Audit in CIS Environment

file:///F|/Courses/2010-11/CGA/AU1 file:///F|/Courses/2010-11/CGA/AU1/06course/m07intro. /06course/m07intro.htm htm

Module 7: Computer auditing Overview In this module, you learn about the effects that computer processing has on both the control environment and the audit of financial systems. You also learn about the approaches to auditing computerized systems and the ways to use computers for an audit. When you have worked through the module, you should have a thorough understanding of the audit implications of a computer-based system for a company s internal controls. Throughout the module, you apply what you have learned to scenarios involving a company planning to computerize its accounting systems. ’

Assignment reminder: Assignment 2 is due this week (see the Course Schedule). Be sure to allocate time to complete and submit the assignment by the deadline.

T e st s t y o u r k n o w l ed ed g e Begin your work on this module with a set of test-your-knowledge of test-your-knowledge questions designed to help you gauge the depth of study required.

L ea ea r n i n g o b j e c t i v e s 7.1 Company operations and computer systems

Explain the major effects of computerization of accounting systems on a company’ s operations and on the audit approach. (Level 1)

7.2 Major elements in today’ s computer environment

Describe the major elements of audit significance in today’ s computer environment. (Level 2)

7.3 Audit implications: Internal control processes

Explain the audit implications of a simple computerbased system for a company’ s internal control as it relates to the organizational structure and the processing of transactions. (Level 1)

7.4 Audit implications: System access and design

Explain the audit implications of a simple computerbased system for a company’ s internal control as it relates to system access, design, backup, and data recovery. (Level 1)

7.5 General controls and application controls

Describe general controls and application controls, and explain how they relate to accounting controls. (Level 2)

7.6 Audit implications of electronic commerce

Summarize the impact of EDI and the Internet on a company’ s operations, including the implications of electronic commerce for the company’ s internal control and for its audit. (Level 2)

7.7 Auditing computerized systems considerations

—

General

7.8 General strategy in auditing computerized systems

Explain how an audit is conducted in a computer environment. environment. (Level 1) Identify the phases of auditing a computerized accounting system. (Level 1)

file:///F|/Courses/2010-11/CGA/AU1 file:///F|/Courses/2010-11/CGA/AU1/06course/m07intro. /06course/m07intro.htm htm (1 of 2) [04/10/2010 3:16:41 PM]


7.9 Internal control considerations in personal computer, online, and database environments

Identify internal control considerations in personal computer, online, and database environments. (Level 1)

7.10 Approaches to auditing computerized systems

Explain the difference between auditing around/ without the computer and auditing through/with the computer to test internal control. (Level 1)

7.11 Approaches to auditing through the computer

Explain how an auditor can use computers in conducting audits by using test data and generalized audit software. (Level 1)

7.12 Computer-aided auditing

Identify ways to use computers in conducting an audit. (Level 1)

Module summary

Print this module



7.9 Internal control considerations in personal computer, online, and database environments

Identify internal control considerations in personal computer, online, and database environments. (Level 1)

7.10 Approaches to auditing computerized systems

Explain the difference between auditing around/ without the computer and auditing through/with the computer to test internal control. (Level 1)

7.11 Approaches to auditing through the computer


7.12 Computer-aided auditing


Module summary

Print this module


file:///F|/Courses/2010-11/CGA/AU1 file:///F|/Courses/2010-11/CGA/AU1/06course/m07t01.ht /06course/m07t01.htm m

7 . 1 Co Co m p a n y o p e r a t i o n s a n d co c o m p u t e r s y st st e m s L ea ea r n i n g o b j e c t i v e ●

Explain the major effects of computerization of accounting systems on a company’ s operations and on the audit approach. (Levels 1)

Required reading ● ● ● ●

●

Chapter 7, pages 231, 234, and 251 –252 Chapter 9, Appendix 9, Appendix 9A , pages 1 –4 (available online) Chapter 9, pages 339-344 CAS 315, Appendix 1 (CICA (CICA Handbook , section 5141, Appendix B), (section titled Information System, Including the Related Business Processes Relevant to Financial Reporting, and Communication), and CAS 315.A53 – A59 Reading 7-1: AuG-6, 7-1: AuG-6, Auditing in an EDP environment environment,, Sections 1 –3

LEVEL 1

Computerization of accounting systems has some major effects on a company’ s operations. Understanding these effects will help you understand the audit implications better. Read CAS 315, Appendix 1 (CICA ( CICA Handbook , section 5141, Appendix B), the section entitled “Information System, Including the Related Business Processes, Relevant to Financial Reporting, and Communication, ” which provides an overview of how the client ’ s information system correlates with the management assertion, audit objectives, and the functions of the information system. S ce ce n a r i o 7 . 1 - 1 : T R P I n c .

Teresa is the Director of Finance for TRP Inc. As part of the business planning for the following year, the Chief Financial Officer (CFO) has tabled a project to computerize TRP’ s accounting systems. Teresa has been assigned the task of identifying and analyzing the major effects of this project on the company ’ s organizational structure and data processing. As TRP Inc.’ s auditor, you must help Teresa gather g ather information for the project. What information will Teresa need to have? Hint: Start by organizing the information into three categories: ● ● ●

Effect (or impact) Risk Management responsibility

Solution

T r a n s a c t i o n p r o c e s se se s Another effect of computerization is dramatic changes in transaction processes. processes. On pages 344 to 345, the text describes the control benefits and control risks of IT systems. Topic 7.3, which covers the control environment in computer-based systems, looks at the implications of these characteristics in more detail.

A u d i t i n g a p p r o a ch ch Computerization also causes changes in the approach to auditing. Read Sections 1 –3 of Reading 7-1 (CGA ( CGA Auditing Guideline No. 6) for an overview of computer environment issues, and, as you read, think about how a computer environment will affect internal controls and the audit. S ce ce n a r i o 7 . 1 - 2 : T R P I n c .

file:///F|/Courses/2010-11/CGA/AU1 file:///F|/Courses/2010-11/CGA/AU1/06course/m07t01.ht /06course/m07t01.htm m (1 of 2) [04/10/2010 3:16:42 PM]

file:///F|/Courses/2010-11/CGA/AU1 file:///F|/Courses/2010-11/CGA/AU1/06course/m07t01.ht /06course/m07t01.htm m

In this topic, you learned about the impact of computerization on a company ’ s operations. If you were the auditor assigned to audit TRP Inc., what changes would you make in your approach to the audit? Solution

file:///F|/Courses/2010-11/CGA/AU1 file:///F|/Courses/2010-11/CGA/AU1/06course/m07t01.ht /06course/m07t01.htm m (2 of 2) [04/10/2010 3:16:42 PM]

file:///F|/Courses/2010-11/CGA/AU1/06course/m07t02.htm

’

7 . 2 M aj o r e le m e n t s i n t o d a y s c om p u t e r e n v i r o n m e n t L ea r n i n g o b j e c t i v e ●

Describe the major elements of audit significance in today’ s computer environment. (Level 2)

Required reading ●

Reading 7-1: AuG-6, Auditing in an EDP Environment, Sections 9 and 10

LEVEL 2

Be aware of major elements in today ’ s computer environment. You have already studied basic elements of computer-based systems in Managing Information Systems [MS1] or its equivalent. The major elements of audit significance include microcomputers, databases, online systems, and electronic commerce, specifically Electronic Data Interchange (EDI), and the Internet. Microcomputers are explained in Section 9 of CGA AuG-6 (Reading 7-1). Internal controls with respect to microcomputers are explained in detail in Topic 7.5. Paragraphs 10.2 to 10.4 of Reading 7-1 describe the features and characteristics of online systems, and paragraphs 10.5 to 10.11 outline the characteristics of database systems. Electronic commerce is transforming the business environment and is likely to give rise to a wide range of assurance engagements for public accountants. You consider some of the audit implications of electronic commerce in Topic 7.6.

Microcomputers Experienced auditors are concerned about their ab ility to keep up with the advances in information technology. Companies used to use mainframe computers and terminals only; now, many companies use computer networks. The auditor used to be concerned about the integrity of computer programs that ran on the mainframe; now, the auditor is concerned about the proliferation of stand-alone computers and software. With this proliferation, there is a tendency to decentralize data processing. This, in turn, increases the amount of work an auditor needs to do to understand and rely on the computer controls. At one time, only programmers could change the programs used to process the company ’ s data. Now, each employee with access to a computer could also have access to the software that runs on that computer, and could alter it unless adequate safeguards are in place.

D a t a b a se s y s t e m s Database systems store data in a central location under the control of the database administrator. The use of centralized database management systems can result in more reliable data because there is no redundant (duplicate) data, thus removing the chance of conflicting information. However, the database administrator typically exercises substantial power over the databases. This concentration of data and lack of segregation of duties create significant risk. In light of this risk, the auditor must carefully review the activities of the database administrator and examine any audit trail provided by the database management system to ensure that there are adequate compensating controls over the activities of the database administrator. The auditor must also review the backup and recovery procedures to ensure that there is sufficient protection of databases. Because all the systems rely on the databases for accurate processing, the auditor should confirm that there is adequate internal control to ensure the integrity of the databases.

file:///F|/Courses/2010-11/CGA/AU1/06course/m07t02.htm (1 of 2) [04/10/2010 3:16:44 PM]


O n l i n e sy s t e m s The most common forms of online systems are real-time processing and online batch processing. The ATM you use to make withdrawals from, or deposits to, your bank account is an example of an online real-time processing system. A c ce s s c o n t r o l a n d s ec u r i t y o f o n l i n e s y s t e m s

Auditors should be particularly concerned with access control and security of online systems because there may be no evidence of unauthorized access. Access issues apply to both users and programmers. A user with unauthorized access to an online accounts receivable file may, intentionally or unintentionally, wipe out the balances in individual accounts. A programmer with unauthorized access may modify the code of a program to the detriment of the company. The security measures used to protect traditional batch systems (guards and locks) are ineffective for online systems because it may be possible to access such systems from any location using a terminal and a phone line. Auditors should carefully review the backup and recovery procedures of online systems. This is especially important because the lack of source documents will likely make it impossible to reconstruct data files if backup is inadequate. Co n t r o l o v e r o n l i n e s y s t e m s

Unlike traditional systems, online systems permit transactions to be entered directly through terminals, without requiring the use of source documents on paper. To exercise control over online systems, management can require that transactions first be recorded on paper-based source documents and then the source documents be approved before entry into the computer system. Such paper-based source documents form the audit trail needed by the auditor. Activity 7.2-1

What are the implications for the auditor’ s ability to obtain evidence if no paper-based source documents are used? What checks and control can be instituted instead of the use of source documents? Solution

ED I ( El e ct r o n i c d a t a i n t e r c h a n g e ) EDI consists of the exchange of electronic documents between two companies. Effectively, transactions and contracts are created through two interacting computer systems. EDI allows organizations with dissimilar computing environments to exchange electronic business documents without using paper. W h a t a r e t h e b e n e f i t s o f ED I ?

Some obvious benefits are the elimination of paperwork, the reduction of document processing costs, access to more information on a timely basis, and increased accuracy of recordkeeping. There are some drawbacks as well, but the increasing use of EDI suggests that the benefits outweigh the costs. ’

H o w d o ED I t r a n s ac t i o n s a f f e ct t h e a u d i t o r s w o r k ?

The implications for auditors are the loss of audit trail resulting from the paperless environment and lack of human intervention resulting in total dependence on the electronic system. These characteristics significantly increase risk, making control assurance the key objective for EDI environments. Auditors, in turn, need to monitor EDI controls throughout the period under audit, for example, through the use of software that allows tagging of transactions to trace their p rocessing. To control potential legal risks, businesses may require their trading partners to enter into trading partner a greements (TPAs). TPAs frequently include an obligation to report and disclose compliance with a set of specified standards of EDI control. Increasingly, auditors will be asked to provide opinions on the EDI control environment. Such audit opinions may become mandatory, which will likely encourage d evelopment of generalized control standards and criteria. Consequently, auditors will have to be better trained in this emerging area of information technology.



7 . 3 A u d i t i m p l i ca t i o n s: I n t e r n a l co n t r o l p r o c es se s L ea r n i n g o b j e c t i v e ●

Explain the audit implications of a simple computer-based system for a company ’ s internal control as it relates to the organizational structure and the processing of transactions. (Level 1)

Required reading ● ● ●

Chapter 9, Appendix 9A , pages 5 –6 CAS 315.A49 –.A55 (CICA Handbook Reading 7-1: AuG-6, Auditing in an EDP environment, Section 4

, paragraphs 5141.057 –.063)

LEVEL 1

I nternal control objectives are the same under manual systems and computer systems; however, their evaluation is different. The auditor must be aware of the differences between the two systems: certain differences may result in improved controls, while other differences may result in reduced controls. Some differences — for example, the centralization of processing — may be a mixed blessing.

Reading 7-1, Section 4, provides a perspective for assessing risk and internal control in a computer processing environment. The characteristics of computer-based systems are such that either new internal controls must be implemented or existing ones modified. Read paragraph 4.2 of Reading 7-1 to become familiar with all the characteristics that have internal control implications. In this topic, you look at the organizational structure required to manage the computer system, the nature of transaction processing, and the effect on auditing. Review CAS 315.A49 –.A55 (CICA paragraphs 5141.057 –.063), which highlight the risks and benefits of manual and automated Handbook, elements of internal control relevant to the auditor ’ s risk assessment. Topic 7.4 describes audit implications of computerized systems related to system access and design, and backup and recovery procedures. The guidelines deal with internal controls over computer activities; they do not describe computer processing as part of internal controls over an organization ’ s operations. By themselves, computer-based systems are tools; they are not policies and procedures. The following sections describe the more important implications of simple computerbased systems on internal controls.

Co n c e n t r a t i o n o f f u n c t i o n s One of the most important issues related to a computer processing system is the potential control risk associated with the concentration of functions. S ce n a r i o 7 . 3 - 1 : Se g r e g a t i o n o f d u t i e s

Your audit manager informs you that in general, implementation of computer-based systems requires new policies and procedures to ensure that proper segregation of duties is maintained. For you, the audit implication is to ensure that appropriate controls are in place, which ma y include segregating the following functions: ● ● ● ●

data control data entry computer operation data and programs custody

Do you agree that this is possible for traditional large systems? If so, outline the appropriate function segregation (key players involved and their functions) in a typical computer department that will facilitate detection of errors and prevent fraudulent manipulation. Solution 1 file:///F|/Courses/2010-11/CGA/AU1/06course/m07t03.htm (1 of 2) [04/10/2010 3:16:45 PM]


In general, a clear segregation of duties is a feature of traditional large systems. Can segregation of duties be applied to microcomputer systems? Solution 2

D o cu m e n t a t i o n o f t r a n s a ct i o n s The use of computer systems will undoubtedly reduce the amount of physical documentation available for the auditor. Additional controls are necessary to achieve the objectives of validity, authorization, and completeness that are traditionally supported by documentation. Documentation deficiencies can take the following forms: ●

● ●

Input documentation (such as batch entry sheet or purchase invoice), which normally contains evidence of authorization and validity, does not exist. Audit trail documents, such as ledgers, reports, and records are not available except for machine-readable documents. Output documentation providing evidence of transactions, including trial balances and invoices, is not produced by the computer system.

Data may be input to a system without leaving an audit trail of transactions. For example, a customer may order goods by accessing the client’ s system directly; in that case, no hard copy purchase order would exist. The internal accounting, preparation of the invoice and shipping documents, debit to accounts receivable and related credit to sales, debit to cost of goods sold and the related credit to inventory, and reduction in the inventory records for the quantities sold can be accomplished without generating hard copy documentation. The auditor must be able to confirm that the system is properly recording all of these activities. S ce n a r i o 7 . 3 - 2 : T RP I n c

–

A u t o m a t i c t r a n s ac t i o n s

Teresa is the Director of Finance for TRP Inc. The Chief Financial Officer (CFO), as part of the business planning for the following year, has tabled a project to computerize TRP ’ s accounting systems. The various user groups within TRP Inc. have submitted their requirements. They would like to se e internal accounting transactions be initiated and completed within the computer automatically. For example, a sales commission may be calculated and paid automatically by the system without human intervention. Another example is pre-authorized bill payments. The CFO likes the idea of initiating automatic transactions within the system. What comments should Teresa provide in light of controls that may be required for such transactions? Solution Another implication of automatic transactions in computer systems is the multiple updates to accounts that can arise from a single transaction. A single receipt-of-payment entry in a computer system can simultaneously update the cash and accounts receivable, the customer’ s account, and the credit profile of the client. The auditor should be aware of the extent to which a single transaction or entry affects accounts and other files. Yet another risk arises in the capital markets. Worldwide, computers are instructed to initiate and complete buy and sell transactions depending on predetermined conditions, such as the price of a stock. Can you imagine the consequences if a glitch in computer systems (programs) started a chain reaction of massive selling of financial assets such as stocks and derivatives? In these circumstances, auditors should make certain that effective controls exist.



7 . 4 A u d i t i m p l i c at i o n s : Sy s t e m a cc es s an d d e si g n L ea r n i n g o b j e c t i v e ●

Explain the audit implications of a simple computer-based system for a company ’ s internal control as it relates to system access, design, backup, and data recovery. (Level 1)

Required reading ● ●

Chapter 9, Appendix 9A , pages 15 –18 Reading 7-1: AuG-6, Auditing in an EDP environment, Section 4

LEVEL 1

In a computerized environment, concentration of data and programs as well as ease of access can lead to significant risks for companies.

U n a u t h o r i z e d ac c es s For example: Anyone can enter a system unless access is controlled by barriers such as passwords and validation protocols; individuals within a company may be able to access that company ’ s system, or parts of it, without authorization; and “hackers” can break into any computer system. A company may not be aware that its system has been compromised, and may be unaware of transactions made by an unauthorized person. Unauthorized access can be the result of outside operators breaking into a network, or of a company allowing unrestricted access to sensitive areas where hardware and software are kept. Because there is a higher level of centralization of data in computerized systems, unauthorized access can have catastrophic consequences. Audit implications

The auditor must ensure that there are controls to prevent unauthorized access and that there are procedures to secure restricted or sensitive areas throughout the organization. Such controls include, but are not limited to, the following: ● ● ●

password controls physical restrictions to computer equipment activity logs regarding all access and attempted access to data files or programs

Sy s t e m d e s ig n Properly designed systems enable data to be processed consistently and correctly with little human intervention. However, computer systems may produce errors that a human would never make and, usually, the fault is in the system. With manual processing, we usually recognize absurd transactions and correct them; unless programmed to do so, computer systems do not. Ex a m p l e 7 . 4 - 1 : D e si g n r e q u i r e m e n t s

A customer bought some furniture polish from the furniture department of a large department store on his store credit card. The computer system was programmed to perform a limit check on each transaction, but the limits were quite high because furniture tends to have a high unit price. The clerk erroneously punched in the product code as the price, and the sale for the bottle of furniture polish was recorded at $2,045. Neither the clerk nor the customer noticed the error. Several days later, the customer tried to use his store credit card again and was told that he had exceeded his credit limit, which was $2,000. This mistake would have been avoided if the sales clerk had manually recorded the sale on an invoice.



Control procedures can be embedded in computer programs to avoid these types of errors, and the auditor should ensure that such control procedures are in place. In the case of the pricing error for furniture polish, what could have been included as part of the design requirements to prevent or reduce such errors? Solution Auditors should offer their expertise to clients in the design and implementation of new computer systems. Information system designers design computer systems for efficiency and effectiveness. They are not as concerned with controls as auditors and management are, and may omit important internal controls such as a test of the reasonableness of a price (as opposed to the arithmetic accuracy) on an invoice.

V u l n e r a b i l i t y o f h a r d w a r e , s o f t w a r e , a n d d a t a f i l es What happens if there is a fire? Computer systems tend to centralize programs and data. In case of fire, files and computers may be destroyed. If it is not possible to reconstruct the information files from another source, the company could be in serious difficulties. From an audit standpoint, there may even be a denial of opinion, because nothing can be verified without proper access to records. Internal controls must be in place to make sure that data can be recovered in case of an accident. The auditor would have to ensure that there are policies and procedures to back up and recover data, as well as adequate insurance coverage for business interruption and for replacement of hardware that is destroyed or stolen.



7 . 5 Ge n e r a l co n t r o l s a n d a p p l i c at i o n c o n t r o l s L ea r n i n g o b j e c t i v e ●

Describe general controls and application controls, and explain how they relate to accounting controls. (Level 2)

Required reading ● ● ● ●

Chapter 7, pages 253 –254 Chapter 9, Appendix 9A , pages 6 –15 CAS 315.21 and CAS 315.A91 –.A93 (CICA Handbook Reading 7-1: AuG-6, Auditing in an EDP environment, Section 4

, paragraph 5141.093)

LEVEL 2

Technology and technological changes can present risk to a business in different ways. CAS 315.21 requires that the auditor obtain an understanding of how the entity has responded to risks arising from its use of IT. Section 4 of Reading 7-1 defines general and application controls in paragraphs 4.5 and 4.6. General controls and application controls are also described on pages 6 to 15 of Appendix 9A. The control hierarchy diagram in the following exhibit illustrates how computer controls, including their general and application controls components, fit into the overall internal control framework of the organization. Ex h i b i t 7 . 5 - 1 : Co n t r o l h i e r a r c h y d i a g r a m



General controls A general cont rol applies to overall computer processing activities (for example, controls over systems development and maintenance, operations, and backup), while an application control is specific to one or more accounting applications (for example, controls over authorizing, recording, and processing of payroll or sales transactions). General controls are an extension to computer controls of the control environment concept covered in Module 5. Like the control environment, general controls are mostly preventive in nature and apply to all parts of the computer systems. The boxes on pages 7 to 9 of Appendix 9A illustrate some general controls that auditors should consider. The general control procedures establish a structure of control over the management and operation of information systems rather than the specific systems themselves. Activity 7.5-1

General controls include documentation and system development controls. Why are these controls ultimately related to the accurate processing of data and viewed as preventive in nature? Solution 1 The general control procedures of backup , file security , and file retention are described on pages 9 and 10 of Appendix 9A. Backup controls are one of the most important general controls, not only f or audit planning purposes, but also possibly for accounting disclosure purposes. Why is this so? Solution 2



Management and the auditor should be equally concerned that backup control objectives are met.

A p p l i c a t i o n c o n t r o l s : R e as o n a b l e n e s s c h e ck Application controls are needed to replace the loss of human review that normally exists in a manual system. Pages 11 to 14 of Appendix 9A illustrate typical application controls organized by input, processing, and output controls. Note that the application controls are often embedded in the software used by the client. The boxes on pages 14 and 15 of Appendix 9A illustrate important input, processing, and output controls that the auditor should consider for e ach application. S ce n a r i o 7 . 5 - 1 : T RP I n c

—

A p p l i ca t i o n c o n t r o l s

Teresa, Director of Finance for TRP Inc., met with Mario, TRP ’ s Payroll Manager. Mario indicated that in the current manual system, a payroll clerk was able to instantly recognize that 1,000 hours recorded for a single employee during a one-week period is physically impossible. Mario would like to know how this error could be detected if the same processing were done by computer. What do you think Teresa’ s answer would be? Solution

U n d er s t a n d i n g i n t e r n a l co n t r o l i n a c om p u t e r e n v i r o n m e n t The auditor’ s objective of understanding internal control and assessing control risk is the same for a computer system as for a manual system. The auditor wants to determine how much reliance can be placed on internal control, given audit risk and inherent risk, and thus how much evidence must be obtained from the tests of details of balances. If the computer system is very complex, the auditor may need the assistance of a computer audit specialist. S ce n a r i o 7 . 5 - 2 : T RP I n c

—

Co n v e r s i o n t o c o m p u t e r

TRP Inc. is planning to change from a manual accounting system to a computer system. Having regard for the fact that the auditor’ s objective of understanding internal control and assessing control risk is the same for the computer system as for a manual system, what special audit considerations would likely be triggered in a conversion? Solution



7 . 6 A u d i t i m p l i c at i o n s o f e l ec t r o n i c c o m m e r c e L ea r n i n g o b j e c t i v e ●

Summarize the impact of EDI and the Internet on a company ’ s operations, including the implications of electronic commerce for the company’ s internal control and for its audit. (Level 2)

Required reading ● ●

Chapter 7, Appendix 7E Chapter 9, pages 339 –345

LEVEL 2

The Internet, or World Wide Web, is rapidly evolving in a variety of ways as a major force in commerce. This affects the auditor in the following ways: ●

●

●

The Internet provides a vast source of information auditors can use in the course of their work. This information includes real-time access to financial indicators, clients ’ public documents, news, and quotes. Companies can conduct some or all of their business through the Internet. Therefore, there is an anticipated need to provide customized assurance services for these companies. A company’ s Internet website is an open door into the company ’ s network systems. Therefore, security problems may arise unless proper controls are put in place.

W e b s i t e s e cu r i t y Since 1997, the AICPA and CICA have run a joint program of developing and promoting assurance services for websites on the Internet. It has become commonplace for businesses to create an Internet presence through a website. Most websites started as information sources about the company by converting existing brochures and other documents into an online format. Business websites are rapidly becoming more promotional in nature and an important new marketing tool in an increasingly (more people have convenient access to the Internet). Websites are proving to be a major link to customers and suppliers, with the result that companies are using websites to make sales and purchases, to help in the design of products and marketing strategy, and to distribute and share financial and other information. More and more websites are turning into the major outlet or “store front” for companies as electronic commerce (transactions over the Internet or other networks) increases in popularity.

“wired” society

Se c u r i n g s a l e s t r a n s a c t i o n s Security technologies and strategies should be familiar to you from Managing Information Systems [MS1 ] or equivalent. Other important security technologies include ● ● ● ●

digital certificates for authentication and non-repudiation secure sockets layer (SSL) and Secure Hypertext Transfer Protocol (S-HTTP) for privacy access control lists for authentication, and firewalls, a part of organization ’ s overall security plan.

Activity 7.6-1

Electronic commerce introduces a new set of concerns for companies such as designing and positioning a site to attract customers, making sales and purchase transactions secure, and ensuring customer privacy. What are some of the control features an auditor should be looking for in order to address these concerns? Highlight both technological controls as well as organizational controls. file:///F|/Courses/2010-11/CGA/AU1/06course/m07t06.htm (1 of 2) [04/10/2010 3:16:48 PM]


Solution



7 . 7 A u d i t i n g c o m p u t e r i ze d sy s t e m s

—

General considerations

L ea r n i n g o b j e c t i v e ●

Explain how an audit is conducted in a computer environment. (Level 1)

No required reading LEVEL 1

Regardless of whether an entity operates a manual system, a computer system, or a combined manual and computer system, the auditor should comply with GAAS in GAAS audits. Accordingly, the auditor may complete the audit in a computer environment (or combined computer and manual environment) along the following lines.

Co m p l y i n g w i t h G AA S e x a m i n a t i o n s t a n d a r d s First examinat ion standard of GAAS: As part of using sufficient knowledge of the entity ’ s business to plan the audit, the auditor should obtain an understanding of the computer processing configuration, the method of processing and related matters, in order to assess inherent risk in connection with planning the audit. For instance, the auditor will consider the impact of computer processing in determining the nature, timing, and extent of auditing procedures. Second examination standard of GAAS: The auditor would obtain a sufficient understanding of general controls (control environment factors) pertaining to accounting systems applications that are significant to the audit. This can be done through questionnaires, enquiry, and prior-year working papers. Also, the auditor should obtain an understanding of the a pplication controls over input, processing, and output (control systems) relating to major transaction classes and account balances that are significant to the audit. This can be done through a review of systems documentation, for example.

Based on the understanding of the computer processing system and related manual internal control policies, and procedures with respect to specific assertions at the account balance or classes of transactions level, the auditor would assess, on a preliminary basis, control risk at/near maximum or below maximum level, and use a substantive approach or a combined approach accordingly. When using a combined approach, the auditor would perform tests of controls on those internal control policies and procedures (covering both manual and computer systems) that enhance the reliability of data and information. In this regard, the auditor may use a computer for performing tests of controls or dual-purpose procedures. Based on tests of controls, the auditor would finalize control risk for specific a ssertions at the account balance or class of transactions level, and determine the nature, timing, and extent of substantive procedures in light of materiality and inherent risk. Some of these procedures could be performed using computers, and others performed manually. Third examinat ion standard of GAAS: The auditor would perform the substantive procedures determined previously for gathering sufficient appropriate audit evidence for specific assertions at the account balance and transactions level. In this regard, the auditor may consider using generalized audit software packages where appropriate.

file:///F|/Courses/2010-11/CGA/AU1/06course/m07t07.ht

[04/10/2010 3:16:49 PM]


7 . 8 Ge n e r a l st r a t e g y i n a u d i t i n g c o m p u t e r i z ed s y st e m s L ea r n i n g o b j e c t i v e ●

Identify the phases of auditing a computerized accounting system. (Level 1)


● ●

Chapter 9, Appendix 9A pages 3 –4 CAS 315.A77 –.A82 (CICA Handbook Reading 7-1: AuG-6, Auditing in an EDP environment, Section 5

, paragraphs 5141.080 –.089)

LEVEL 1

Reading 7-1, Section 5 describes audit planning considerations in a computer environment. Guidance on obtaining understanding of the accounting information system and the nature of the internal control procedures is given in CAS 315. A77 –.A82 (CICA Handbook , paragraphs 5141.080 –.089). The steps in evaluating computer processing controls can be summarized as follows.

1 . Pr e l i m i n a r y e v a l u a t i o n o f i n t e r n a l co n t r o l Activity 7.8-1

Auditors should conduct a preliminary evaluation of the general and application controls that may be effective and efficient for performing the audit. The general controls may have a pervasive effect on the processing of transactions in applications systems. If these controls are not effective, the risk is that errors might occur and go undetected in the application system. Weaknesses in general controls may make certain application controls unreliable. However, manual procedures exercised by the users may provide effective compensating control at the application level. Can you identify a compensating control? Solution 1 What alternate measures might the auditor look f or when concluding that there are weaknesses in general or application controls that preclude reliance on those controls? Solution 2

2 . T es t o f c o n t r o l s p r o c e d u r e s The purpose of the auditors ’ test of controls procedures and final evaluation is to determine that the controls that they intend to rely on were functioning effectively throughout the period of intended reliance and that they can be relied on as planned in the preliminary evaluation. In a computer environment, the objectives of test of controls procedures do not change from those in a manual environment; however, some audit procedures may change. In addition to enquiry, observation, and sampling procedures, the auditor may find it necessary, or may prefer, to use computer-assisted audit techniques (CAATs).

3 . Fi n a l e v a l u a t i o n If the auditor obtains evidence that the controls were not operating as designed, or the test of controls procedures indicate that the general controls do not provide reasonable assurance that the application controls functioned during the pe riod of reliance, the auditor’ s final evaluation may be to discontinue the planned reliance. Instead, the auditor may seek to accomplish the audit objectives through the application of more extensive substantive procedures.


[04/10/2010 3:16:50 PM]


7 . 9 I n t e r n a l co n t r o l c o n si d e r a t i o n s i n p e r s o n a l c o m p u t e r , o n l i n e , a n d d a t a b a se e n v i r o n m e n t s L ea r n i n g o b j e c t i v e

●

Identify internal control considerations in personal computer, online, and database e nvironments. (Level 1)

Required reading

●

●

Chapter 9, Appendix 9A , pages 15 –19 Reading 7-1: AuG-6, Auditing in an EDP Environment, Sections 9 and 10 (paragraphs 10.1 – 10.11)

LEVEL 1

AuG-6, Section 9 provides an overview of the audit considerations in a personal computer environment.

P er s o n a l c o m p u t e r s ( P Cs ) The control environment for stand-alone computers (PCs) is generally weak because of a lack of ●

●

●

●

●

segregation of duties physical security of the microcomputer and its files computer knowledge reliable hardware and software, and documentation for software and software changes.

Typically, there are no application controls (such as use of batch totals or passwords) in small systems. In such computer environments, it may not be easy to distinguish between general controls and application controls. Frequently, it may not be practicable or cost-effective for management to implement sufficient controls to reduce risks of undetected errors to a minimum level. The auditor may often assume the control risk is high in such systems. Nevertheless, the auditor may be able to rely on owner/manager controls to compensate for the poor c ontrol environment.

O n l i n e an d d a t a b a se s y s t e m s Paragraphs 10.1 to 10.11 in Reading 7-1 outline the internal control considerations for online and database systems.


[04/10/2010 3:16:50 PM]


7 . 1 0 A p p r o a ch e s t o a u d i t i n g c om p u t e r i ze d s y st e m s L ea r n i n g o b j e c t i v e ●

Explain the difference between auditing around/without the computer and auditing through/with the computer to test internal control. (Level 1)


Chapter 9, Appendix 9A , pages 18 –20 (up to Review Checkpoints)

LEVEL 1

There are two terms to describe the methods of auditing computerized systems — auditing around the computer and auditing through the computer.

A u d i t i n g a r o u n d t h e c om p u t e r When auditing around the computer, no attempt is made to evaluate the internal processes of the computer. This method of bypassing the computer, or treating it like a “black box,” consists of vouching or tracing to and from source documents and outputs. Exhibit 9A-2 on page 19 of Appendix 9A illustrates this process of manually processing sample documents and comparing those results to the same documents processed by the client’ s system.

A u d i t i n g t h r o u g h t h e c om p u t e r This approach consists of auditing the computer processing system or data produced by the system to determine how much reliance can be placed on the various internal controls programmed into the system. Exhibit 7.10-1 summarizes the two approaches. Ex h i b i t 7 . 1 0 - 1 : A u d i t i n g a r o u n d t h e c om p u t e r a n d t h r o u g h t h e c o m p u t e r

How is it done?

Advantage(s)

A u d i t i n g a r o u n d t h e co m pu t er

Au d it in g t h r ou gh t h e computer

No attempt is made to evaluate the internal processes of the computer. Consists of vouching or tracing to and from source documents and outputs.

Auditing the computer processing system or data produced by the system to test the programmed controls.

●

●

Simplicity — does not require computer-proficient personnel. May be more cost effective.


Sophisticated method and may be the only method if significant parts of the internal controls are embedded in the computer system.


What are the “ideal” conditions for each?

Requires sufficient audit trail of visible evidence.

This method must be used if any one of the following exists: ●

●

●

Approaches

Bypasses the computer (auditing without the computer).

The presence of large volumes of input/output means that direct examination of the records is difficult. Lack of visible audit trail means that significant parts of the internal controls are embedded in the computer system. System is complex and includes key parts of the accounting system.

Two main approaches 1. Test data 2. Parallel simulation



7 . 1 1 A p p r o ach e s t o a u d i t i n g t h r o u g h t h e co m p u t e r L ea r n i n g o b j e c t i v e ●



Chapter 9, Appendix 9A , pages 20 –28, and Exhibits 9A-e and 9A-4 on pages 21 and 22

●

Reading 7-1: AuG-6, Auditing in an EDP Environment, Section 6

LEVEL 1

There are several approaches to auditing through the computer. The text describes two of these approaches to “auditing with the computer” to test a company’ s programmed controls: ● ●

Test data approach Auditor’ s computer program approach, including generalized audit software (GAS)

Each approach has its particular strengths and weaknesses and may be used alone or in combination. As clients ’ computer systems perform more and more of the accounting functions, the audit trail becomes less visible. If the audit trail is nonexistent, the auditor is forced to audit through the computer using one of the two approaches described. Exhibit 7.11-1 compares the two approaches. Ex h i b i t 7 . 1 1 - 1 : T e st d a t a a n d p a r a l l el s i m u l a t i o n a p p r o a c h e s

Tes t da t a a p p r o a ch

Pa r a l l e l s i m u l a t i o n a p p r o a ch ’

Strengths

Uses the uniformity principle The auditor s own programs can (once a computer is programmed be tailored to the client s system. to handle transactions in a certain logical way, it will handle every transaction in a similar fashion).

Weaknesses

A computer system may contain errors that offset each other, providing output that appears to be correct. Without examining the internal processing logic of the computer systems, the auditor can only prove that the computer system works correctly with the test data used. The auditor has no means to confirm that the computer system will correctly handle transactions not included in the test data.

’

“

”

The programs may be costly to develop and modify. Generalized audit software (GAS) makes the parallel simulation approach more attractive. GAS contains prepackaged subroutines that can perform most tasks needed in auditing and business applications.

The t est dat a approach involves developing simulated data that are processed using the client’ s actual computer program (or more likely a copy thereof), and then comparing the output to predetermined results. When using the test data approach, the auditor must ascertain that the computer system being tested is the same one the client used to process data for the entire period under review, and that none of the test data has contaminated the client ’ s



records and files. Because of the high risks of not detecting system errors in complex systems, the test data approach is not the best approach to use in auditing such systems.

Ge n e r a l i ze d a u d i t s o f t w a r e ( GA S) Parallel simulati on consists of processing client data using the auditor’ s program and comparing the result to the output of the same data processed by the client’ s program. This process can be performed by GAS.

Exhibit 9A-4 on page 22 of Appendix 9A illustrates how an auditor would use developed software as a parallel simulation. Some larger firms develop software for the audit of specific clients (for example, life insurance companies). GAS has the advantages of being relatively easy to use and widely applicable. GAS can be used to process a variety of files in different formats or media to perform a number of functions, such as sampling, calculating totals and subtotals, selecting specific records, and so on. Appendix 9A, pages 24 and 25, lists a number of techniques (with excellent examples) that the auditor can perform if the client’ s data are in machine-readable form. Reading 7-1, AuG-6, Section 6, Computer-assisted audit techniques (CAATs), explains the uses of CAATs.



7 . 1 2 Co m p u t e r - a i d e d a u d i t i n g L ea r n i n g o b j e c t i v e ●



Chapter 9, Appendix 9A , page 28

LEVEL 1

On page 28 of Appendix 9A, the text describes several ways to use computers for an audit. The future of computers in auditing is firmly established because of their small size yet large computing power. The development of software to support the new hardware is keeping pace. Many public accounting firms provide staff with computers; laptop and notebook computers, along with auditing software such as CaseWare, are becoming as ubiquitous as the auditor ’ s briefcase. In addition, industry information and information on comparable companies can be obtained on the Internet (for example, via Statistics Canada’ s website) as a means to improve the auditor ’ s knowledge of the business and in performing analytical procedures. Here are some highlights of the software programs and aids available to auditors. Comm ercial general use soft w are Spreadsheet programs such as Microsoft Excel can be used for analysis or for sampling (see Computer activity 6.11-1 in Topic 6.11). Word-processing programs such as Microsoft Word are useful for drafting statements or preparing reports and letters. —

Pre-built spreadsheet t emplat es papers and financial statements).

—

Auditors often use pre-built spreadsheet templates (for example, model working

Some academics and public accountants see the development of expert systems as one of the Special use soft w are next major developments in auditing. The work on expert systems is slow and very expensive. There are some applications in auditing — one application developed in the United States by KPMG LLP can be used to assess the collectibility of bank loans. Expert systems are being developed for audit planning and for assessing EDP controls. —

Custom pr ograms These special programs are written by auditors to audit specific areas. For example, one large accounting firm uses custom programs to audit policy reserves of casualty insurance companies. —

Working paper softw are Almost all public accounting firms now use working paper software developed either in-house or purchased from an outside vendor (for example, CaseWare). The purchased software may be modified with specialized templates or electronic forms to prepare working papers and letters such as confirmations, engagement, and management letters. The main purpose of working paper software is to automate calculations such as footings and extensions, as well as to perform the carryforward functions such as updating from journal entries and worksheets to working pap ers, lead sheets, trial balances, and financial statements. —

Netw orked files Adopting technological advances allows several auditors to work independently on different sections of the audit on their laptop computers hooked up to a network. The network continually integrates their work with a master working paper file and keeps working paper references and indexing up-to-date. —

Team members in different locations can coordinate their work by sending each other copies of their portion of the audit file, while supervisors can monitor progress and provide feedback without being physically present at the audit location(s). This alternative provides great flexibility in organizing the team ’ s work. St andardized document t emplat es

—

The use of standardized templates provides a common starting point for all



documents. A database of templates can be useful in customizing documents such as internal control questionnaires, audit programs, and sample letters. Links can also be established to other databases or even to websites so that data or information from these sources can be cross-referenced or transferred to the working papers. Thus, not only various staff but also various sources of information can be integrated to support the auditor ’ s opinion. Of course, to obtain such efficiencies, the audit firms would need to invest in hardware, software, and training of staff.


file:///F|/Courses/2010-11/CGA/AU1/06course/m07summary.htm

M o d u l e 7 su m m a r y ’

Ex p l a i n t h e m a j o r e f f e c t s o f co m p u t e r i z a t i o n o f a cc o u n t i n g s y s t e m s o n a c o m p a n y s o p e r a t i o n s a n d o n t h e a u d i t a p p r o a ch . ●

Effects on the company’ s operations: absence or short life of transaction trails uniform processing of transactions concentration of functions increased potential for certain types of errors and irregularities potential for increased management supervision and review existence of system-generated transactions r r r r r r

●

Effects on the approach to auditing: Consideration of IT-related matters when planning the audit The impact of the computer environment on internal controls and the audit r r

●

●

●

When acquiring sufficient knowledge of the client’ s business, the auditor should obtain an understanding of the client’ s computer systems and how they are used. The auditor must sufficiently understand the internal controls related to the computer systems. This understanding includes both general controls and application controls. The auditor can also consider using computer-assisted audit techniques when gathering and evaluating e vidence concerning the assertions at the account balance and transaction level. ’

D e sc r i b e t h e m a j o r e l e m e n t s o f a u d i t s i g n i f i c a n c e i n t o d a y s c om p u t e r e n v i r o n m e n t . ●

Major elements of audit significance include microcomputers, databases, online systems, and e-commerce (Electronic Data Interchange and the Internet). ’

Ex p l a i n t h e au d i t i m p l i c at i o n s o f a si m p l e co m p u t e r - b a s e d sy s t e m f o r a c o m p a n y s i n t e r n a l co n t r o l a s it r e l a t e s t o t h e o r g a n i z a t i o n a l st r u c t u r e a n d t h e p r o c e s si n g o f transactions. ●

Although control objectives do not change, the procedures used to achieve control and the means of evaluation will change. Increased concern must be placed on controls related to the concentration of functions documentation of transactions controls over online authorizations and system-generated transactions r r r

’

Ex p l a i n t h e au d i t i m p l i c at i o n s o f a si m p l e co m p u t e r - b a s e d sy s t e m f o r a c o m p a n y s i n t e r n a l c o n t r o l a s i t r e l a t e s t o s y s t e m a cc es s, d e si g n , b a c k u p , a n d d a t a r e c ov e r y . ●

Although control objectives do not change, the procedures used to achieve control and the means of evaluation will change. Increased concern must be placed on controls related to controls over access to programs and data controls over system design and maintenance protection of the system against hazards of nature and against potential sabotage r r r

D e sc r i b e g e n e r a l c o n t r o l s a n d a p p l i ca t i o n c o n t r o l s an d e x p l a i n h o w t h e y r e l a t e t o a cc o u n t i n g c o n t r o l s . ●

●

General controls apply to all or many computerized accounting activities. They include controls over segregation of duties, physical access to the computer, programs, data, documentation, systems development controls, hardware controls, backup and recovery procedures, and so on. Application controls are related to specific applications such as order processing and payroll. They include input controls, processing controls, and output controls.

file:///F|/Courses/2010-11/CGA/AU1/06course/m07summary.htm (1 of 3) [04/10/2010 3:16:54 PM]

file:///F|/Courses/2010-11/CGA/AU1/06course/m07summary.htm ●

●

Application controls are usually evaluated using flowcharts and internal control questionnaires in much the same way that accounting controls are evaluated for manual systems. The auditor must consider the potential weaknesses in the computer controls as well as the manual controls over the data before and after computer processing. ’

Su m m a r i ze t h e i m p a c t o f ED I a n d t h e I n t e r n e t o n a c o m p a n y s o p e r a t i o n s , in c l u d i n g t h e i m p l i c at i o n s o f e l e ct r o n i c co m m e r c e f o r a c o m p a n y s in t e r n a l co n t r o l a n d f o r i t s a u d i t . ’

●

The two main effects of EDI for auditors are a paperless environment, resulting in the loss of an audit trail the lack of human involvement in the data interchange, resulting in a complete dependence on the electronic system r r

●

●

●

The main concerns about the use of the Internet are related to security issues such as the need for firewalls to keep external users outside the organization ’ s internal networks and systems. The main implications for internal control are related to se curity issues. These include control over access to websites and protection from viruses, and so on. Both websites and the transactions carried out on the Internet must be secure. The main implications for the audit are an expansion of the area of knowledge required of the auditor, who will have to gain knowledge of the additional controls and almost certainly test their performance.

Ex p l a i n h o w a n a u d i t i s co n d u c t e d i n a c om p u t e r e n v i r o n m e n t . ●

●

●

●

Auditors should comply with GAAS in GAAS audits regardless of whether an entity operates a manual system or a computer system. The audit should be properly planned. The auditor should gain an understanding of the entity and its environment, including its internal controls and should use that understanding to p lan the audit. Sufficient appropriate evidence must be obtained from tests of control and substantive audit procedures. The auditor may be able to use computer assisted audit techniques to improve the effectiveness and efficiency of the audit.

I d e n t i f y t h e p h a s es o f a u d i t i n g a c o m p u t e r i z ed a c co u n t i n g s y st e m . ●

●

The auditor should conduct a preliminary evaluation of internal control. This should include general and application controls the auditor might consider effective to rely on when conducting the audit. The auditor must then test the controls to see if they were functioning properly throughout the period being audited.

I d e n t i f y i n t e r n a l co n t r o l c o n s id e r a t i o n s i n p e r s o n a l c o m p u t e r , o n l i n e , a n d d a t a b a s e environments. ●

●

The auditor should take into account any unique internal control considerations for personal computers, online, and database environments. Guidance in auditing microcomputers, online systems and database environments are found in Sections 9 and 10 of CGA-Canada’ s Auditing Guideline No. 6.

Ex p l a i n t h e d if f e r e n ce b et w e en a u d i t i n g a r o u n d / w i t h o u t t h e co m p u t e r a n d a u d it i n g t h r o u g h / w i t h t h e c om p u t e r t o t e st i n t e r n a l c on t r o l . ●

●

●

Auditing around (or without) the computer consists of manually processing client transactions and comparing the results to the computer output. This does not necessarily violate generally accepted auditing standards and may be the most efficient approach in some circumstances. Auditing through (or with) the computer is usually necessary whenever the transaction volume is very large, there is


file:///F|/Courses/2010-11/CGA/AU1/06course/m07summary.htm

little or no audit trail, or the system is complex. ●

Two of the approaches that can be used in auditing through the computer are the test data and parallel simulation approaches.

Ex p l a i n h o w a n a u d i t o r c a n u s e c o m p u t e r s i n c o n d u c t i n g a u d i t s b y u s i n g t e s t d a t a a n d g e n e r a l i ze d au d i t s o f t w a r e . ●

●

●

The test data approach is used by developing simulated data and processing it through the client ’ s system and comparing the output to predetermined results. Generalized audit software can be used for a variety of audit purposes. Such programs will extract data from the client system, sort data, perform calculations, match data from different files, select statistical samples, and generate worksheets or databases for further analysis. The auditor should consider the extent to which it will be efficient to use computer-assisted audit techniques in carrying out the compliance or substantive testing required for the audit.

I d e n t i f y w a y s t o u se co m p u t e r s i n co n d u c t i n g a n au d i t . ● ● ● ● ● ● ●

commercial general-use software such as Excel pre-built spreadsheet templates special-use software such as expert systems custom programs for auditing specific areas working paper software networked files standardized document templates


file:///F|/Courses/2010-11/CGA/AU1/06course/m07t01sol.htm

Scenario 7.1-1 solution

Ef f e ct / I m p a ct

Ri sk

M a n a g e m e n t r e sp o n s i b i l i t y

Change to the organizational structure: Implementation of computer systems requires additional resources for the systems to function properly. These resources include qualified personnel and investment in capital assets (appropriate computer equipment).

Appropriate internal controls lacking in computerized environment

Management is responsible for establishing internal controls, regardless of the environment in which the company operates (computerized or noncomputerized). Therefore, implementation of computer systems forces management to ensure that ●

●

●

Centralization of data processing and resulting efficiencies: Centralization and the resulting efficiencies are usually the reasons why the company implements computer systems. Rather than having separate accounts payable or accounts receivable departments doing the data processing independently, for example, more data processing is done through one department — the computer centre or computer processing department.

Greater risk of losing large amount of data in case of breakdown of computer system

file:///F|/Courses/2010-11/CGA/AU1/06course/m07t01sol.htm [04/10/2010 3:16:56 PM]

adequate procedures are in place and computer systems are properly documented an adequate audit trail for significant classes of transactions exists, and knowledgeable personnel are in place to support the computer system and assist management and auditors.

Internal controls, policies, and procedures must be in place to make sure that data can be recovered in case of an accident. (The users of the computer processing department, such as the accounts receivable and accounts payable departments, become more dependent on centralized processing.)

file:///F|/Courses/2010-11/CGA/AU1/06course/m07t01sol2.htm


●

●

●

There might be more emphasis on evaluating the internal controls of the IT department. The auditor will have to determine if an IT specialist needs to be brought in to the audit team and how this will affect the nature, extent, and timing of audit procedures. Make planning decisions regarding other resources that will be needed for the audit, such as the use of computerassisted audit techniques.

file:///F|/Courses/2010-11/CGA/AU1/06course/m07t01sol2.htm [04/10/2010 3:16:57 PM]


Activity 7.2-1 solution

The auditor may not be able to obtain evidence that the transactions have been properly authorized. In such cases, the auditor may need to perform more extensive tests of details of balances. A common characteristic and desirable control for online systems that permit direct data entry without source documents is subjecting data to immediate validation checks by the system. To continue with the ATM example, the system checks for a correct PIN number, then accesses the information from the customer s bank account file to determine if there are enough funds to allow the customer to withdraw money from the ATM. ’



S ce n a r i o 7 . 3 - 1 s o l u t i o n 1 Se g r e g a t i o n o f d u t i e s

In traditional large systems, it is possible to segregate the functions in the computer department to detect errors and prevent fraudulent manipulation. The data control clerk in the computer processing department receives transaction batches from user departments and confirms that the transactions have been appropriately authorized before they are passed to the data entry clerks. Data entered into batches are verified for completeness and accuracy before the operator inputs that batch of data for processing. There is segregation of duties among the data control clerk, data entry clerk, and the operator. Operations staff is not permitted to modify the computer programs. Only programmers and systems analysts (systems development staff) can access and modify computer programs, provided they have authorization; however, they are not allowed to work with actual live data. Thus, there is a clear segregation of duties between the systems development staff on the one hand and the operations staff on the other, and the chance for unauthorized changes to computer programs is minimized.



S ce n a r i o 7 . 3 - 1 s o l u t i o n 2

With microcomputer systems, the segregation of duties and functions is often impractical a nd unlikely in practice. Usually, the same person (user) has complete control over the installation of the computer programs and entry of data. Thus, it is possible for a user with the required technical knowledge to alter the programs and data for personal gain without leaving any audit trail.




Automatic transaction processes must have appropriate controls in place. For example, input controls should ensure that purchases or sales will not take place above a pre-specified amount, and organization controls should ensure that changes to the program trading software are authorized, fully tested before implementation, and documented.



Ex a m p l e 7 . 4 - 1 s o l u t i o n D e si g n r e q u i r e m e n t s

A computer may prompt the user each time a transaction is out of the ordinary before continuing the process. Product prices could be entered into a database and accessed by the point-of-sales terminal by electronically scanning the Universal Product Code (UPC) printed on each item. The system could be programmed to prompt the user whenever a transaction would cause a customer s account balance to exceed the customer s credit limit. ’

’



Activity 7.5-1 solution 1

These controls affect the integrity of the various application programs that are developed and documented by the IT department, and as such, they ultimately relate to the accurate processing of data and are designed to prevent errors from occurring.




Backup controls and control procedures are of particular interest because they have serious accounting implications. One of the basic assumptions underlying a company s financial statements is that the company is a going concern. Researchers have estimated that a large company, which has computerized its system extensively, would be out of business in less than two weeks if its system was extensively damaged and it did not have backup systems and hardware. ’




The payroll software should have built-in limits or reasonableness checks to flag such transactions.




To rely on internal control, the auditor must audit the internal controls of the original accounting system up to the changeover date, audit the conversion to ensure that the correct balances were carried forward to the new system, and audit the new internal controls to the year-end. In other words, a conversion forces the auditor to perform three sets of audit tests in the year of conversion. The auditor may decide not to rely on one or both systems, and so would not audit either one or both, but would in any case audit the conversion to ensure that the client correctly carried forward the account balances from the old to the new system. This will apply as well in situations where there is a change from one computer system to another.



Activity 7.6-1 solution

One key control in designing a site is a firewall. Essentially, a firewall is a logical filter between an organization s internal network and the rest of the world. Firewalls monitor the data traffic both into and out of the organization s network and can be configured to block both certain kinds of data and all traffic from particular locations. ’

’

Firewalls, however, are not sufficient. They simply form part of the organization s overall security plan. Firewalls only help mitigate the risk of loss of privacy and reduce the likelihood of importing a virus, worm, or similar destructive agent. A company engaged in electronic commerce needs to address issues related to authentication, authorization, privacy, and nonrepudiation. ’

Technological controls also need to be supplemented by organizational controls, such as educating employees about virus scanning and ensuring that unauthorized devices are not bypassing the firewall. A company should also set up defined policies regarding the use of company networks, e-mail, and the Internet, because sensitive information sent via the Internet, unless specifically encrypted, is unsecured.




To compensate for lack of appropriate processing controls, the payroll department can scan the detailed listing of weekly or monthly salary payments for unusual amounts.




The auditor does not need to continue the review documentation or to perform compliance procedures. Instead, the auditor may seek to accomplish the audit objectives through the application of substantive procedures.


file:///F|/Courses/2010-11/CGA/AU1/06course/m07selftest.htm

M o d u l e 7 s el f - t e st Question 1

As a potential CGA, you should be aware of the auditing guidelines issued by CGA Canada in order to properly audit a computer processing installation. Describe the skills and competence required to perform such an audit, and explain why they are so important. Solution Question 2

List six characteristics that are important to the auditor s understanding of IT controls. ’

Solution Question 3

What concerns should an auditor have about the actual conversion when a client converts to a new information system? Solution Question 4

a. Review checkpoint 22, page 16 of Appendix 9A b. Review checkpoint 5, page 4 of Appendix 9A Solution Question 5

Review checkpoint 12, page 15 of Appendix 9A Solution Question 6

Review checkpoint 29, Appendix 9A , page 24 Solution Question 7

a. Review checkpoint 32, Appendix 9A , page 28 b. How are PCs used in small business audits? Solution

file:///F|/Courses/2010-11/CGA/AU1/06course/m07selftest.htm [04/10/2010 3:29:45 PM]

file:///F|/Courses/2010-11/CGA/AU1/06course/m07selftestsol1.htm

Se l f - t e s t 7 So l u t i o n 1

In CGA Auditing Guideline No. 6, Auditing in an EDP Environment (Reading 7-1), paragraph 3.3 under Skills and competence describes the skills and competence an auditor should have in order to properly audit an EDP system. They are: “

”

a.

Sufficient understanding of the EDP environment to plan the audit. An important part of planning an audit is gaining knowledge of the client s business and the environment in which the business operates. This includes a knowledge of the client s information processing capability, whether it be manual or EDP, or a mixture of both.

“

”

’

’

b.

“

c.

“

”

Sufficient knowledge of EDP to implement the auditing procedures. Generally accepted auditing standards require an auditor to have adequate technical training and proficiency in auditing. A logical extension is to require a CGA who is auditing an EDP system to have an adequate knowledge of EDP in order to audit an EDP system, which includes assessing inherent and control risk for specific assertions in an EDP environment, and determining substantive auditing procedures for gathering and evaluating sufficient appropriate audit evidence. Sufficient skills to competently evaluate the results. The comments pertaining to (b) apply equally to (c). ”

file:///F|/Courses/2010-11/CGA/AU1/06course/m07selftestsol1.htm [04/10/2010 3:29:46 PM]



The six characteristics important to the auditor s understanding of IT controls are: ’

1. Audit trail Some computer systems are so designed that a complete transaction trail (audit trail) may exist only for a short time or only in computer-readable form. (A transaction trail is a chain of evidence provided through coding, crossreferences, and documentation connecting account balances and other summary results with the original transaction documents and calculations.) 2. Uniform processing Computers process uniformly subjects like transactions to the same processing instructions, potentially eliminating random errors normally associated with manual processing. Conversely, programming errors (or other similar systematic errors in either the computer hardware or software) will result in all like transactions being processed incorrectly when those transactions are processed under the same conditions. The approach in auditing computerized files will be to test a small number of unusual or exceptional transactions (rather than a large number of similar transactions, as is the case in manual systems), and testing that the software tested has not been tampered with between tests. This assurance is obtained through justified reliance on control systems that are in place to prevent unauthorized changes and to document all changes to the software. 3. Segregation of duties Individuals who have access to the computer may be in a position to perform incompatible functions in an IT system that could have been controlled by segregating functions in manual systems. Password control procedures are a control method to separate incompatible functions, such as access to assets and access to records through an online terminal. The auditing approach puts more emphasis on the evaluation of general internal controls of the computer centre. 4. Visibility of alterations The potential for individuals, including those performing control procedures, to gain unauthorized access or alter data without visible evidence, as well as to gain access (direct or indirect) to assets, may be greater in computerized accounting systems. 5. Availability of analytical tools The IT system provides tools that management may use to review and supervise the operations of the company. This can enhance the entire system of internal control and reduce control risk. 6. Transactions initiated or executed automatically by a computer system The authorization of these transactions or procedures may not be documented and may be implicit in management s acceptance of the system design. Auditors need to assess general controls over system development and design. ’




The auditor s greatest concern is whether the data have been accurately and completely converted to the new system. If the new system or changed system starts with inaccurate data, the errors might never be caught. In addition, the cost of tracking down and converting discovered errors is very high. The auditor should also be concerned with potential fraudulent manipulation of data during the conversion process. The auditor should always attempt to be involved in any system conversion to ensure that data integrity is maintained. Because of the conversion, control risk may have increased and audit procedures will have to be changed. ’

Accurate cut-off between the two systems is essential. Documentation of conversion process should be required. The auditor needs to test the accuracy and completeness of the conversion.




a. Evaluating general and environmental controls before evaluating the more specific application controls is often most cost effective because the general and environmental controls have a more pervasive impact and tend to be preventive in nature. Generally, a weak control environment cannot be compensated by strong application controls because of the risks of control override and unauthorized access and program changes, so there is no point testing specific application controls unless the overall control environment and general controls are adequate. b. The extent of IT use has an impact on how a client produces financial information. The information systems and IT used in the client s significant accounting processes influence the nature, timing, and extent of planned audit procedures. Significant accounting processes are those relating to accounting information that can materially affect the financial statements. Important matters to consider include its complexity, how the IT function is organized and its place in the overall business organization, data availability, availability of CAATs, and the need for IT specialist skills. ’




General control procedures include ●

●

●

●

●

●

●

●

organization and physical access documentation and systems development hardware controls and preventive maintenance data file and program control and security backup and recovery procedures file security file retention system conversion controls (procedures to ensure the data is transferred completely and accurately, and that an accurate cut-off between the two systems is achieved)

Application control procedures include Input controls: ●

●

●

●

●

●

●

●

●

●

●

input authorization check digits record counts batch financial totals batch hash totals valid character tests valid sign tests missing data tests sequence tests limit/reasonableness tests error correction and resubmission

Processing controls: ●

●

●

●

run-to-run totals control total reports file logs limit/reasonableness tests

Output controls: ●

●

●

control totals master file changes output distribution




●

●

Using CAATs to test controls allows the audit team to make a conclusion about the actual operation of IT-based controls in an information system. This conclusion is used to assess the control risk and determine the nature, timing, and extent of substantive audit procedures for auditing the related account balances in the overall audit plan. This control risk assessment decision determines whether subsequent audit work may be performed using machine-readable files that are produced in the system. The data-processing control over such files is important because their content is utilized later in computer-assisted work using generalized audit software. CAATs can also be used when performing substantive testing.


Audit in CIS Environment

Recommend Documents