Auditing of information systems & computerassisted audit techniques
Learning Objectives:
Audit process
Audit approaches
Computer-assisted audit techniques (CAAT)
Applications
Audit process
•
•
•
•
Audit objectives
Audit planning
Test of controls (SOX Section 404)
Substantive tests
Nature of audits
•
•
•
•
Labor-intensive
Highly repetitive
Time-pressure
Process (not result) oriented
Audit Approaches
• Audit around the computer
• Audit through the computer
• Audit with the computer
Audit around the computer
• Computer is a “black-box.”
• Suitable only under the following conditions:
– The audit trail is complete and visible
– The processing operations are relatively
straightforward and low volume
– Complete documentation are available
Audit through the computer
• Should be applied to all complex systems
– Test Data
– Integrated Test Facility
– Embedded Audit Module Techniques
– Program Code Checking
– Parallel Simulation
– Controlled Processing
Audit with the computer
• Generalized Audit Software (GAS)
– Prepare trial balances
– Statistical Sampling
– Data analysis
– Evaluate sample results
– Histogram (chart) Generation
– Record Aging (AR and AP)
– File Comparison
– Sequence verification
Myth of Using GAS
• GAS is difficult to use
– Nonprocedural languages
• GAS is expensive
• GAS cannot handle various systems
– ASCII code
– EBCDIC code
Advantages of Using GAS
• Module design
– Reusability
– Expertise
•
•
•
•
Efficiency
Self-documentation—user manuals, WP
Statistical sampling—quantify audit risk
Analytical review procedures
GAS in the Market
• ACL by ACL Services
• Applaud by Premier International
• IDEA
Criteria of Selecting GAS
•
•
•
•
•
•
•
•
•
•
Process various file structures—wk1, xls, rpt, dbf
Review file contents on the screen
Create a data dictionary for all data
Use the modularity approach
Provide audit working papers automatically
Provide the user manual for all modules
Provide data validation feature
Perform statistical sampling
Export files
Provide the on-screen help facilities, tutorial & tollfree technical assistance
Application in Accounting Industry
• Ernst & Young: Sweden
• Application: Improving Audit Efficiency
• Benefits
– A standard application make it easier to perform data analysis
– Efficiency, audit Sales Process takes only 2-3 hours instead of
12-16
– ACL automatically generate audit reports based on most
common factors
Application in Banking Industry
• Investors Group Inc.: HQ in Winnipeg, Manitoba,
Canada’s largest mutual fund company
• Application: ensuring regulatory compliance &
improving operations
• Benefits
– Review client records for cash deposits over CDN$10,000 to
comply with reporting mandated by the Canadian Proceeds of
Crime (Money Laundering) and Terrorist Financing Act
– Monitor mutual fund trading activity continuously to ensure
ongoing compliance with a wide variety of industry regulations
– Developed a preferred list of suppliers, resulting in overall
savings of CDN$600,000
– Develop and implement effective fraud detection controls
Application in Communications Industry
• Ameritech: 73,000 employees & $30 billion in assets
• Application: business process improvements
• Benefits
– realized approximately $15 million in value-added
recommendations in 9 months
– 100% data analysis (no samples)
Application in Government Accounting
• Louisiana Legislative Auditor: Baton Rouge, LA
• Application: Improving Audit Quality and Efficiency
• Benefits
– Recover public funds lost due to errors and mismanagement,
including an erroneous $173,000 payment uncovered in a fiveminute data stratification analysis
– Help auditors pull information from a multitude of agency
databases faster, analyze audit risks and conduct data testing
with higher accuracy and efficiency
– Obtain a more detailed understanding of agency data during
audits, and create standardized reports to analyze monthly
agency transactions
Application in Healthcare Industry
• HCA: Nashville, TN
• Application: internal audits
• Benefits
– Identify vendor billing errors on 16,000 units of medical
equipment
– Locate $17 million in duplicate payments over the course of
one year
– Test human resources and payroll data for costly reporting and
coding inconsistencies
– Monitor balance sheets and income statements for unusual
activity and abnormal account balances
– Prepare continuous monitoring systems to ensure compliance
with Section 404 Sarbanes-Oxley legislative requirements
Application in Insurance Industry
• Washington National Insurance Company: Phoenix, AZ
• Application: internal audits
• Benefits
– Claim checks reconciliation
– Significantly reduced the amount of time the Fraud
Unit needed to accomplish their task
– Improve policy data analysis
– Audit Department is now seen not only as a
watchdog but also as a value-added unit/partner that
can increase the productivity and efficiency in all
other departments
Application in Manufacturing Industry
• Lockheed Martin Corporation is a large aerospace and
defense electronics manufacturing company
• Application: internal audits
• Benefits
– perform trend analyses on the labor data (180,000
employees) to determine if people are charging time
inappropriately,
– review vendors performance effectively
– perform a test in half an hour with ACL; it took 40
hours before
– allow them to conduct a much more thorough
analysis
Application in Retail Industry
• Office Depot: the world's largest seller of office products
• Application: how to improve services with meaningful
customer data analysis
• Benefits
– reduce business risk in A/R
– serve customers better
– establish clear guidelines service coding & redesign
the customer service coding systems
– computer-based training (CBT) program for ACL
solutions
Application in Utility Industry
• Dominion, a major U.S. energy provider; HQ at
Richmond, Virginia; annual revenues of more than $10
billion and assets of US $35 billion
• Application: access and analyze huge volumes of
business transactions efficiently within the company’s
SAP systems
• Benefits
– find duplicate payments in four years (over a million individual
transactions)
– independently extract and cleanse sensitive company data
– create continuous monitoring reports
– improve audit controls over accounts payable and vendor
master files