Auditing computer-based information systems ( T6) Flashcards
Auditing
The systematic process of obtaining and evaluating evidence regarding assertions about economic actions and events ( transactions ) in order to determine how well they correspond with established criteria ( accounting standards ).
External auditing
• Using external independent auditors – more credible
Internal auditing
- An internal, objective assurance and consulting activity designed to add value and improve organisational effectiveness and efficiency, including assisting in the design and implementation of an AIS. – can be issues of credibility
- Interenal helps recognize weaknesses and address then before an external audit
External audits ( detail )
External auditors responsible to corporate shareholders ( not managers )
(External auditors hired by board of directors)
– question short term objectives of mangers – agency problem
- Concerned with gathering evidence needed to express opinion concerning financial statements
- Indirectly concerned with effectiveness of AIS
- Required to assess how audit strategy affected by use of AIS and IT
- Required to assess how audit will be affected by AIS and IT
- Assess and evaluate IT controls
- Design and perform tests of IT controls
Auditing Compliance in Australia
- Australian Auditing and Assurance Standards Board, a statutory body
- 35 Australian Auditing Standards
- Consistent with International Auditing Standards
Types of Internal Audits
FIOCI
Financial
• Examines the reliability and integrity of financial transactions, accounting records and financial statements.
Information System
• Reviews the controls of an AIS to assess compliance with internal control policies and procedures and effectiveness in safeguarding assets.
Operational
• Economical and efficient use of resources and the accomplishment of established goals and objectives.
Compliance
• Determines whether entities are complying with applicable laws, regulations, policies and procedures.
Investigative
• Incidents of possible fraud, misappropriation of assets, waste and abuse, or improper governmental activities.
Major steps in the Audit Process
- Audit Planning
- Collecting Evidence
- Evaluating Evidence
- Communicating Audit Results
Planning the Audit
Why, when, how, whom? – asnwers these question
Why- choice or required by standards
When- frequency – compliance, doing right by stakeholders
How – how often – annually, semi annually or more often
Whom – evidence of independence – no conflict of interest
An audit program lastly is prepared to show the nature, extent, and timing of the procedures needed to achieve audit objectives and minimize audit risks. A time budget is prepared, and staff members are assigned to perform specific audit steps.
Planning the audit
Audit scope and objectives
(e.g. “true and fair” financial statements; solid IS controls) – scope , you typically cant audit everuthing as it is expensive and impractical ( take samples of transactions and make conclusion)
Work targeted to area with greatest risk – choose to look at activities with greatest risk
Types of risk in auditing
• Inherent risk
- Chance of risk in the absence of controls
- E.g. cloud a/c exposed to hackers, traditional accounting is not
• Control risk
- Risk a misstatement will not be caught by the internal control system.
- Weak password etiquette control => passwords may be ‘cracked’
• Detection risk
- Chance a misstatement will not be caught by auditors or their procedures.- industries often have idiocrincacies
Collection of Audit Evidence
Observation of activities to be audited. (e.g., watching how data control personnel handle data processing work as it is received)
Review of documentation: - to understand how a particular process or internal control sys- tem is supposed to function
Discussions - with employees about their jobs and about how they carry out certain procedures
Questionnaires that gather data
Physical examination - of the quantity and/or condition of tangible assets, such as equipment and inventory
Confirmations:
• Testing balances with external 3rd parties (similar to vouching
Re-performance:
• Recalculations to test values. (e.g.
recalculate deprec. Exp.)
Vouching:
• Examination of supporting documents (e.g. vendor reports on invoiced amounts).
Analytical review:
• Examining relationships and trends (e.g. ratio of A/C receivable/Sales)
Evaluation of Audit Evidence
Does evidence support favourable or unfavourable conclusion?
Materiality of errors (unintentional) / irregularities (deliberate)
• How significant is the impact of the evidence?
“information is material if its omission or misstatement could influence the economic decision of users taken on the basis of financial statements. … Materiality provides a threshold or cut- off point.” (IASB Framework)
Evaluation of Audit evidence
-Reasonable Assurance (RA)
- Auditor seeks RA that no material error exists in information or processes audited
- Some risk remains that the audit conclusion is incorrect.
Communication of Audit Conclusion
Written report summarising audit findings and recommendations: • To management • The audit committee • The board of directors • Other appropriate parties
Risk-Based Audit Approach
The risk-based approach provides auditors with a clearer understanding of the fraud and errors that can occur and the related risks and exposures. It also helps them plan how to test and evaluate internal controls, as well as how to plan subsequent audit procedures
