CH 16

Chapter Auditing Information
16 Technology
What is auditing through the computer?

It is the process of reviewing and evaluating the
internal controls in an electronic data processing
system.
What is auditing with the computer?
It is the utilization of the computer by an auditor
to perform some audit work that otherwise would
have to be done manually.
2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 1
Structure of Financial
Statement Audit
The primary objective and responsibility

of the external auditor is to attest to the
fairness of a firms financial reports.
The external auditor serves the firms
stockholders, the government, and the
general public.
The internal auditor serves a firms
management.
Statement Audit
Various types of professional certifications

are applicable to auditing.
What are these?
CPA (certified public accountant)
CISA (certified information systems auditor)
CIA (certified internal auditor)
Audits are almost universally divided into
two components.
Statement Audit
Accounting Financial
Transactions
System Reports

Cash Bank
Compliance Testing Receivables Customers
Interim Audit (Confirm balances)
Substantive Testing
Financial Statement Audit
Auditing Around the Computer
An accounting system is comprised of input,

processing, and output.
In the around-the-computer approach, the
processing portion is ignored.
Auditing through the computer may be defined as
the verification of controls in a computerized system.
Auditing with the computer is the process of
using information technology in auditing.
Control Framework
in IT Environment
Computer
Applications Application
Controls Systems and
Programs
Application
Internal
Systems
Controls
Development
Computer
General Service
Controls Center
Auditing with the Computer
What are some of the potential benefits

of using information systems technology
in an audit?
1 Computer-generated working papers are
generally more legible and consistent.
2 Time may be saved by eliminating manual
footing, cross footing, and other routine
calculations.
3 Calculations, comparisons, and other data

manipulations are more accurately performed.
4 Analytical review calculations may be more
efficiently performed.
5 Project information may be more easily
generated and analyzed.
6 Standardized audit correspondence may be

stored and easily modified.
7 Morale and productivity may be improved by
reducing the time spent on clerical tasks.
8 Increased cost-effectiveness is obtained by reusing
and extending existing electronic audit
applications to subsequent audits.
9 Increased independence from information systems
personnel is obtained.
Information Systems
Auditing Technology
Technique: Test data

Description: Test data are input containing both
valid and invalid data.
Example: Payroll transactions for fictitious
employees are processed
concurrently with valid payroll
transactions.
Information Systems
Auditing Technology
Test Data
Hypothetical
Transactions
Computer Processing
Using Master Program
Compare Auditors
Error Listing Expected
Output
Information Systems
Auditing Technology
Technique: Integrated test facility (ITF)
Description: ITF involves both the use of test
data and the creation of fictitious
records (vendors, employees) on
the master files of a computer
system.
Example: Payroll transactions for fictitious
employees are processed
concurrently with valid payroll
transactions.
Information Systems
Auditing Technology
ITF
Transactions Transactions
Computer Data Files

Application
System ITF Data
Reports Reports
Without Containing
ITF Data ITF Information
Information Systems
Auditing Technology
Technique: Parallel simulation

Description: Processing real data through audit
programs. The simulated output
and the regular output are then
compared.
Example: Depreciation calculations are
verified by processing the fixed-
asset master file with an audit
program.
Information Systems
Auditing Technology
Computer
Application Transactions
System
Parallel
Simulation
Program
Function to
Be Verified
Compare Simulation
Report
Report
Information Systems
Auditing Technology
Technique: Audit software

Description: Computer programs that permit
the computer to be used as an
auditing tool.
Example: An auditor uses a computer
program to extract data records
from a master file.
Information Systems
Auditing Technology
Technique: Generalized audit software (GAS)

Description: GAS is audit software that has
been specifically designed to allow
auditors to perform audit-related
data processing functions.
Example: An auditor uses GAS to search
computer files for unusual items.
Information Systems
Auditing Technology
Technique: PC software
Description: Software that allows the auditor to
use a PC to perform audit tasks.
Example: A PC spreadsheet package is used
to maintain audit working papers
and audit schedules.
Information Systems
Auditing Technology
Deloitte & Touche AuditSystem/2
Smart Audit
Work Support Access to
Papers Information
Document
Manager
Trial File
Balance Multilocation Interrogation
Support
MS MS MS Lotus Folio Other
Word Excel Access cc:mail ACL VIEWS Applications
Information Systems
Auditing Technology
Technique: Embedded audit routines

Description: Special auditing routines included
in regular computer programs so
that transaction data can be
subjected to audit analysis.
Example: Data items that are exceptions to
auditor-specified edit tests
included in a program are written
to a special audit file.
Information Systems
Auditing Technology
Production
Transactions
Production
Computer
Application
System
Production Embedded Audit

Reports Audit Data Reports
Collection
Module
Information Systems
Auditing Technology
Technique: Extended records

Description: Modification of programs to
collect and store data of audit
interest.
Example: A payroll program is modified to
collect data pertaining to overtime
pay.
Information Systems
Auditing Technology
Technique: Snapshot
Description: Modifications of programs to
output data of audit interest.
Example: A payroll program is modified to
output data pertaining to overtime
pay.
Information Systems
Auditing Technology
Technique: Tracing
Description: Tracing provides a detailed audit
trail of the instructions executed
during the programs operation.
Example: A payroll program is traced to
determine if certain edit tests are
performed in the correct order.
Information Systems
Auditing Technology
Technique: Review of system documentation

Description: Existing system documentation
such as program flowcharts are
reviewed for audit purposes.
Example: An auditor desk checks the
processing logic of a payroll
program.
Information Systems
Auditing Technology
Technique: Control flowcharting

Description: Analytic flowcharts or other
graphic techniques are used to
describe the controls in a system.
Example: An auditor prepares an analytic
flowchart to review controls in
the payroll application system.
Information Systems
Auditing Technology
Technique: Mapping
Description: Special software is used to monitor
the execution of a program.
Example: The execution of a program with
test data as input is mapped to
indicate how extensively the input
tested compares with individual
program statements.
General Approach to an
Information Systems Audit
Most approaches to an information systems

audit follow some variation of a three-phase
structure.
The first phase consists of an initial review
and evaluation of the area to be audited and
audit plan preparation.
The second phase is a detailed review and
evaluation of controls.
The third phase involves compliance testing

and is followed by analysis and reporting of
results.
The initial review phase determines the
course of action the audit will take.
It includes the following:
decisions concerning specific areas to be
investigated
the deployment of audit labor

the audit technology to be used
the development of time and/or cost budget
for the audit
The primary control over the conduct of an
information systems audit centers on
documentation and review of performance.
What is an audit program?

It is a detailed list of the audit procedures
to be applied on a particular audit.
Standardized audit programs for particular
audit areas have been developed and are
common in all types of auditing.
In the second general phase of the audit,

effort is focused on fact-finding in the
area(s) selected for audit.
Documentation of the application area
is reviewed.
Data concerning the operation of the system
are reviewed.
In the third phase of the audit, compliance

tests are undertaken to provide reasonable
assurance that internal controls exist and
operate as prescribed.
Information Systems Application
Audits
Application controls are divided into three

general areas.
What are these areas?
1 Input
2 Processing
3 Output
Application Systems
Development Audits
There are three general areas of audit

concern in the systems development process.
They are:
1 Systems development standards
2 Project management
3 Program change control
What are systems development standards?
Application Systems
Development Audits
Systems development standards are the

documentation governing the design,
development, and implementation of
application systems.
What is project management?
It consists of project planning and project
supervision.
Application Systems
Development Audits
What is the objective of program change controls?
It is to prevent unauthorized and potentially
fraudulent changes from being introduced into
previously tested and accepted programs.
Normally, an audit of the computer service center
is undertaken before any application audits to
ensure the general integrity of the environment in
which the application will function.

CH 16

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CH 16

Uploaded by

Copyright:

Available Formats

Chapter Auditing Information

What is auditing through the computer?

The primary objective and responsibility

Various types of professional certifications

An accounting system is comprised of input,

What are some of the potential benefits

3 Calculations, comparisons, and other data

6 Standardized audit correspondence may be

Technique: Test data

Computer Data Files

Technique: Parallel simulation

Technique: Audit software

Technique: Generalized audit software (GAS)

Technique: Embedded audit routines

Production Embedded Audit

Technique: Extended records

Technique: Review of system documentation

Technique: Control flowcharting

Most approaches to an information systems

The third phase involves compliance testing

the deployment of audit labor

What is an audit program?

In the second general phase of the audit,

In the third phase of the audit, compliance

Application controls are divided into three

There are three general areas of audit

Systems development standards are the

You might also like