Others are described in previous ITAudit Forum articles and many are identified in the Reference Library. Selecting the right one for your organization is the most important thing. If there are some data analysis tools in your organization already, then they should be used. Remember, the package you buy, if used widely in audits, will end up being a substantial investment in programming time. If the correct package is not chosen, then substantial rewriting or modification may be needed at a later date.
Training is another important aspect.
If your intent is to build expertise with existing staff, you must give them the training they need. The generalized audit software packages detailed at the end of this article all provide training. But most importantly, you must ensure that staff uses the training when they get back from the class. Getting started in writing CAATs can be quite difficult. Sending individuals to training and then not trying to immediately tap into what they've learned will only produce more frustration and make the learning curve steeper.