There are different choices available to an
internal audit function when developing
CAATs. Working within a production system
environment is often one that most audit
functions either ignore or do not even consider.
The production system environment provides another option and is another effective way to get both filtered data and quick information to provide intelligence and support audit conclusions.
Regardless of where the CAATs reside, the auditor will need to continue to design the audit procedures and tests. These will require a very detailed understanding of the environment being audited (e.g. businesses, process life cycles, design
of internal controls), as well as the application systems in place to support the operations. There are many challenges associated with developing CAATs, whether or not they are developed externally or reside within the structure of the
production system. These include: