Module 7: Computer auditing

(1)

Overview

In this module, you learn about the effects that computer processing has on both the

control environment and the audit of financial systems. You also learn about the approaches to auditing computerized systems and the ways to use computers for an audit.

When you have worked through the module, you should have a thorough understanding of the audit implications of a computer-based system for a company’s internal controls.

Throughout the module, you apply what you have learned to scenarios involving a company planning to computerize its accounting systems.

Assignment reminder: Assignment 2 is due this week (see the Course schedule in the course navigation). Be sure to allocate time to complete and submit the assignment by the deadline.

Test your knowledge

Begin your work on this module with a set of test-your-knowledge questions designed to help you gauge the depth of study required.

Learning objectives

7.1 Explain the major effects of computerization of accounting systems on a company’s operations and on the audit approach. (Levels 1 and 2)

7.2 Describe the major elements of audit significance in today’s computer environment. (Level 2)

7.3 Explain the audit implications of a simple computer-based system for a company’s internal control as it relates to the organizational structure and the processing of transactions. (Levels 1 and 2)

7.4 Explain the audit implications of a simple computer-based system for a company’s internal control as it relates to system access, design, backup, and data recovery. (Level 1)

7.5 Describe general controls and application controls, and explain how they relate to accounting controls. (Level 2)

7.6 Summarize the impact of EDI and the Internet on a company’s operations, including the implications of electronic commerce for the company’s internal control and for its audit. (Level 2)

7.7 Explain how an audit is conducted in a computer environment. (Level 1) 7.8 Identify the phases of auditing a computerized accounting system. (Level 1)

(2)

Module 7: Computer auditing

7.9 Identify internal control considerations in personal computer, online, and database environments. (Level 1)

7.10 Explain the difference between auditing around/without the computer and auditing through/with the computer to test internal control. (Level 1)

7.11 Explain how an auditor can use computers in conducting audits by using test data and generalized audit software. (Level 1)

7.12 Identify ways to use computers in conducting an audit. (Level 1)

(3)

7.1 Company operations and computer systems

Learning objective

● Explain the major effects of computerization of accounting systems on a company’s operations and on the audit approach. (Levels 1 and 2)

Required readings

● Chapter 7, pages 211-215 (up to Elements of an IT-Based Information System) and pages 223-225 (Level 1)

● Chapter 9, pages 314-317 (Level 1)

● CAS 315, Appendix 1 (CICA Handbook, section 5141, Appendix B), section titled Information System, Including the Related Business Processes Relevant to Financial Reporting, and Communication (Level 1)

● Reading 7-1: CGA AuG-6, "Auditing in an EDP environment," sections 1-3 (Level 2) LEVEL 1

Computerization of accounting systems has some major effects on a company’s operations. Understanding these effects will help you understand the audit implications better. Read CAS 315, Appendix 1 (CICA Handbook, section 5141, Appendix B), the section entitled "Information System, Including the Related Business Processes, Relevant to Financial

Reporting, and Communication," which provides an overview of how the client’s information system correlates between the management assertion, audit objectives, and the functions of the information system.

Scenario 7.1-1: TRP Inc.

Teresa is the Director of Finance for TRP Inc. As part of the business planning for the following year, the Chief Financial Officer (CFO) has tabled a project to computerize TRP’s accounting systems. Teresa has been assigned the task of identifying and analyzing the major effects of this project on the company’s organizational structure and data processing. As TRP Inc.’s auditor, you must help Teresa gather information for the project. What information will Teresa need to have?

Hint: Start by organizing the information into three categories:

● Effect (or impact)

● Risk

● Management responsibility

Solution

Transaction processes

Another effect of computerization is dramatic changes in the transaction processes. On pages 223 to 225, the text describes these changes and provides a general statement of the audit implication for each of the characteristics. Topic 7.3, which covers the control

(4)

7.1 Company operations and computer systems

environment in computer-based systems, looks at the implications of these characteristics in more detail.

Auditing approach

Computerization also causes changes in the approach to auditing. Read sections 1-3 of Reading 7.1-1 (CGA Auditing Guideline No. 6) for an overview of computer environment issues, and, as you read, think about how a computer environment will affect internal controls and the audit.

Scenario 7.1-2: TRP Inc.

In this topic, you learned about the impact of computerization on a company’s operations. If you were the auditor assigned to audit TRP Inc., what changes would you make in your approach to the audit?

Solution

(5)

7.2 Major elements in today's computer environment

7.2 Major elements in today

’

s computer environment

● Describe the major elements of audit significance in today’s computer environment. (Level 2)

● Chapter 7, page 215-216, Elements of an IT-Based Information System

● Reading 7-1: CGA AuG-6, "Auditing in an EDP Environment," sections 9 and 10 LEVEL 2

Be aware of major elements in today’s computer environment. You have already studied basic elements of computer-based systems in Managing Information Systems [MS1] or its equivalent.

The major elements of audit significance include microcomputers, databases, online systems, and electronic commerce, specifically Electronic Data Interchange (EDI), and the Internet. Microcomputers are explained in section 9 of CGA AuG-6 (Reading 7.1-1). Internal controls with respect to microcomputers are explained in detail in Topic 7.5. Paragraphs 10.2 to 10.4 of Reading 7.1-1 describe the features and characteristics of online systems, and paragraphs 10.5 to 10.11 outline the characteristics of database systems.

Electronic commerce is transforming the business environment and is likely to give rise to a wide range of assurance engagements for public accountants. You consider some of the audit implications of electronic commerce in Topic 7.6.

Microcomputers

Experienced auditors are concerned about their ability to keep up with the advances in information technology. Companies used to use mainframe computers and terminals only; now, many companies use computer networks.

The auditor used to be concerned about the integrity of computer programs that ran on the mainframe; now, the auditor is concerned about the proliferation of stand-alone computers and software. With this proliferation, there is a tendency to decentralize data processing. This, in turn, increases the amount of work an auditor needs to do to understand and rely on the computer controls. At one time, only programmers could change the programs used to process the company’s data. Now, each employee with access to a computer could also have access to the software that runs on that computer, and could alter it unless adequate safeguards are in place.

Database systems

Database systems store data in a central location under the control of the database

(6)

administrator. The use of centralized database management systems can result in more reliable data because there is no redundant (duplicate) data, thus removing the chance of conflicting information.

However, the database administrator typically exercises substantial power over the databases. This concentration of data and lack of segregation of duties create

significant risk. In light of this risk, the auditor must carefully review the activities of the database administrator and examine any audit trail provided by the database

management system to ensure that there are adequate compensating controls over the activities of the database administrator.

The auditor must also review the backup and recovery procedures to ensure that there is sufficient protection of databases. Because all the systems rely on the databases for accurate processing, the auditor should confirm that there is adequate internal control to ensure the integrity of the databases.

Online systems

The most common forms of online systems are real-time processing and online batch processing. The ATM you use to make withdrawals from, or deposits to, your bank account is an example of an online real-time processing system.

Access control and security of online systems

Auditors should be particularly concerned with access control and security of online systems because there may be no evidence of unauthorized access. Access issues apply to both users and programmers. A user with unauthorized access to an online accounts receivable file may, intentionally or unintentionally, wipe out the balances in individual accounts. A programmer with unauthorized access may modify the code of a program to the detriment of the company.

The security measures used to protect traditional batch systems (guards and locks) are ineffective for online systems because it may be possible to access such systems from any location using a terminal and a phone line. Auditors should carefully review the backup and recovery procedures of online systems. This is especially important

because the lack of source documents will likely make it impossible to reconstruct data files if backup is inadequate.

Control over online systems

Unlike traditional systems, online systems permit transactions to be entered directly through terminals, without requiring the use of source documents on paper. To

exercise control over online systems, management can require that transactions first be recorded on paper-based source documents and then the source documents be approved before entry into the computer system. Such paper-based source documents form the audit trail needed by the auditor.

Activity 7.2-1

What are the implications for the auditor's ability to obtain evidence if no paper-based source documents are used? What checks and control can be instituted instead of the use of source documents?

Solution

(7)

EDI (Electronic data interchange)

EDI consists of the exchange of electronic documents between two companies. Effectively, transactions and contracts are created through two interacting computer systems. EDI allows organizations with dissimilar computing environments to exchange electronic business documents without using paper.

What are the benefits of EDI?

Some obvious benefits are the elimination of paperwork, the reduction of document processing costs, access to more information on a timely basis, and increased accuracy of recordkeeping. There are some drawbacks as well, but the increasing use of EDI suggests that the benefits outweigh the costs.

How do EDI transactions affect the auditor’s work?

The implications for auditors are the loss of audit trail resulting from the paperless environment and lack of human intervention resulting in total dependence on the electronic system. These characteristics significantly increase risk, making control assurance the key objective for EDI environments. Auditors, in turn, need to monitor EDI controls throughout the period under audit, for example, through the use of software that allows tagging of transactions to trace their processing.

To control potential legal risks, businesses may require their trading partners to enter into trading partner agreements (TPAs). TPAs frequently include an obligation to report and disclose compliance with a set of specified standards of EDI control. Increasingly, auditors will be asked to provide opinions on the EDI control environment. Such audit opinions may become mandatory, which will likely encourage development of

generalized control standards and criteria. Consequently, auditors will have to be better trained in this emerging area of information technology.

(8)

7.3 Audit implications: Internal control processes

● Explain the audit implications of a simple computer-based system for a company’s internal control as it relates to the organizational structure and the processing of transactions. (Levels 1 and 2)

● Chapter 7, page 234 (Level 2)

● CAS 315.A49-.A55 (CICA Handbook, paragraphs 5141.057-.063) (Level 1) ● Reading 7-1: CGA AuG-6, "Auditing in an EDP environment," section 4 (Level 2) LEVEL 1

Internal control objectives are the same under manual systems and computer systems; however, their evaluation is different. The auditor must be aware of the differences between the two systems: certain differences may result in improved

controls, while other differences may result in reduced controls. Some differences — for example, the centralization of processing — may be a mixed blessing.

Reading 7.1-1, section 4, provides a perspective for assessing risk and internal control in a computer processing environment. The characteristics of computer-based systems are such that either new internal controls must be implemented or existing ones

modified. Read paragraph 4.2 of Reading 7.1-1 to become familiar with all the characteristics that have internal control implications. In this topic, you look at the organizational structure required to manage the computer system, the nature of transaction processing, and the effect on auditing. Review CAS 315-A49-.A55 (CICA Handbook, paragraphs 5141.057-.063), which highlight the risks and benefits of manual and automated elements of internal control relevant to the auditor’s risk assessment.

Topic 7.4 describes audit implications of computerized systems related to system access and design, and backup and recovery procedures. The guidelines deal with internal controls over computer activities; they do not describe computer processing as part of internal controls over an organization’s operations. By themselves, computer-based systems are tools; they are not policies and procedures. The following sections describe the more important implications of simple computer-based systems on internal controls.

Concentration of functions

One of the most important issues related to a computer processing system is the potential control risk associated with the concentration of functions.

Scenario 7.3-1: Segregation of duties

Your audit manager informs you that in general, implementation of computer-based systems requires new policies and procedures to ensure that proper segregation of

(9)

duties is maintained. For you, the audit implication is to ensure that appropriate controls are in place, which may include segregating the following functions:

● Data control ● Data entry

● Computer operation

● Data and programs custody

Do you agree that this is possible for traditional large systems? If so, outline the

appropriate function segregation (key players involved and their functions) in a typical computer department that will facilitate detection of errors and prevent fraudulent manipulation.

Solution 1

In general, a clear segregation of duties is a feature of traditional large systems. Can segregation of duties be applied to microcomputer systems?

Solution 2

Documentation of transactions

The use of computer systems will undoubtedly reduce the amount of physical

documentation available for the auditor. Additional controls are necessary to achieve the objectives of validity, authorization, and completeness that are traditionally supported by documentation. Documentation deficiencies can take the following forms:

● Input documentation (such as batch entry sheet or purchase invoice), which normally contains evidence of authorization and validity, does not exist.

● Audit trail documents, such as ledgers, reports, and records are not available except for machine-readable documents.

● Output documentation providing evidence of transactions, including trial balances and invoices, is not produced by the computer system.

Data may be input to a system without leaving an audit trail of transactions. For example, a customer may order goods by accessing the client’s system directly; in that case, no hard copy purchase order would exist. The internal accounting, preparation of the invoice and shipping documents, debit to accounts receivable and related credit to sales, debit to cost of goods sold and the related credit to inventory, and reduction in the inventory records for the quantities sold can be accomplished without generating hard copy documentation. The auditor must be able to confirm that the system is properly recording all of these activities. Scenario 7.3-2: TRP Inc – Automatic transactions

Teresa is the Director of Finance for TRP Inc. The Chief Financial Officer (CFO), as part of the business planning for the following year, has tabled a project to computerize TRP’s accounting systems. The various user groups within TRP Inc. have submitted their requirements. They would like to see internal accounting transactions be initiated and completed within the computer automatically. For example, a sales commission may be calculated and paid automatically by the system without human intervention. Another example is pre-authorized bill payments. The CFO likes the idea of initiating automatic transactions within the system. What comments should Teresa provide in light of controls that may be required for such transactions?

(10)

Solution

Another implication of automatic transactions in computer systems is the multiple updates to accounts that can arise from a single transaction. A single receipt-of-payment entry in a computer system can simultaneously update the cash and accounts receivable, the

customer’s account, and the credit profile of the client. The auditor should be aware of the extent to which a single transaction or entry affects accounts and other files.

Yet another risk arises in the capital markets. Worldwide, computers are instructed to initiate and complete buy and sell transactions depending on predetermined conditions, such as the price of a stock. Can you imagine the consequences if a glitch in computer systems (programs) started a chain reaction of massive selling of financial assets such as stocks and derivatives? In these circumstances, auditors should make certain that effective controls exist.

(11)

7.4 Audit implications: System access and design

● Explain the audit implications of a simple computer-based system for a company's

internal control as it relates to system access, design, backup, and data recovery. (Level 1)

Required reading

● Reading 7-1: CGA AuG-6, "Auditing in an EDP environment," section 4 (Level 2)

LEVEL 1

In a computerized environment, concentration of data and programs as well as ease of access can lead to significant risks for companies.

Unauthorized access

For example: Anyone can enter a system unless access is controlled by barriers such as passwords and validation protocols; individuals within a company may be able to

access that company’s system, or parts of it, without authorization; and "hackers" can break into any computer system.

A company may not be aware that its system has been compromised, and may be unaware of transactions made by an unauthorized person. Unauthorized access can be the result of outside operators breaking into a network, or of a company allowing unrestricted access to sensitive areas where hardware and software are kept. Because there is a higher level of centralization of data in computerized systems, unauthorized access can have catastrophic consequences.

Audit implications

The auditor must ensure that there are controls to prevent unauthorized access and that there are procedures to secure restricted or sensitive areas throughout the organization. Such controls include, but are not limited to, the following:

● Password controls

● Physical restrictions to computer equipment

● Activity logs regarding all access and attempted access to data files or programs

System design

Properly designed systems enable data to be processed consistently and correctly with little human intervention. However, computer systems may produce errors that a human would never make and, usually, the fault is in the system. With manual processing, we usually recognize absurd transactions and correct them; unless programmed to do so, computer systems do not.

(12)

7.4 Audit implications: System access and design

Example 7.4-1: Design requirements

A customer bought some furniture polish from the furniture department of a large department store on his store credit card. The computer system was programmed to perform a limit check on each transaction, but the limits were quite high because furniture tends to have a high unit price. The clerk erroneously punched in the product code as the price, and the sale for the bottle of furniture polish was recorded at $2,045. Neither the clerk nor the customer noticed the error.

Several days later, the customer tried to use his store credit card again and was told that he had exceeded his credit limit, which was $2,000. This mistake would have been avoided if the sales clerk had manually recorded the sale on an invoice.

Control procedures can be embedded in computer programs to avoid these types of errors, and the auditor should ensure that such control procedures are in place. In the case of the pricing error for furniture polish, what could have been included as part of the design requirements to prevent or reduce such errors?

Solution

Auditors should offer their expertise to clients in the design and implementation of new computer systems. Information system designers design computer systems for efficiency and effectiveness. They are not as concerned with controls as auditors and management are, and may omit important internal controls such as a test of the reasonableness of a price (as opposed to the arithmetic accuracy) on an invoice.

Vulnerability of hardware, software, and data files

What happens if there is a fire? Computer systems tend to centralize programs and data. In case of fire, files and computers may be destroyed. If it is not possible to reconstruct the information files from another source, the company could be in serious difficulties. From an audit standpoint, there may even be a denial of opinion, because nothing can be verified without proper access to records.

Internal controls must be in place to make sure that data can be recovered in case of an accident. The auditor would have to ensure that there are policies and procedures to back up and recover data, as well as adequate insurance coverage for business interruption and for replacement of hardware that is destroyed or stolen.

(13)

7.5 General controls and application controls

● Describe general controls and application controls, and explain how they relate to accounting controls. (Level 2)

● Chapter 7, pages 226-228 and 235-246 (up to Review checkpoints)

● CAS 315.21 and CAS 315.A91-.A93 (CICA Handbook, paragraph 5141.093) ● Reading 7-1: CGA AuG-6, "Auditing in an EDP environment," section 4 LEVEL 2

Technology and technological changes can present risk to a business in different ways. CAS 315.21 requires that the auditor obtain an understanding of how the entity has responded to risks arising from its use of IT. Section 4 of Reading 7.1-1 defines general and application controls in paragraphs 4.5 and 4.6. General controls and application controls are also described on pages 235 to 245 of the text.

The control hierarchy diagram in the following exhibit illustrates how computer controls, including their general and application controls components, fit into the overall internal control framework of the organization.

Exhibit 7.5-1: Control hierarchy diagram

(14)

General controls

A general control applies to overall computer processing activities (for example, controls over systems development and maintenance, operations, and backup), while an application control is specific to one or more accounting applications (for

example, controls over authorizing, recording, and processing of payroll or sales transactions).

General controls are an extension to computer controls of the control environment concept covered in Module 5. Like the control environment, general controls are mostly preventive in nature and apply to all parts of the computer systems. The boxes on text pages 235 and 237 illustrate some general controls that auditors should consider.

The general control procedures establish a structure of control over the management and operation of information systems rather than the specific systems themselves. Activity 7.5-1

General controls include documentation and system development controls. Why are these controls ultimately related to the accurate processing of data and viewed as preventive in nature?

(15)

Solution 1

The general control procedures of backup, file security, and file retention are

described on pages 238-240 of the text. Backup controls are one of the most important general controls, not only for audit planning purposes, but also possibly for accounting disclosure purposes. Why is this so?

Solution 2

Management and the auditor should be equally concerned that backup control objectives are met.

Application controls: Reasonableness check

Application controls are needed to replace the loss of human review that normally exists in a manual system. The lists on text pages 243 and 244 illustrate typical

application controls organized by input, processing, and output controls. Note that the application controls are often embedded in the software used by the client. The boxes on pages 243 and 244 illustrate important input, processing, and output controls that the auditor should consider for each application.

Scenario 7.5-1: TRP Inc - Application controls

Teresa, Director of Finance for TRP Inc., met with Mario, TRP’s Payroll Manager. Mario indicated that in the current manual system, a payroll clerk was able to instantly

recognize that 1,000 hours recorded for a single employee during a one-week period is physically impossible. Mario would like to know how this error could be detected if the same processing were done by computer. What do you think Teresa’s answer would be?

Solution

Understanding internal control in a computer environment

The auditor’s objective of understanding internal control and assessing control risk is the same for a computer system as for a manual system. The auditor wants to

determine how much reliance can be placed on internal control, given audit risk and inherent risk, and thus how much evidence must be obtained from the tests of details of balances. If the computer system is very complex, the auditor may need the

assistance of a computer audit specialist.

Scenario 7.5-2: TRP Inc – Conversion to computer

TRP Inc. is planning to change from a manual accounting system to a computer

system. Having regard for the fact that the auditor’s objective of understanding internal control and assessing control risk is the same for the computer system as for a manual system, what special audit considerations would likely be triggered in a conversion?

Solution

(16)

7.6 Audit implications of electronic commerce

● Summarize the impact of EDI and the Internet on a company’s operations,

including the implications of electronic commerce for the company’s internal control and for its audit. (Level 2)

● Chapter 9, pages 339-343 LEVEL 2

The Internet, or World Wide Web, is rapidly evolving in a variety of ways as a major force in commerce. This affects the auditor in the following ways:

● The Internet provides a vast source of information auditors can use in the course of their work. This information includes real-time access to financial indicators, clients’

public documents, news, and quotes.

● Companies can conduct some or all of their business through the Internet. Therefore, there is an anticipated need to provide customized assurance services for these

companies.

● A company’s Internet website is an open door into the company’s network systems. Therefore, security problems may arise unless proper controls are put in place.

Website security

In October 1997, the AICPA and CICA announced a joint program of developing and

promoting assurance services for websites on the Internet. The most immediate impact on business is the creation of business websites. It is becoming commonplace for businesses to create an Internet presence through a website. Most websites started as information

sources about the company by converting existing brochures and other documents into an online format.

Business websites are rapidly becoming more promotional in nature and an important new marketing tool in an increasingly "wired" society (more people have convenient access to the Internet). Websites are proving to be a major link to customers and suppliers, with the result that companies are using websites to make sales and purchases, to help in the design of products and marketing strategy, and to distribute and share financial and other

information. More and more websites are turning into the major outlet or "store front" for companies as electronic commerce (transactions over the Internet or other networks) increases in popularity.

Securing sales transactions

Security technologies and strategies should be familiar to you from Managing Information Systems [MS1] or equivalent. Other important security technologies include

(17)

7.6 Audit implications of electronic commerce

● digital certificates for authentication and non-repudiation

● secure sockets layer (SSL) and Secure Hypertext Transfer Protocol (S-HTTP) for privacy

● access control lists for authentication, and

● firewalls, a part of organization’s overall security plan. Activity 7.6-1

Electronic commerce introduces a new set of concerns for companies such as designing and positioning a site to attract customers, making sales and purchase transactions secure, and ensuring customer privacy. What are some of the control features an auditor should be looking for in order to address these concerns? Highlight both technological controls as well as organizational controls.

Solution

(18)

7.7 Auditing computerized systems — General considerations

7.7 Auditing computerized systems

—

General considerations

● Explain how an audit is conducted in a computer environment. (Level 1) LEVEL 1

Regardless of whether an entity operates a manual system, a computer system, or a combined manual and computer system, the auditor should comply with GAAS in GAAS audits. Accordingly, the auditor may complete the audit in a computer environment (or combined computer and manual environment) along the following lines.

Complying with GAAS examination standards

First examination standard of GAAS: As part of using sufficient knowledge of the entity’s business to plan the audit, the auditor should obtain an understanding of the computer processing configuration, the method of processing and related matters, in order to assess inherent risk in connection with planning the audit. For instance, the auditor will consider the impact of computer processing in determining the nature, timing, and extent of auditing procedures.

Second examination standard of GAAS: The auditor would obtain a sufficient understanding of general controls (control environment factors) pertaining to accounting systems applications that are significant to the audit. This can be done through questionnaires, enquiry, and prior-year working papers. Also, the auditor should obtain an understanding of the application controls over input, processing, and output (control systems) relating to major transaction classes and account balances that are significant to the audit. This can be done through a review of systems documentation, for example.

Based on the understanding of the computer processing system and related manual internal control policies, and procedures with respect to specific assertions at the account balance or classes of transactions level, the auditor would assess, on a preliminary basis, control risk at/near maximum or below maximum level, and use a substantive approach or a combined approach accordingly. When using a combined approach, the auditor would perform tests of controls on those internal control policies and procedures (covering both manual and computer systems) that enhance the

reliability of data and information. In this regard, the auditor may use a computer for performing tests of controls or dual-purpose procedures.

Based on tests of controls, the auditor would finalize control risk for specific assertions at the account balance or class of transactions level, and determine the nature, timing, and extent of substantive procedures in light of materiality and inherent risk. Some of these procedures could be performed using computers, and others performed manually. Third examination standard of GAAS: The auditor would perform the substantive procedures determined previously for gathering sufficient appropriate audit evidence for specific assertions at the account balance and transactions level. In this regard, the auditor may consider using generalized audit software packages where appropriate.

(19)

7.8 General strategy in auditing computerized systems

● Identify the phases of auditing a computerized accounting system. (Level 1)

● Chapter 9, pages 314-317

● CAS 315.A77-.A82 (CICA Handbook, paragraphs 5141.080-.089)

● Reading 7-1: CGA AuG-6, "Auditing in an EDP environment," section 5 LEVEL 1

Reading 7-1 section 5 describes audit planning considerations in a computer environment. Guidance on obtaining understanding of the accounting information system and the nature of the internal control procedures is given in CAS 315-A77-.A82 (CICA Handbook, paragraphs 5141.080-.089). The steps in evaluating computer

processing controls can be summarized as follows.

1. Preliminary evaluation of internal control

Activity 7.8-1

Auditors should conduct a preliminary evaluation of the general and application controls that may be effective and efficient for performing the audit. The general controls may have a pervasive effect on the processing of transactions in applications systems. If these controls are not effective, the risk is that errors might occur and go undetected in the application system. Weaknesses in general controls may make certain application controls unreliable. However, manual procedures exercised by the users may provide effective compensating control at the application level. Can you identify a

compensating control?

Solution 1

What compensating control might the auditor look for when concluding that there are weaknesses in general or application controls that preclude reliance on those controls?

Solution 2

2. Test of controls procedures

The purpose of the auditors’ test of controls procedures and final evaluation is to determine that the controls that they intend to rely on were functioning effectively throughout the period of intended reliance and that they can be relied on as planned in the preliminary evaluation. In a computer environment, the objectives of test of

controls procedures do not change from those in a manual environment; however, some audit procedures may change. In addition to enquiry, observation, and sampling

(20)

7.8 General strategy in auditing computerized systems

procedures, the auditor may find it necessary, or may prefer, to use computer-assisted audit techniques (CAATs).

3. Final evaluation

If the auditor obtains evidence that the controls were not operating as designed, or the test of controls procedures indicate that the general controls do not provide reasonable assurance that the application controls functioned during the period of reliance, the auditor’s final evaluation may be to discontinue the planned reliance. Instead, the auditor may seek to accomplish the audit objectives through the application of more extensive substantive procedures.

(21)

7.9 Internal control considerations in personal computer, online, and database environments

7.9 Internal control considerations in personal computer,

online, and database environments

● Identify internal control considerations in personal computer, online, and database environments. (Level 1)

● Chapter 7, pages 246-249

● Reading 7-1: CGA AuG-6, "Auditing in an EDP environment," sections 9 and 10 (paragraphs 10.1 to 10.11)

LEVEL 1

Text pages 246 to 249 and AuG-6 section 9 provide an overview of the audit considerations in a personal computer environment.

Personal computers

The control environment for stand-alone microcomputers is generally weak because of a lack of

● segregation of duties

● physical security of the microcomputer and its files

● computer knowledge

● reliable hardware and software, and

● documentation for software and software changes.

Typically, there are no application controls (such as use of batch totals or passwords) in small systems. In a typical microcomputer environment, it may not be easy to distinguish between general controls and application controls. Frequently, it may not be practicable or cost-effective for management to implement sufficient controls to reduce risks of

undetected errors to a minimum level.

The auditor may often assume the control risk is high in such systems. Nevertheless, the auditor may be able to rely on owner/manager controls to compensate for the poor control environment.

Online and database systems

Paragraphs 10.1 to 10.11 in Reading 7.1-1 outline the internal control considerations for online and database systems.

(22)

7.10 Approaches to auditing computerized systems

● Explain the difference between auditing around/without the computer and auditing through/with the computer to test internal control. (Level 1)

● Chapter 9, pages 348-349 (up to Review Checkpoints)

LEVEL 1

There are two terms to describe the methods of auditing computerized systems — auditing around

the computer and auditing through the computer. Auditing around the computer

When auditing around the computer, no attempt is made to evaluate the internal processes of the computer. This method of bypassing the computer, or treating it like a "black box," consists of vouching or tracing to and from source documents and outputs. Exhibit 9-14 on page 348 illustrates this process of manually processing sample documents and comparing those results to the same

documents processed by the client’s system.

Auditing through the computer

This approach consists of auditing the computer processing system or data produced by the system to determine how much reliance can be placed on the various internal controls programmed into the system. Exhibit 7.10-1 summarizes the two approaches.

Exhibit 7.10-1: Auditing around the computer and through the computer

Auditing around the computer Auditing through the

computer

How is it done? No attempt is made to evaluate the

internal processes of the computer. Consists of vouching or tracing to and from source documents and outputs.

Auditing the computer processing system or data produced by the system to test the programmed controls.

Advantage(s) ● Simplicity — does not

require computer-proficient personnel.

● May be more cost effective.

Sophisticated method and may be the only method if significant parts of the internal controls are embedded in the computer system.

(23)

7.10 Approaches to auditing computerized systems

What are the "ideal"

conditions for each? Requires sufficient audit trail of visible evidence. This method must be used if any one of the following exists:

● The presence of large volumes of input/output means that direct

examination of the records is difficult.

● Lack of visible audit trail means that significant parts of the internal controls are embedded in the computer system.

● System is complex and includes key parts of the accounting system.

Approaches Bypasses the computer (auditing

without the computer). Two main approaches

1. Test data

2. Parallel simulation

(24)

7.11 Approaches to auditing through the computer

● Explain how an auditor can use computers in conducting audits by using test data and generalized audit software. (Level 1)

● Chapter 9, pages 349-357, Exhibits 9-15 and 9-16 on pages 351 and 352 ● Reading 7-1: CGA AuG-6, "Auditing in an EDP environment," section 6 LEVEL 1

There are several approaches to auditing through the computer. The text describes two of these approaches to "auditing with the computer" to test a company’s programmed controls:

● Test data approach

● Auditor’s computer program approach, including generalized audit software (GAS) Each approach has its particular strengths and weaknesses and may be used alone or in combination. As clients’ computer systems perform more and more of the accounting

functions, the audit trail becomes less visible. If the audit trail is non-existent, the auditor is forced to audit through the computer using one of the two approaches described. Exhibit 7.11-1 compares the two approaches.

Exhibit 7.11-1: Test data and parallel simulation approaches

Test data approach Parallel simulation approach

Strengths Uses the uniformity

principle (once a computer is programmed to handle transactions in a certain logical way, it will handle every transaction in a similar fashion).

The auditor’s own programs can be tailored to the

client’s system.

(25)

7.11 Approaches to auditing through the computer

Weaknesses A computer system may

contain errors that offset each other, providing output that appears to be correct. Without examining the internal processing logic of the computer systems, the auditor can only "prove" that the computer system works correctly with the test data used. The auditor has no means to confirm that the computer system will correctly handle

transactions not included in the test data.

The programs may be costly to develop and modify. Generalized audit software (GAS) makes the parallel simulation approach more attractive. GAS contains prepackaged subroutines that can perform most tasks needed in auditing and business applications.

The test data approach involves developing simulated data that are processed using the client’s actual computer program (or more likely a copy thereof), and then comparing the output to predetermined results.

When using the test data approach, the auditor must ascertain that the computer system being tested is the same one the client used to process data for the entire period under review, and that none of the test data has contaminated the client’s records and files. Because of the high risks of not detecting system errors in complex systems, the test data approach is not the best approach to use in auditing such systems.

Generalized audit software (GAS)

Parallel simulation consists of processing client data using the auditor’s program and comparing the result to the output of the same data processed by the client’s program. This process can be performed by GAS.

Exhibit 9-16 on page 352 illustrates how an auditor would use developed software as a parallel simulation. Some larger firms develop software for the audit of specific clients (for example, life insurance companies).

GAS has the advantages of being relatively easy to use and widely applicable. GAS can be used to process a variety of files in different formats or media to perform a number of functions, such as sampling, calculating totals and subtotals, selecting specific records, and so on. Text page 354 lists a number of techniques (with excellent examples) that the

auditor can perform if the client’s data are in machine-readable form.

Reading 7.1-1, CGA AuG-6 section 6, Computer-assisted audit techniques (CAATs), explains the uses of CAATs.

(26)

7.12 Computer-aided auditing

● Identify ways to use computers in conducting an audit. (Level 1)

● Chapter 9, pages 357-358 LEVEL 1

On pages 357 to 358, the text describes several ways to use computers for an audit. The future of computers in auditing is firmly established because of their small size yet large computing power. Hardware is being developed that is more powerful yet more compact, such as laptop and notebook computers. The development of software to support the new hardware is keeping pace. Many public accounting firms provide staff with computers; laptop and notebook computers are becoming as ubiquitous as the auditor’s briefcase.

This exciting area of audit practice creates new opportunities as well as risks. The CICA study "Assurance Engagement Working Paper" (1997) provides a good analysis of the issues. For example, industry information and information on comparable companies can be obtained on the Internet as a means to improve the auditor’s knowledge of the business and in performing analytical procedures. Only a lack of creativity prevents the auditor from maximizing the potential of the Internet.

Here are some highlights of the software programs and aids available to auditors.

Commercial general use software — Spreadsheet programs such as Microsoft Excel or Lotus 1-2-3 can be used for analysis or for sampling (see Computer activity 6.11-1 in Topic 6.11). Word-processing programs such as Microsoft Word or WordPerfect are useful for drafting statements or preparing reports and letters.

Pre-built spreadsheet templates — Auditors often use pre-built spreadsheet templates (for example, model working papers and financial statements).

Special use software — Some academics and public accountants see the

development of expert systems as one of the next major developments in auditing. The work on expert systems is slow and very expensive. There are some applications in auditing — one application developed in the United States by KPMG LLP can be used to assess the collectibility of bank loans. Expert systems are being developed for audit planning and for assessing EDP controls.

Custom programs — These special programs are written by auditors to audit specific areas. For example, one large accounting firm uses custom programs to audit policy reserves of casualty insurance companies.

Working paper software — Almost all public accounting firms now use working paper software developed either in-house or purchased from an outside vendor (for example,

(27)

7.12 Computer-aided auditing

CaseWare). The purchased software may be modified with specialized templates or electronic forms to prepare working papers and letters such as confirmations,

engagement, and management letters. The main purpose of working paper software is to automate calculations such as footings and extensions, as well as to perform the carryforward functions such as updating from journal entries and worksheets to working papers, lead sheets, trial balances, and financial statements.

Networked files — Adopting technological advances allows several auditors to work independently on different sections of the audit on their laptop computers hooked up to a network. The network continually integrates their work with a master working paper file and keeps working paper references and indexing up-to-date.

Team members in different locations can coordinate their work by sending each other copies of their portion of the audit file, while supervisors can monitor progress and provide feedback without being physically present at the audit location(s). This alternative provides great flexibility in organizing the team’s work.

Standardized document templates — The use of standardized templates provides a common starting point for all documents. A database of templates can be useful in customizing documents such as internal control questionnaires, audit programs, and sample letters. Links can also be established to other databases or even to websites so that data or information from these sources can be cross-referenced or transferred to the working papers. Thus, not only various staff but also various sources of information can be integrated to support the auditor’s opinion. Of course, to obtain such

efficiencies, the audit firms would need to invest in hardware, software, and training of staff.

(28)

E-106 (1)

May 2008

Auditing Guideline No. 6

Auditing in an EDP environment

TABLE OF CONTENTS

PAGE

1. Introduction 2

2. Objectives 2

3. Skills and competence 2

4. Internal controls in an EDP environment 3

5. Audit planning 4

6. Computer-assisted audit techniques (CAATs) 5

7. Reliance on evidence obtained from other professionals 6

8. Evaluate potential for fraud 6

9. Auditing microcomputers 7

10. Special topics in EDP auditing 9

(29)

E-106 (2)

May 2008

1. Introduction

1.1 International Standards on Auditing and Related ServicesISA 200, “Objective and General Principles Governing an Audit of Financial Statements”, published by IFAC, states that the objective of an audit of financial statements is to “express an opinion whether the financial statements are prepared, in all material respects, in accordance with an identified financial reporting framework. ”

1.2 The overall objective and scope of an audit does not change in an electronic data processing (EDP) environment. However, an EDP environment may significantly affect the processing and storage of financial information and related internal controls. Accordingly, the nature, timing and extent of the audit procedures may be affected.

1.3 In the context of CGA-Canada Auditing Guidelines, an EDP environment exists when a computer of any type or size is involved in the processing of financial information which is of significance to the audit, whether that computer is operated by the entity or by a third party. The EDP environment comprises computer hardware, software, manual procedures, and related support resources and services.

1.4 To determine the significance of the effect of the EDP environment on the audit, the auditors should assess the impact of the EDP environment on the operations of the client. The significance depends on the complexity and pervasiveness of the EDP operations. In other words, the more complex the EDP applications are, and the more pervasive the EDP environment is to the day-to-day operations of the client, the more dominant the EDP environment will be. Consequently, the EDP environment will have a greater impact on the audit.

1.5 In general, an EDP environment will affect the application of both tests of control and substantive procedures in several ways. First, changes may have to be made in the audit techniques due to the possible absence of input and output documents, the lack of a visible audit trail and the possible weakening in the internal control system. Second, the timing of audit procedures may be affected, because data may not be retained in computer files for an indefinite time. Third, the effectiveness and efficiency of audit procedures may be improved by the use of computer-assisted audit techniques.

The overall objective and scope of an audit does not change in an EDP environment. However, the nature, timing and extent of the audit procedures may be affected, depending on the impact of the EDP environment on the operations of the business, especially the processing of financial information.

2. Objectives

2.1 The objective of this Guideline is to provide auditors in an EDP environment with the additional guidance necessary to attain the overall audit objective. At the same time, it will assist the auditors to conform with Canadian generally accepted auditing standards (Canadian GAAS) and the CGA-Canada Code of Ethical Principles and Rules of Conduct

(CEPROC). This Guideline will assist auditors in determining how to plan for an audit in an EDP environment, what skills and competence are required, and when to use computer-assisted audit techniques (CAATs). Guidance for auditing microcomputers, on-line systems, databases, and computer service bureaus is also provided.

3. Skills and competence

3.1 The skills required when auditing in an EDP environment include a knowledge of computer hardware, software and processing systems. The level of knowledge will depend on the nature of the computerized accounting system. However, as a minimum, it should be at a level required to manage the internal controls of the particular EDP environment.

3.2 Auditors must understand how EDP affects the study and evaluation of internal controls and the application of auditing procedures, including the use of CAATs.

(30)

E-106 (3)

May 2008

3.3 Auditors must have sufficient understanding of the EDP environment to plan the audit. Auditors must also have sufficient knowledge of EDP to implement the auditing procedures; alternatively, they should involve other professionals who possess the required skills to assist in applying auditing procedures. Where the audit involves other professionals, the auditors continue to be responsible for forming and expressing an opinion on the financial statements.

Auditors must have:

• sufficient understanding of the EDP, environment to plan the audit,

• sufficient knowledge of EDP to implement the auditing procedures,

• sufficient skills to competently evaluate the results.

4. Internal controls in an EDP environment

4.1 Internal controls comprise the plan of organization and all the coordinated systems established by the management of an entity to assist in achieving management’s objective of ensuring the orderly and efficient conduct of the business. The auditors should, as a first step, gain and document an understanding of the overall control environment and flow of transactions. If the auditors plan to assess control risk at less than maximum, they should also review, test and document the relevant control systems.

4.2 The auditors should understand and consider those characteristics of the EDP environment that may have an impact on the control environment, the accounting system and related control systems. Such characteristics may include:

• concentration of functions and knowledge,

• absence of visible audit trail,

• absence of input and output documents,

• existence of, and control over, system generated transactions,

• built-in control procedures within computer programs,

• concentration of data and computer programs,

• vulnerability of storage media,

• increased exposure to fraud, or

• internal audit staff’s knowledge of EDP systems.

4.3 The auditors must be aware of the areas of concern and changes in risk due to the EDP environment. Some potential areas of risk include:

• the absence of a visible audit trail,

• system-generated transactions,

• the existence of proper internal controls and their classification,

• the competence of management with respect to the EDP environment,

• the pervasiveness and the complexity of the EDP environment,

• conversion from manual procedures to EDP procedures,

• conversion from one EDP application to another,

• data access controls,

• unwarranted reliance on computer-generated information,

• segregation of incompatible functions, or

• security and backup procedures.

4.4 The auditors should understand what impact the EDP environment has on the internal controls of the entity. The internal controls in the EDP environment include both the manual procedures and computer procedures, such as controls built into computer programs. Two types of internal controls can be identified. General EDP controls are concerned with overall controls over the EDP function. EDP application controls are concerned with specific controls over the computerized accounting applications.

4.5 General EDP controls establish a structure of control over the management and operation of the EDP function. Such controls may include:

• organization and management controls,

(31)

E-106 (4)

May 2008

• computer operation controls,

• systems software controls,

• program and data access controls,

• physical security, or

• backup and recovery controls.

General EDP controls will affect the auditor’s assessment of the control environment. 4.6 EDP application controls establish specific controls over the accounting applications, in

order to ensure that all transactions are authorized, recorded and processed completely, accurately and on a timely basis. EDP application controls include input/output controls, and processing controls.

4.7 Auditors should understand the inherent limitations of internal controls in an EDP environment. These limitations include human error, exposure to collusion due to concentration of functions and knowledge, varying efficiency with changes in EDP staff, and lack of sufficient controls because of the cost involved.

Auditors should understand the inherent limitations of internal controls in an EDP environment.

5. Audit planning

5.1 The audit engagement should be planned in accordance with the guidelines provided in CGA-Canada Auditing Guideline No. 3, “Audit Planning and Control.” [E-103] “Planning the Audit” in Volume II of the CGA-Canada Public Practice Manual also provides guidance for audit planning. In addition, auditors should consider special audit procedures required in an EDP environment.

5.2 Special plans should be set up for first engagements. These plans include procedures to gather information on the EDP environment that is relevant to the audit plan, including:

• the organization of the EDP function,

• the extent of concentration of functions and knowledge,

• the computer hardware and software configurations,

• the major applications which are computerized and which affect the financial information,

• planned implementation of new applications, revisions to existing applications, or applications currently under development,

• the policies guiding the EDP function, and

• the competence of management with respect to the EDP environment. Information should be gathered on the EDP environment relevant to the audit.

5.3 There are many ways to gather such information. A very effective technique is the use of a general review questionnaire. A sample is provided in [Exhibit 6-1]. It comprises two sections: part 1 is a general review of internal controls, while part 2 is a more detailed examination of potential applications that can be served by the EDP department. This latter part would serve to document whether the application in question is present in the EDP environment of the firm. If it is present, then the auditors can formulate the investigation knowing that it will be necessary to review these applications.

5.4 If the audit is a repeat engagement, the previously obtained information on the EDP environment must be updated to reflect all changes which have occurred since the last audit. 5.5 If there has been a changeover to an EDP environment, or significant changes have occurred

within the EDP environment, the auditors should:

• review the documentation relating to the changeover process and ensure that the controls over the process were adequate, and

(32)

E-106 (5)

May 2008

• where appropriate, attend, or have a specialist attend, all, or a portion, of the implementation or the changeover, to ensure that all procedures are followed, and all data has been transferred.

5.6 When the auditors have an expectation that the controls operate effectively, they should include procedures in the overall audit plan to identify relevant EDP controls and to test the reliability of such controls. The use of an EDP internal control checklist, such as [Exhibit 6-2], should be considered.

5.7 The auditors must determine how, when and where the EDP function will be reviewed. Based on this information, the auditors must assess the level of EDP expertise required to carry out the audit plan, and determine whether the necessary technical skills are available. The auditors may use independent EDP professionals to augment the technical skills of the audit team.

5.8 The auditors must obtain an overall understanding of the internal control structure in an EDP environment as part of the audit planning. If the auditors have an expectation that the controls operate effectively, they should review and evaluate the relevant general EDP controls and EDP application controls. Where such controls are found to be materially deficient, the level of control risk should not be reduced. Instead, other methods should be undertaken to accomplish the audit objectives.

5.9 The audit plan must include procedures to obtain sufficient and appropriate audit evidence. An EDP environment may affect the existence and nature of the audit evidence. The timing of procedures to obtain audit evidence may be affected inasmuch as data may not be retained in computer files for a sufficient length of time for audit use. The auditors may have to make special arrangements to retain the needed audit evidence, or time the audit procedures to examine the audit evidence when it is available.

5.10 The use of CAATs should be considered. Such techniques may improve the effectiveness and efficiency of auditing procedures.

Audit plans must consider the:

• the control environment in the EDP area,

• level of EDP expertise required,

• changes that have occurred in the EDP environment,

• need for involvement of EDP professionals,

• nature, timing and extent of audit evidence,

• use of CAATs.

6. Computer-assisted audit techniques (CAATs)

6.1 CAATs involve the use of computer programs and data to assist in the auditing procedures. Some examples of CAATs are:

• recalculating data,

• test of internal controls,

• testing of extensions and footings,

• analytical review procedures,

• statistical selection of random and/or key audit samples,

• selection and printing of confirmations, and

• summarizing of data.

6.2 CAATs can be broadly classified into two groups: those which are used to review systems controls, and those which are used to review production data. The first group includes test data methods, integrated test facilities, automated program logic analyzers, and code comparison programs. The second group includes techniques to examine, retrieve, manipulate, and report on actual production data. Refer to the Appendix for a description of some of the more common CAATs available to the auditor.

6.3 CAATs may be used during tests of control and substantive procedures, such as:

(33)

E-106 (6)

May 2008

• analytical review procedures,

• tests of EDP application controls,

• financial analyses, and

• statistical sampling.

6.4 Factors affecting the use of CAATs include:

• the level of computer expertise of the audit team,

• the availability of suitable computer facilities,

• the effectiveness and efficiency of alternative means of testing,

• the availability of, and access to, data, and

• the cost-benefit involved.

The auditors should be aware of the potential benefits of using CAATs, such as improved efficiency of some audit procedures, and savings in audit costs/time.

6.5 The use of CAATs may be required when:

• a visible audit trail is lacking, thereby precluding the auditor from tracing transactions through the computerized system manually,

• data is stored in the computer and manual means of examining the data is unfeasible or uneconomical, and

• input and output documents are not available (e.g., system-generated transactions). Computer-assisted audit techniques (CAATs) should be considered when:

• cost savings can be achieved, and

• there are no other means of performing the audit procedures.

7. Reliance on evidence obtained fromother professionals

7.1 When auditing in an EDP environment, the auditors may decide to engage the services of an EDP professional to assist in the audit. The auditors should be satisfied with the technical qualifications of the EDP professional when it is planned to use that professional’s work as audit evidence. The auditors should consider the professional certification, licence or other evidence of the competence of the EDP professional. Other relevant considerations include the EDP professional’s experience, reputation, and membership in an appropriate professional body.

When an EDP professional is engaged to assist in the audit, the auditors should be satisfied that the EDP professional is qualified to carry out the audit procedures.

7.2 Additional guidance for the reliance on evidence obtained from other professionals can be found in the ISA 620 entitled “Using the Work of an Expert.”

8. Evaluate potential for fraud

8.1 An EDP environment provides easy access to data for those who have legitimate purposes. However, such access may also be used to perpetrate fraud. Because vital operating information is often stored on the computer, computer fraud can be a major threat to the entity. The auditors should assess the risk of material misstatements in the financial statements due to fraud and/or embezzlement.

8.2 Control weaknesses which may indicate the potential for fraud include:

• inadequate control over systems development and computer operations,

• inadequate segregation of jobs requiring technical knowledge,

• inadequate segregation of record-keeping duties from physical operations and custodianship over assets, and