Conducting an Information Systems Audit Chapter 2
Dealing with Complexity The Nature of Controls Preventive control Detective control Corrective control Dealing with Complexity Given the purposes of the IS audit, factor the system to be evaluated into subsystems. Determine the reliability of each subsystem and the implications of each subsystem’s level of reliability for the overall level of reliability in the system.
Decomposition of the information systems function IS Function Management systems Cycles Application systems Management subsystems Application subsystems
Management Subsystem : - Top management - IS management - Systems development management - Programming management - Data administration - Quality assurance management - Security administration - Operations management
Application Subsystems : - Boundary - Input - Communication - Processing - Database - Output Assessing Subsystem Reliability
Audit Risks Audit risk model for the external audit function : DAR = IR x CR x DR DAR = Desired audit risk IR = inherent risk CR = control risk DR = detection risk
Types of Audit Procedures Procedures to obtain an understanding of controls Tests of controls Substantive tests of details of transactions Substantive tests of details of account balances Analytical review procedures
Auditors can use similar types of procedures if they are concerned with evaluating the effectiveness and efficiency of organization’s operation : Procedures to obtain an understanding of controls Tests of controls Substantive tests of details of transactions Substantive tests of overall results Analytical review procedures
Overview of Steps in an Audit Planning The Audit Start Rely on Controls ? no Preliminary Audit work Yes Tests of controls Obtain Understanding Of control structure Reassess Control risk Assess control risk Extended Substantive testing Still Rely on Control ? no Form audit Opinion and Issue report yes Increase Reliance on Controls ? no Stop Limited Substantive testing yes
Tests of controls Tests of transactions Tests of balances or overall results Completion of the audit Auditing Around or Through The Computer Auditing around the computer Auditing through the computer