1. Accounting Information Systems: Essential Concepts and Applications Fourth Edition by Wilkinson, Cerullo, Raval, and Wong-On-Wing Chapter 10: Auditing of Information Systems Slides Authored by Somnath Bhattacharya, Ph.D. Florida Atlantic University

2. Nature of Audits zAudits are examinations performed to assess and evaluate an activity or object, such as whether the internal controls implemented into the AIS are working as prescribed by management

3. Types of Audits zOperational Audits zCompliance Audits zProject Management and Change Control Audits zInternal Control Audits zFinancial Audits zFraud Audits Figure 10-1

4. Types of Auditors zInternal Auditors zExternal Auditors zGovernment Auditors zFraud Auditors

5. Basic Auditing Considerations zEthics and Auditing Standards yNeed for Ethics yContent of Standards yEffect of Automation on Standards zImpact of Computerization on Audit Procedures zTransaction Cycle Approach to Auditing

6. The Auditing Process zThe 5 phases of a financial audit are: yPlanning the Audit xAnalytical Procedures yPreliminary Review & Assessment of the Internal Control Structure yCompletion of the Review xDetailed Evaluation and Testing of Controls yAnalytical and Substantive Review yAudit Reporting

7. Preliminary Assessment of the Internal Control Structure zReview, Document, and Assess the ICS zAssess and Set the level of Control Risk yControl Risk is the risk that material misstatements in assertions, leading to significant errors in the financial statements, will fail to be prevented or detected by the internal control structure yThe level of Control Risk may be expressed numerically or subjectively yAn Assertion is an expressed account balance, transaction classification, or disclosure in the financial statements being examined zCost Effectiveness of Testing Controls

8. Testing of Controls zPerform Tests of Controls zEvaluate the Findings of the Tests of Controls zFinal Assessment of Control Risk for each transaction cycle yDetermine level of Planned Detection Risk yThe Planned Detection Risk is the risk that a material misstatement in the financial statements or in individual account balances will fail to be uncovered by substantive testing procedures yDetermine the nature, timing, and extent of substantive testing procedures zDevelop Final Audit Program

9. Substantive Testing zChoose and Perform Substantive Tests yPerform Final Analytical Procedures yTest Account Balances yTest Details of Transaction Classes zEvaluate Substantive Tests

10. Document the Conclusions zWriting the Audit Report yUnqualified Opinion: Financial Statements present fairly, in all material respects, the financial status, results of operations, and cash flow of the firm being audited yQualified Opinion: Issued when a significant condition, such as a departure from GAAP, prevents the issuance of an unqualified opinion yAdverse Opinion: Given when the auditor concludes that the overall financial statements are so materially misleading that they cannot be relied upon yA Disclaimer of Opinion: The Auditor refuses to express an opinion on the overall financial statements due to major restrictions placed on the scope of the audit or the failure to collect sufficient evidence zLetter of Reportable Conditions

11. Auditing Around the Computer - I zComputer is a “black-box.” zAssumption: If the auditor can show that the actual outputs are the correct results to be expected from a set of inputs to the processing system, then the computer processing must be functioning in a reliable manner zInvolves tracing selected transactions from source documents to summary accounts and records, and vice-versa zA “Non-Processing of Data” Method

12. zSuitable only under the following 3 conditions: yThe audit trail is complete and visible yThe processing operations are relatively straightforward, uncomplicated, and low volume yComplete documentation, such as DFDs and Systems Flowcharts, are available to the auditor zBest suited for independent periodic processing applications: ycash disbursements ypayroll processing Auditing Around the Computer - II

13. zLimitations is that it does not allow the auditor to determine exactly how the computer processing programs handle edit checks and programmed checks Auditing Around the Computer - III

14. Auditing Around the Computer: An Illustration Normal Processing Audit Test Master File Regular Transactions Selected Transactions Predetermined Results Regular Processing Run Exception Report Documents, Listings, Registers, Reports Auditor Comparison Figure 10-4a

15. Auditing Through the Computer zShould be applied to all complex automated processing systems yPeriodic direct and real-time processing applications where the audit trail is impaired zMethods include: yTest Data yIntegrated Test Facility yEmbedded Audit Module Techniques yProgram Code Checking yParallel Processing yParallel Simulation yControlled Processing zAll auditing-through-the-computer techniques provide evidence concerning the level of control risk.

16. Auditing Through the Computer: An Illustration Master File Regular Transactions Regular Processing Run Exception Report Documents, Listings, Registers, Reports Normal Processing Figure 10-4 b Audit Test Transactions Regular Processing Run Exception Report Summary Results from Tests Predetermined Results Audit Comparison Audit Test Master File

17. Auditing with the Computer - I zMicrocomputer Audit Assist Software yThe Generalized Audit Software (GAS) Package yThe Template xPrepare trial balances xMaintain recurring journal entries xEvaluate sample results xSchedule and manage auditor time in field audits xPerform reasonableness tests of expenses xEstimate expenses

18. zAudit Software: A collection of program routines, each serving a mechanistic audit function zGAS (e.g., ACL) yAttribute Sampling yHistogram Generation yRecord Aging yFile Comparison yDuplicate Checking yFile Printing Auditing with the Computer - II

19. Typical Audit Functions Available in a GAS package zExtracting Data from Files zCalculating with Data zSummarizing Data zAnalyzing Data zReorganizing Data zSelecting Sample Data for Testing zGathering Statistical Data zPrinting Confirmation Requests, Analyses, and other outputs

20. Applications of a GAS Package Computer runs involving such audit functions as Extracting data from files Calculating with data Performing comparisons with data Summarizing data Analyzing data Reorganizing data Selecting sample data for testing Gathering statistical data Printing confirmation requests, analyses, and other outputs Master File Transaction File Control and Specification File GAS Package Requests for confirmation listings, Sample data items, Reports, Analyses, Control Totals Exception Report Figure 10-5

21. Advantages of GAS Packages zAllow auditors to access computer-readable records for a wide variety of applications and organizations zEnable auditors to examine much more data than could be examined through manual means zRapidly and accurately perform a variety of routine audit functions, including the statistical selection of samples zReduce dependence on non-auditing personnel for performing routine functions like summarizing data, thereby enabling auditors to maintain better control over the audit zRequire only minimal computer knowledge on the part of the auditor

22. Disadvantages of GAS Packages zThey do not directly examine the applications program and programmed checks. zThey cannot replace audit- through-the-computer techniques

23. Situations Triggering DP Operational Audits zAn apparently excessive cost for computer services zA major shift in corporate plans zA proposal for a major hardware or software upgrade or acquisition zAn inability to attract and retain computer DP executives zA new DP executive’s need for an intensive assessment zAn inordinate amount of personnel turnover within the DP department zA proposal to consolidate or distribute DP resources zA major system that appears unresponsive to needs or is difficult to enhance or maintain zAn excessive or increasing number of user complaints

24. Copyright © 2000 John Wiley & Sons, Inc. All rights reserved. Reproduction or translation of this work beyond that permitted in Section 117 of the 1976 United States Copyright Act without the express written permission of the copyright owner is unlawful. Request for further information should be addressed to the Permissions Department, John Wiley & Sons, Inc. The purchaser may make back-up copies for his/her own use only and not for distribution or resale. The publisher assumes no responsibility for errors, omissions, or damages, caused by the use of these programs or from the use of the information contained herein. Accounting Information Systems: Essential Concepts and Applications Fourth Edition by Wilkinson, Cerullo, Raval, and Wong-On-Wing