1.6,1.6.3,1.6.4,1.7,1.7.1,1.7.2
1.6 audit project management
The process of auditing includes defining the audit scope, formulating audit objectives,
identifying audit criteria, performing audit procedures, reviewing and evaluating evidence,
forming audit conclusions and opinions, and reporting to management after discussion with key
process owners.
Project management techniques for managing and administering audit projects include the
following basic steps:
•Plan the audit engagement—Plan the audit, considering project-specific risk.
•Build the audit plan—Chart out the necessary audit tasks across a timeline, optimizing
resource use. Make realistic estimates of the time requirements for each task with proper
consideration given to the availability of the auditee.
•Execute the plan—Execute audit tasks against the plan.
•Monitor project activity—Report actual progress against planned audit steps to ensure
challenges are managed proactively and the scope is completed within time and budget.
1.6.3 audit programs
An audit program is a step-by-step set of audit procedures and instructions that should be
performed to complete an audit. It is based on the scope and objective of the particular
assignment.
The main purposes of developing an audit program are to accomplish the following:
•Formal documentation of audit procedures and sequential steps
•Creation of procedures that are repeatable and easy to use by internal or external audit and
assurance professionals who need to perform similar audits
•Documentation of the type of testing that will be used (compliance and/or substantive)
•Meeting generally accepted audit standards that relate to the planning phase in the audit process
IS auditor often evaluates IT functions and systems from different perspectives, such as:
security (confidentiality, integrity and availability),
quality (effectiveness, efficiency),
fiduciary (compliance, reliability),
service and capacity.
General audit procedures are the basic steps in the performance of an audit and usually include:
•Obtaining and recording an understanding of the audit area/subject
•Creating a risk assessment and general audit plan and schedule
•Performing detailed audit planning that includes the necessary audit steps and a breakdown of
the work planned across an anticipated time line
•Doing a preliminary review of the audit area/subject
•Evaluating the audit area/subject
•Verifying and evaluating the appropriateness of controls designed to meet control objectives
•Conducting compliance testing (tests of the implementation of controls and their consistent
application)
•Conducting substantive testing (confirming the accuracy of information)
•Reporting (communicating results)
•Following up in cases where there is an internal audit function
Minimum Skills to develop an audit program
The following skills can assist an IS auditor in creating an audit program:
•Good understanding of the nature of the enterprise and its industry to identify and categorize the
types of risk and threat
•Good understanding of the IT space and its components and sufficient knowledge of the
technologies that affect them
•Understanding of the relationship between business risk and IT risk
•A basic knowledge of risk assessment practices
•Understanding of the different testing procedures for evaluating IS controls and identifying the
best method of evaluation, for example:
–The use of generalized audit software to survey the contents of data files (e.g., system logs, user
access list)
–The use of specialized software to assess the contents of operating systems, databases and
application parameter files
–Flowcharting techniques for documenting business processes and automated controls
–The use of audit logs and reports to evaluate parameters
–Review of documentation
–Inquiry and observations
–Walk-throughs
–Reperformance of controls
1.6.4 audit work papers
All audit plans, programs, activities, tests, findings and incidents should be properly documented
in work papers. The format and media of work papers can vary, depending on specific needs of
the department. IS auditors should particularly consider how to maintain the integrity and
protection of audit test evidence in order to preserve its value as substantiation in support of audit
results.
Work papers can be considered the bridge or interface between the audit objectives and the final
report. Work papers should provide a seamless transition—with traceability and support for the
work performed—from objectives to report and from report to objectives. In this context, the
audit report can be viewed as a particular work paper.
1.7 sampling methodology
statistical or nonstatistical methods
IS auditors should design and select an audit sample, perform audit procedures and evaluate
sample results to obtain sufficient and appropriate evidence to form a conclusion.
When using sampling methods to draw a conclusion on the entire population, professionals
should use statistical sampling.
the purpose of sample
•Compliance testing/test of controls—An audit procedure designed to evaluate the operating
effectiveness of controls in preventing, or detecting and correcting, material weaknesses
•Substantive testing/test of details—An audit procedure designed to detect material weaknesses
at the assertion level
1.7.1 compliance vs substantive testing
Compliance testing is evidence gathering for the purpose of testing an organization’s compliance
with control procedures.
A compliance test determines whether controls are being applied in a manner that complies with
management policies and procedures.
The broad objective of any compliance test is to provide reasonable assurance that the particular
control as perceived in the preliminary evaluation.
Compliance tests can be used to test the existence and effectiveness of a defined process, which
may include a trail of documentary and/or automated evidence—for example, to provide
assurance that only authorized modifications are made to production programs.
A substantive test substantiates the integrity of actual processing. It provides evidence of the
validity and integrity of the balances in the financial statements and the transactions that support
these balances.
An IS auditor could use substantive tests to test for monetary errors directly affecting financial
statement balances or other relevant data of the organization.
an IS auditor might develop a substantive test to test the completeness and accuracy of report
data. To perform this test, the IS auditor might use a statistical sample, which will allow the IS
auditor to develop a conclusion regarding the accuracy of all of the data.
Examples of compliance testing of controls where sampling could be considered
user access rights, program change control procedures, documentation procedures, program
documentation, follow-up of exceptions, review of logs and software license audits.
Examples of substantive tests where sampling could be considered
performance of a complex calculation (e.g., interest) on a sample of accounts or a sample of
transactions to vouch for supporting documentation.
Relationship Between Compliance and Substantive tests
1.7.2 sampling
•Statistical sampling—An objective method of determining the sample size and selection
criteria
–Statistical sampling uses the mathematical laws of probability to: (1) calculate the sampling
size, (2) select the sample items, and (3) evaluate the sample results and make the inference.
–With statistical sampling, an IS auditor quantitatively decides how closely the sample should
represent the population (assessing sample precision) and the number of times in 100 that the
sample should represent the population (the reliability or confidence level). This assessment is
represented as a percentage. The results of a valid statistical sample are mathematically
quantifiable.
•Nonstatistical sampling (often referred to as judgmental sampling)—Uses audit judgment to
determine the method of sampling, the number of items that will be examined from a population
(sample size) and which items to select (sample selection)
–These decisions are based on subjective judgment as to which items/transactions are the most
material and most risky.
Attribute sampling, generally applied in compliance testing, deals with the presence or absence
of the attribute and provides conclusions that are expressed in rates of incidence.
Attribute sampling refers to three different, but related, types of proportional sampling:
•Attribute sampling (also referred to as fixed sample-size attribute sampling or frequencyestimating sampling)—A sampling model that is used to estimate the rate (percent) of
occurrence of a specific quality (attribute) in a population. Attribute sampling answers the
question of “how many?” An example of an attribute that might be tested is approval signatures
on computer access request forms.
•Stop-or-go sampling—A sampling model that helps prevent excessive sampling of an attribute
by allowing an audit test to be stopped at the earliest possible moment. Stop-or-go sampling is
used when an IS auditor believes that relatively few errors will be found in a population.
•Discovery sampling—A sampling model most often used when the objective of the audit is to
seek out (discover) fraud, circumvention of regulations or other irregularities. For example, if the
sample is found to be error free, it is assumed that no fraud/irregularity exists; however, if a
single error is found, the entire sample is believed to be fraudulent/irregular.
Variable sampling, generally applied in substantive testing, deals with population characteristics
that vary, such as monetary values and weights (or any other measurement), and provides
conclusions related to deviations from the norm.
Variable sampling—also known as dollar estimation or mean estimation sampling—is a
technique used to estimate the monetary value or some other unit of measure (such as weight) of
a population from a sample portion. An example of variable sampling is a review of an
organization’s balance sheet for material transactions and an application review of the program
that produced the balance sheet.
Variable sampling refers to three types of quantitative sampling models:
•Stratified mean per unit—A statistical model in which the population is divided into groups
and samples are drawn from the various groups; used to produce a smaller overall sample size
relative to unstratified mean per unit
•Unstratified mean per unit—A statistical model in which a sample mean is calculated and
projected as an estimated total
•Difference estimation—A statistical model used to estimate the total difference between
audited values and book (unaudited) values based on differences obtained from sample
observations
There are two types of sampling risk:
•The risk of incorrect acceptance—A material weakness is assessed as unlikely when, in fact,
the population is materially misstated.
•The risk of incorrect rejection—A material weakness is assessed as likely when, in fact, the
population is not materially misstated.
Key steps in the construction and selection of a sample for an audit test
Statistical Sampling Terms
Confidence coefficient
Level of risk
Precision
Expected error rate
Sample mean
Sample standard deviation
Tolerable error rate
Population standard deviation