auditing in CBE Flashcards
What are the two main categories of internal controls in a computer-based environment?
Application controls and general controls.
What do application controls relate to?
They relate to procedures used to initiate, record, process, and report transactions or other financial data to ensure accuracy and completeness.
What are the four categories of application controls?
Input controls, processing controls, output controls, and master files and standing data controls.
Give an example of an input control.
Edit checks, such as reasonableness checks or range checks.
What are processing controls designed to ensure?
They ensure the accuracy and completeness of data processing by comparing input and output totals.
What are output controls?
Controls that ensure the accuracy and completeness of output data, such as the controlled resubmission of rejected transactions.
What do master files and standing data controls involve?
They involve checking changes to master files and ensuring the accuracy of data such as customer price changes.
What are general controls?
Policies and procedures that support the effective functioning of application controls and maintain the integrity of data in various IT environments.
What do administrative controls include?
Controls over data centre operations, network operations, and access security.
What are system development controls?
Controls over system software acquisition, development, maintenance, program changes, and application system development.
What are computer-assisted audit techniques (CAATs)?
Techniques that use computers to apply auditing procedures, including audit software, test data, and other techniques.
What are the types of audit software used in CAATs?
Package programs, purpose-written programs, and enquiry programs.
What is the purpose of test data in CAATs?
To test the operation of application controls by processing dummy data with error conditions.
What is an integrated test facility?
A technique where dummy records are used within the client’s live system to test controls without corrupting master files.
What are embedded audit facilities?
Audit tools embedded into the client’s application software to perform audit functions and gather information for review.
How does a computer-based system impact audit planning?
Auditors need to consider the effect of IT on audit procedures, including data availability and CAATs.
What does ISA 315 require auditors to do regarding internal controls?
Obtain an understanding of internal controls, including both IT and manual systems.
What does ISA 330 require from auditors in response to assessed risks?
Design and perform further audit procedures based on assessed risks of material misstatement.
What is the difference between ‘round the machine’ and ‘through the machine’ approaches to testing?
‘Round the machine’ involves reconciling input and output without detailed testing of controls; ‘through the machine’ involves using CAATs to test controls directly.
What should auditors do when dealing with small computer-based systems?
They may use ‘round the computer’ auditing if sufficient evidence is obtained through testing input and output.