Copyright © 2014 Pearson Education Chapter 12 Implications of Information Technology for the Audit Process

Copyright © 2014 Pearson Education

Chapter 12

Implications of Information

Technology for the Audit Process

Chapter 12

Implications of Information

Technology for the Audit Process

Copyright © 2014 Pearson Education12-2

Describe how IT improves internal control.

Identify risks to accounting systems specific to IT.

Explain how general controls and application controls reduce IT risks.

Describe how general controls affect the auditor’s testing of application controls.


Use test data, parallel simulation, and embedded audit module approaches to test automated controls.

Identify issues for e-commerce systems and other specialized IT systems.


Describe how IT improves internal control.

12-4

11


Computer controls replace manual

controls

Higher-quality information is

available


Identify risks to accounting systems specific to IT.

12-6

22


Risks to hardware and data

Reduced audit trail

Need for IT experience andseparation of IT duties


Reliance on hardware and

software

Unauthorized access

Data loss

Systematic vs.

random errors


Visibility of audit trail

Lack of traditional

authorization

Reduced human

involvement

Detection risk


Reduced separation of duties

Need for IT experience


Explain how general controls and application controls reduce IT risks.

12-11

33


Information technology controls

Application controls

General controls




The perceived importance of IT within anorganization is often dictated by the attitude ofthe board of directors and senior management.



Typical teststrategies

Pilot testing Parallel testing


Online Controls: User ID control Password control Separate add-on

security softwarePhysical Controls: Keypad entrances Badge-entry systems Security cameras Security personnel


Offsite storage of critical files is a key element to a backup and contingency plan


These controls are built into computerequipment by the manufacturer todetect and report equipment failures.


Application controls are designed for each software application

Input controls

Output controls

Processing controls


These controls are designed by anorganization to ensure that theinformation being processed isauthorized, accurate, and complete.


Financial total

Hash total

Record count

Total for all records in a batch

Total of codes from all batch

records

Total of records in a batch


Validation test

Sequence test

Arithmetic accuracy test

Data reasonableness test

Completeness test

Correct file, database, or program?

Correct processing order?

Accuracy of processed data?

Data exceeds preset amounts?

Completeness of record fields?


These controls focus on detecting errorsafter processing is completed ratherthan on preventing errors.


Describe how general controls affect the auditor’s testing of application controls.

12-26

44


Effects of general controls on system-wide applications

Effects of general controls on software changes

Obtaining an understanding of client general controls

Relating IT controls to transaction-related audit objectives Effect of IT controls on substantive testing


LESS

MORE

Audit around the computer

Smaller companies

IT controls < effective

Audit through the computer

Parallel simulation

Test data



Use test data, parallel simulation, and embedded audit module approaches to test

automated controls.

12-30

55


1. Test data should include all relevantconditions that the auditor wants tested.

2. Application programs tested by theauditors’ test data must be the same asthose the client used throughout the year.

3. Test data must be eliminated from theclient’s records.


Input testtransactions to test

key controlprocedures

Application programs(assume batch system)

Control testresults

Transaction files(contaminated?)

Contaminatedmaster files

Master files


Control testresults

Auditor makescomparisons

Differences betweenactual outcome and

predicted result

Auditor-predicted resultsof key control procedures

based on an understandingof internal control


The auditor uses auditor-controlled softwareto perform parallel operations to the client’ssoftware by using the same data files.


Productiontransactions

Auditor-preparedprogram

Auditorresults

Auditor makes comparisons betweenclient’s application system output andthe auditor-prepared program output

Masterfile

Client applicationsystem programs

Clientresults

Exception reportnoting differences


Auditor inserts an audit module in theclient’s application system to identifyspecific types of transactions.



Identify issues for e-commerce systems and other specialized IT systems.

12-38

66


Network Environments

Outsourced IT

Database Management

Systems

e-Commerce systems



Copyright

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Printed in the United States of America.

12-41

Documents

Copyright © 2014 Pearson Education Chapter 12 Implications of Information Technology for the Audit Process