1.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 1 Auditing Information Technology Chapter 16 l What is auditing through the computer? l It is the process of reviewing and evaluating the internal controls in an electronic data processing system. l What is auditing with the computer? l It is the utilization of the computer by an auditor to perform some audit work that otherwise would have to be done manually.

2.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 2 Structure of Financial Statement Audit l The primary objective and responsibility of the external auditor is to attest to the fairness of a firm’s financial reports. l The external auditor serves the firm’s stockholders, the government, and the general public. l The internal auditor serves a firm’s management.

3.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 3 Structure of Financial Statement Audit l Various types of professional certifications are applicable to auditing. l What are these? l CPA (certified public accountant) l CISA (certified information systems auditor) l CIA (certified internal auditor) l Audits are almost universally divided into two components.

4.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 4 Structure of Financial Statement Audit Accounting System Accounting System Transactions Financial Reports Financial Reports Compliance Testing Interim Audit Substantive Testing Financial Statement Audit Cash Bank Receivables Customers (Confirm balances)

5.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 5 Auditing Around the Computer l An accounting system is comprised of input, processing, and output. l In the around-the-computer approach, the processing portion is ignored. l Auditing through the computer may be defined as the verification of controls in a computerized system. l Auditing with the computer is the process of using information technology in auditing.

6.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 6 Control Framework in IT Environment Computer Application Systems and Programs Computer Application Systems and Programs Applications Controls Applications Controls Internal Controls Internal Controls General Controls General Controls Application Systems Development Application Systems Development Computer Service Center Computer Service Center

7.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 7 Auditing with the Computer l What are some of the potential benefits of using information systems technology in an audit? 1 Computer-generated working papers are generally more legible and consistent. 2 Time may be saved by eliminating manual footing, cross footing, and other routine calculations.

8.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 8 Auditing with the Computer 3 Calculations, comparisons, and other data manipulations are more accurately performed. 4 Analytical review calculations may be more efficiently performed. 5 Project information may be more easily generated and analyzed.

9.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 9 Auditing with the Computer 6 Standardized audit correspondence may be stored and easily modified. 7 Morale and productivity may be improved by reducing the time spent on clerical tasks. 8 Increased cost-effectiveness is obtained by reusing and extending existing electronic audit applications to subsequent audits. 9 Increased independence from information systems personnel is obtained.

10.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 10 Information Systems Auditing Technology l Technique:Test data l Description:Test data are input containing both valid and invalid data. l Example:Payroll transactions for fictitious employees are processed concurrently with valid payroll transactions.

11.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 11 Information Systems Auditing Technology Test Data Hypothetical Transactions Test Data Hypothetical Transactions Computer Processing Using Master Program Computer Processing Using Master Program Error Listing Auditor’s Expected Output Auditor’s Expected Output Compare

12.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 12 Information Systems Auditing Technology l Technique:Integrated test facility (ITF) l Description:ITF involves both the use of test data and the creation of fictitious records (vendors, employees) on the master files of a computer system. l Example:Payroll transactions for fictitious employees are processed concurrently with valid payroll transactions.

13.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 13 Information Systems Auditing Technology Transactions ITF Transactions ITF Transactions Computer Application System Computer Application System Reports Without ITF Data Reports Without ITF Data Reports Containing ITF Information Reports Containing ITF Information Data Files ITF Data

14.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 14 Information Systems Auditing Technology l Technique:Parallel simulation l Description:Processing real data through audit programs. The simulated output and the regular output are then compared. l Example:Depreciation calculations are verified by processing the fixed- asset master file with an audit program.

15.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 15 Information Systems Auditing Technology Transactions Parallel Simulation Program Parallel Simulation Program Report Simulation Report Simulation Report Computer Application System Function to Be Verified Compare

16.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 16 Information Systems Auditing Technology l Technique:Audit software l Description:Computer programs that permit the computer to be used as an auditing tool. l Example:An auditor uses a computer program to extract data records from a master file.

17.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 17 Information Systems Auditing Technology l Technique:Generalized audit software (GAS) l Description:GAS is audit software that has been specifically designed to allow auditors to perform audit-related data processing functions. l Example:An auditor uses GAS to search computer files for unusual items.

18.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 18 Information Systems Auditing Technology l Technique:PC software l Description:Software that allows the auditor to use a PC to perform audit tasks. l Example:A PC spreadsheet package is used to maintain audit working papers and audit schedules.

19.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 19 Information Systems Auditing Technology Deloitte & Touche AuditSystem/2™ Smart Audit Support Smart Audit Support Access to Information Access to Information File Interrogation File Interrogation Work Papers Work Papers Trial Balance Trial Balance Multilocation Support Multilocation Support Document Manager Document Manager MS Word MS Excel MS Access Lotus cc:mail ACL Folio VIEWS Other Applications

20.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 20 Information Systems Auditing Technology l Technique:Embedded audit routines l Description:Special auditing routines included in regular computer programs so that transaction data can be subjected to audit analysis. l Example:Data items that are exceptions to auditor-specified edit tests included in a program are written to a special audit file.

21.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 21 Information Systems Auditing Technology Production Transactions Production Transactions Production Reports Production Reports Audit Reports Audit Reports Production Computer Application System Embedded Audit Data Collection Module Production Computer Application System Embedded Audit Data Collection Module

22.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 22 Information Systems Auditing Technology l Technique:Extended records l Description:Modification of programs to collect and store data of audit interest. l Example:A payroll program is modified to collect data pertaining to overtime pay.

23.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 23 Information Systems Auditing Technology l Technique:Snapshot l Description:Modifications of programs to output data of audit interest. l Example:A payroll program is modified to output data pertaining to overtime pay.

24.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 24 Information Systems Auditing Technology l Technique:Tracing l Description:Tracing provides a detailed audit trail of the instructions executed during the program’s operation. l Example:A payroll program is traced to determine if certain edit tests are performed in the correct order.

25.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 25 Information Systems Auditing Technology l Technique:Review of system documentation l Description:Existing system documentation such as program flowcharts are reviewed for audit purposes. l Example:An auditor desk checks the processing logic of a payroll program.

26.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 26 Information Systems Auditing Technology l Technique:Control flowcharting l Description:Analytic flowcharts or other graphic techniques are used to describe the controls in a system. l Example:An auditor prepares an analytic flowchart to review controls in the payroll application system.

27.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 27 Information Systems Auditing Technology l Technique:Mapping l Description:Special software is used to monitor the execution of a program. l Example:The execution of a program with test data as input is mapped to indicate how extensively the input tested compares with individual program statements.

28.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 28 General Approach to an Information Systems Audit l Most approaches to an information systems audit follow some variation of a three-phase structure. l The first phase consists of an initial review and evaluation of the area to be audited and audit plan preparation. l The second phase is a detailed review and evaluation of controls.

29.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 29 General Approach to an Information Systems Audit l The third phase involves compliance testing and is followed by analysis and reporting of results. l The initial review phase determines the course of action the audit will take. l It includes the following: – decisions concerning specific areas to be investigated

30.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 30 General Approach to an Information Systems Audit – the deployment of audit labor – the audit technology to be used – the development of time and/or cost budget for the audit l The primary control over the conduct of an information systems audit centers on documentation and review of performance.

31.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 31 General Approach to an Information Systems Audit l What is an audit program? l It is a detailed list of the audit procedures to be applied on a particular audit. l Standardized audit programs for particular audit areas have been developed and are common in all types of auditing.

32.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 32 General Approach to an Information Systems Audit l In the second general phase of the audit, effort is focused on fact-finding in the area(s) selected for audit. l Documentation of the application area is reviewed. l Data concerning the operation of the system are reviewed.

33.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 33 General Approach to an Information Systems Audit l In the third phase of the audit, compliance tests are undertaken to provide reasonable assurance that internal controls exist and operate as prescribed.

34.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 34 Information Systems Application Audits l Application controls are divided into three general areas. l What are these areas? 1 Input 2 Processing 3 Output

35.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 35 Application Systems Development Audits l There are three general areas of audit concern in the systems development process. l They are: 1 Systems development standards 2 Project management 3 Program change control l What are systems development standards?

36.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 36 Application Systems Development Audits l Systems development standards are the documentation governing the design, development, and implementation of application systems. l What is project management? l It consists of project planning and project supervision.

37.  2001 Prentice Hall Business Publishing, Accounting Information Systems, 8/E, Bodnar/Hopwood 16 - 37 Application Systems Development Audits l What is the objective of program change controls? l It is to prevent unauthorized and potentially fraudulent changes from being introduced into previously tested and accepted programs. l Normally, an audit of the computer service center is undertaken before any application audits to ensure the general integrity of the environment in which the application will function.