• Efficiency: It allows auditors to screen large volumes of transactions quickly to decide where to focus deeper manual investigations.

⚠️ Important Limitations

Benford's Law is a diagnostic tool, not a smoking gun. It should be used with caution because:

• Data Must Be Natural: It does not apply to assigned numbers (like invoice numbers or ID codes).
• False Positives: Deviations can occur due to legitimate business reasons, such as fixed price points or company policies (e.g., a "two-signature required" threshold at $5,000).
• Dataset Size: It requires a sufficiently large, multi-order-of-magnitude dataset to be statistically valid.