Auditing 81.3550
Auditing & Automated Systems
Chapter 22
Highlights
Auditing and Computer Systems
• As client computing facilities become more
sophisticated, “paperless” accounting
systems evolve wherein little “hard copy”
documentation is produced
• Evidence forms may differ slightly but the
basic procedures and objects are often
similar.
Challenges of Sophisticated
Computer Systems
- audit trails, documentation may only
exist on disk (no printed copies)
- program errors may exist that cause
uniform transaction errors
- in some circumstances, controls may
have to make up for a lack of adequate
segregation of duties
- detecting unauthorized access may be
difficult
Challenges of Sophisticated
Computer Systems
• electronic method of sending
documents between companies
• no “paper trail” for the auditor to
follow
• increased emphasis on front-end
controls
• security becomes key element in
controlling system
Electronic Fund Transfers (EFT)
• also referred to as electronic
commerce, or e-commerce
• greatly increased through
“internet shopping”
• direct payment systems, e.g.
payroll, remove the paper trail
once relied upon by auditors
Data Communications Risks
and Control Procedures
• As part of the audit
equation need to assess
computer control
systems in place
• Starting point obtaining
clients computer system
documentation,
diagrams, policies and
procedures
Data Communications Risks
and Control Procedures
• loss of confidential information,
through corporate espionage or
“hackers”
- create multiple levels of
passwords; change regularly
• data intercepted during data
communication
- encrypt (scramble) information
during transmission
Data Communications Risks
and Control Procedures
• inappropriate access to information
via the Internet
- use of firewalls
- physically separate homepage
equipment and software from
other systems
• viruses invading systems
- same as above
- use current anti-virus
software
Data Communications Risks
and Control Procedures
• Organization should have
a well planned disaster
recovery plan
• Should include regular
offsite storage of prior
data
Disaster Recovery Process
Basics
1. Management commitment to
disaster recovery planning.
2. Ranking of business processes:
What will happen if process x
fails?
3. Identifying minimum resources
required to restore vital
operations.
Disaster Recovery Process
Basics
4. Prepare a data centre plan and
a user plan.
5. Test the plan, to discover any
shortcomings in the plan
before disaster strikes.
Categories of Controls in an
EDP Environment
GENERAL CONTROLS
relate to all parts of
the EDP system.
APPLICATION CONTROLS
relate to one specific
use of the system
revenue
system
expenditure
system
payroll
system
revenue
system
Categories of General Controls
1. plan of organization
Separate duties in
EDP systems as discussed
in chapter 9.
Categories of General Controls
2. systems development and
documentation controls
• each system should have documented,
authorized specifications
• any system changes should be authorized and documented
Categories of General Controls
• 3. hardware controls
-diagnostic routines - hardware or software
that checks the system’s internal operations
and devices
-boundary protection - ensures that
simultaneous jobs do not interfere with one
another
-periodic maintenance - hardware should be
examined periodically by qualified technicians
Categories of General Controls
ACCESS TO:
program
documentation
data files &
programs
computer
hardware
4. controls over
access to
equipment,
programs, and
data files –
limited on need
basis
Objectives of General Controls
1. Responsibility for control
2. Information system meets needs of entity
3. Efficient implementation of information
systems
4. Efficient and effective maintenance of
information systems
5. Effective and efficient development and
acquisition of information systems
6. Present and future requirements of users
can be met
7. Efficient and effective use of resources
within information systems processing
Objectives of General Controls
8. Complete, accurate and timely processing
of authorized information systems
9. Appropriate segregation of incompatible
functions
10.All access to information and information
systems is authorized
11.Hardware facilities are physically
protected from unauthorized access, loss
or damage
12. Recovery and resumption of information
systems processing
13.Maintenance and recovery of critical user
activities
Physical Access Controls
•Visitor identification
•Security guards
•Security systems
•Locked areas
Application Controls
• 3 Basic categories:
input
processing
output
Input Controls
• input data should be authorized &
approved
• the system should edit the input
data & prevent errors
• Examples include: validity checks,
field checks, reasonableness check,
record counts etc.
Processing Controls
assure that
data entered into
the system are
processed, processed
only once, and
processed accurately
Processing Controls
Examples
control, batch, or proof total - a total of a
numerical field for all the records of a
batch that normally would be added
(example: wages expense)
logic test - ensures against illogical combina
tions of information (example: a salaried employee does not report hours worked)
Output Controls
assure that
data generated by
the system are valid,
accurate, complete,
and distributed to
authorized persons in
appropriate quantities
Objectives of Application Controls
1. Design application controls with regard
to:
- segregation of incompatible functions
- security
- development
- processing of information systems
2. Information provided by the systems is:
- complete
- accurate
- authorized
3. Existence of adequate management trails
There are two general approaches
to auditing EDP systems:
1. Auditing “around” the computer
involves extensive testing of the
inputs and outputs of the EDP
system and little or no testing of
processing or computer
hardware.
This approach involves no tests of the
computer programs and no auditor use
of the computer.
There are two general approaches
to auditing EDP systems:
1. Auditing “around” the computer
depends on a visible, traceable,
hard copy audit trail made of
manually prepared and computerprepared documents.
There are two general approaches
to auditing EDP systems:
2. Auditing with use of the
computer involves extensive
testing of computer hardware
and software.
Techniques for auditing
with use of the computer
1. Test data involves auditor
preparation of a series of fictitious
transactions; many of those
transactions will contain intentional
errors. The auditor examines the
results and determines whether the
errors were detected by the client’s
system.
What are the shortcomings of the
use of test data?
- possibility of accidental integration of
fictitious and actual data
- preparation of test data that examines
all aspects of the application is difficult
- the auditor must make sure that the
program being tested is the one
actually used in routine processing
techniques for auditing
with use of the computer
• 2. Parallel simulation
-the auditor writes a computer program that
replicates part of the client’s system
-the auditor’s program is used to process
actual client data
- the results from the auditor’s program and
that of the client’s routine processing are
compared
Auditing Software
Generalized audit software involves
the use of auditor programs, client
data, and auditor hardware. The
primary advantage of GAS is that the
client data can be down-loaded into
the auditor’s system and manipulated
in a variety of ways.
Common Audit Software
Functions
- verifying extensions and footings
- examining records
- comparing data on separate files
- summarizing or re-sequencing data and
performing analyses
- comparing data obtained through other
audit procedures with company records
- selecting audit samples
- printing confirmation requests