1. IT Considerations in Integrated Audit By: Yusuf Musaji

2. Audit Basics and the Integrated Audit

3. Objectives Recognize and understand key audit terminology Describe the activities preformed in each phase of Y&A’s audit methodology Describe key aspects of control testing Y&A’s audit methodology Explain how an audit of internal control integrates with a financial statement audit to form the integrated audit Identify the new and modified work papers required in the integrated audit workflow process Demonstrate an awareness of activities preformed in each phase of the integrated audit

4. Module Introduction Audit Basics Regulations and Key Concepts Integrated Audit Methodology Engagement Management Strategic Analysis Process Analysis SuPer Wrap Up

5. Topics Sec 2a: Introduction & Audit Basics Sec 2b: Regulations & Key Concepts Sec 2c: Overview of the Audit of Internal Control and Integrated Audit Sec 2d: Strategic Analysis Sec. 2e: Process Analysis Sec 2f: SuPER Sec 2g: Wrap-up

6. Audit Basics Basic Audit Concepts Y&A’s Audit Methodology

7. Financial Statement Assertions (CEAVOP) Completeness Existence Accuracy Valuation Obligation and Rights Presentation and Disclosure Assertions can be remembered by CEAVOP

8. Module Introduction Audit Basics Regulations and Key Concepts Integrated Audit Methodology Engagement Management Strategic Analysis Process Analysis SuPER Wrap Up

9. Integrated Audit Overview

10. Module Introduction Audit Basics Regulations and Key Concepts Integrated Audit Methodology Engagement Management Strategic Analysis Process Analysis SuPER Wrap Up

11. Module Introduction Audit Basics Regulations and Key Concepts Integrated Audit Methodology Engagement Management Strategic Analysis Process Analysis SuPER Wrap Up

12. Workpapers Business Understanding Document (BUD) Planning Considerations Document (PCD) Risk Analysis Document (RAD) Evaluation of Management’s Assessment Process Company and Business Level Controls Document

13. COSO We document the COSO control component applicable to each control and use this information to ensure all COSO components are addressed for each SBR or SCOT There may not be control environment controls within a process

14. IA – Substantive Procedures, Evaluation and Reporting

15. Material Weaknesses Significant deficiencies that are strong indicators of a material weakness: Restatement of previously issued financial statements Identification of a material misstatement in the financial statements by an auditor Ineffective audit committee oversight Internal audit or risk assessment process is ineffective, if those functions are critical to company programs and controls Regulatory compliance function is ineffective in highly regulated industries Identification of any fraud by senior management Previously communicated significant deficiencies that remain uncorrected for a reasonable period of time Ineffective control environment

16. Evaluating Management’s Assessment of IT General Controls

17. IT General Controls Access to Program and Data

18. IT General Controls for Program Changes and Computer Operations

19. Company Level Controls

20. IT General Controls Program Development

21. Working Paper Documentation Requirements - Findings Findings for systems that will not be implemented during the first year will be categorized as “deficiencies.” You should make management aware of these deficiencies so that they can correct them prior to the system being implemented. These deficiencies should be carried forward on the SICD to the subsequent year Deficiencies that are not resolved during the following year may result in a “material weakness.”

22. Use of Service Organizations

23. End-User Computing

24. Process/Application Level Controls

25. End-User Computing