AT - AUDIT IN A COMPUTERIZED ENVIRONMENT Flashcards
What are the characteristics of a Computer Information System?
- Vulnerability of data and program storage media - Information on computer can easily be changed, leaving no trace of the original content.
- Consistency of performance - computer processes transactions uniformly
- Lack of visible transaction trails - data can be entered directly without supporting documents
- Ease of Access to Data and Computer Program - may be accessed/altered by unauthorized persons.
- Concentration of Duties - functions that are normally segregated in manual processing are combined in a CIS environment. A properly programmed computer has no tendency/motivation to commit irregularities or conceal its errors.
What are the two internal control procedures in a CIS environment?
- General Controls
2. Application Controls
What is General Control? What are its components?
General Control are those control policies and procedures that relate to the OVERALL COMPUTER INFORMATION SYSTEM (CIS), which includes:
- ) Monitoring Controls
- ) Organizational controls
- ) Systems development and documentation controls
- ) Access Controls
- ) Data Recovery Controls
What are monitoring controls under general controls?
It is designed to ensure that CIS controls are working effectively as planned by periodic evaluation of the adequacy and effectiveness of the overall CIS operations.
What are organizational controls under general controls?
It includes the segregation between the user and CIS department and segregation of duties within the CIS department.
- ) User department initiates transactions, CIS processes these transactions
- ) Functions within the CIS are segregated - as a minimum, SYSTEMS DEVELOPMENT AND COMPUTER OPERATIONS MUST BE SEGREGATED, and COMPUTER OPERATORS SHOULD NOT PARTICIPATE IN THE PROGRAM DESIGN.
Discuss the components of a CIS department.
CIS director - exercises control over CIS operations
SYSTEMS DEVELOPMENT
1. Systems analyst - designs new systems evaluates and improves existing systems and prepares specifications for programmers.
- Programmer - Guided by specifications of the System Analyst, he writes a program and prepares the computer operating instructions
OPERATIONS
1. Computer operator - Uses the program prepared by the programmer to process transactions
- Data entry operator - Prepares and verifies input data for processing
OTHER FUNCTIONS
1. Librarian - maintains custody of systems documentation,programs and files
- Control Group - reviews all input procedures, monitors processing.
What are systems development and documentation controls under general controls?
It tests and modifies programs, if needed, by the CIS and user department. It also maintains adequate systems documentation in order to facilitate the use of the program as well as changes that may be made later into the system.
What are data recovery controls under general controls?
It provides for the MAINTENANCE OF BACK-UP FILES AND OFF-SITE STORAGE PROCEDURES.
What are access controls under general controls?
It involves adequate security controls to protect equipment, files and programs.
What are Application controls?
Application controls are those policies and procedures that relate to the SPECIFIC USE OF THE SYSTEM. It is designed to PROVIDE REASONABLE ASSURANCE THAT ALL TRANSACTIONS ARE AUTHORIZED, PROCESSED COMPLETELY ACCURATELY ON A TIMELY BASIS. Its components are:
- ) Controls over input
- ) Controls over processing
- Controls over output
What are controls over input? Give examples and explain each.
Controls over input are designed to provide reasonable assurance that DATA SUBMITTED FOR PROCESSING ARE COMPLETE, AUTHORIZED, AND ACCURATELY TRANSLATED INTO MACHINE READABLE FORM. It includes:
- Key verification - requires data to be entered twice to ensure no key entry errors are made.
- Field check - Ensures that input data agree with the required field (Ex: must contain 10 numbers for SSS)
- Validity check - information entered are compared with those in the master file to determine the authenticity of the input (EX : 1 for male, 2 for female, 3 is a wrong input)
- Self-checking digit - mathematically calculated digit to detect common transitional errors in data submitted for processing
- Limit check - ensures that data for processing DOES NOT EXCEED A PRE-DETERMINED LIMIT OR A REASONABLE AMOUNT
- Control totals - Ensures the completeness of data submitted for processing
What are controls over processing?
Processing controls are designed to provide reasonable assurance that INPUT DATA ARE PROCESSED ACCURATELY AND THAT DATA ARE NOT LOST.
What are controls over output?
Output controls are designed to provide reasonable assurance that results processed are complete accurate and that the outputs are DISTRIBUTED TO AUTHORIZED PERSONNEL ONLY.
What are the auditor’s choices when he wants to test the application controls?
- Audit around the computer
2. CAAT (Computer Assisted Audit Techniques)
What is auditing around the computer?
It involves examination of documents and reports to determine the reliability of the system. Input data are simply reconciled with output data to verify the accuracy of processing. It is also known as “BLACK BOX APPROACH” It can only be used when there are visible input documents and detailed output.
