11. Auditing Computer-based Information Systems

Question 1

What is auditing

Tip: objectively evaluating assertions

Answer 1

Auditing objectively obtaining and evaluating evidence regarding assertions about economic actions and events to ascertain the degree of correspondence.

Question 2

How does internal auditors add value to their organization in helping to achieve the goals of the organization by conducting?

Tip: 1) financial, 2) internal control AIS, 3) operational, 4) compliance, 5) investigative

Answer 2

1) financial, examines the reliability and integrity of financial transaction, accounting records and financial statements.
2) information system or internal control, reviews control policies and procedures of an AIS (input, processing, output, storage)
3) operational, focus on efficient use of resources
4) compliance, laws and regulations
5) investigative, examines potential fraud, waste, abuse, misappropriation

Question 3

What does external auditors emphasis?

Tip: fairness

Answer 3

External auditors emphasis on the fairness of financial statements while the internal auditor focus on adherence to management policies

Question 4

What are the major steps in the auditing process

Tip: 1) audit planning, 2) collection, 3) evaluation, 4) communication

Answer 4

1. Audit planning (why, how, when and who) and establish scope and objectives of the audit; identify risk
2. Collection of audit evidence
3. Evaluation of evidence
4. Communication of the results

Question 5

Describe step 1) about audit planning from the major steps in the auditing process

Tip: add classification of risk

Answer 5

Audit planing focus on why, how, when, who and establish scope as well objectives of the audit.

Its about identifying risk that classification as inherent risk, control risk and detection risk.

Question 6

What is inherent risk

Answer 6

Inherent risk susceptibility to significant control problems if there is no internal control.

Question 7

What is control risk

Answer 7

Control risk is about material misstatement will go through the internal control and into the financial statements.

Question 8

What is detection risk

Answer 8

Detection risk is about auditors and their audit procedures that fail to detect a material error or misstatement.

Question 9

Describe step 2) collection of audit evidence from the major steps in the auditing process

Answer 9

Collecting of audit evidence can be done through observation, reviewing documentation, interviews, discussion and questionnaires etc.

Question 10

Describe step 3) evaluation of evidence from the major steps in the auditing process

Answer 10

Auditors conclude that the evidence support or does not support the assertion. The auditor also seeks reasonable assurance that no material error exist in the information or process audited.

When the inherent or control risk is high, the audit must obtain greater assurance to offset the greater uncertainty and risk

Question 11

Describe step 4) communication of the results from the major steps in the auditing process

Answer 11

Is the form of a written report and often includes recommendations to;
Management, board of directors and others.

Afterwards, auditors often do a follow-up to ascertain whether recommendations were implemented

Question 12

Risk-based audit provides auditor with a clearer understanding of the fraud and errors that can occur and the related risks and exposure. It is a framework for conducting internal information system audits and consist of?

Tip: 1) identify fraud, 2) identify internal control, 3) evaluate internal control, 4) determine

Answer 12

1. identify fraud and errors (threat) that can occur that threaten each objective
2. identify internal control procedures (prevent, detect, correct the threats)
3. evaluate internal control procedures, review and test if they work as intended
4. determine effect of internal control weaknesses

Question 13

Describe operational system audit

Tip: ALL

Answer 13

Operational system audit encompasses all aspect of system management, and not just information system and financial statements.