IAAUDCIS CHAPTER 7: COMPUTER ASSISTED AUDIT TOOLS & TECHNIQUES Flashcards
Systems that uses physical source document in initiating transactions
Source Document Control
Coding controls that checks the integrity of data codes used in processing
Data coding controls
Control digit added to the code when it is originally assigned that allows the integrity of the code to be established during subsequent processing
Check Digits
an effective method of managing high volumes of transaction data through a system.
reconciles output produced by the system with the input originally entered into the system.
Batch Controls
Intended to detect errors in transaction data before the data are processed.
Validation Controls
Involves programmed procedures that examine the characteristics of the data in the field.
Field Interrogation
used to examine the contents of a field for the presence of blank spaces
Missing Data Checks
determine whether the correct form of data is in the field
Numeric-Alphabetic Data Checks
used to verify that certain fields are filled with zeros
Zero-Value Checks
Determine if the value on the field exceeds an authorized limit
Limit Checks
Assign upper and lower limits to acceptable data values
Range Checks
Compare actual values in a field against known acceptable values
Validity Checks
identify keystroke errors in key fields by testing the internal validity of the code
Check Digit
Procedures validate the entire record by examining the interrelationship of its field
Record Interrogation
Determine if a value in one field, which has already passed a limit check and a range check is reasonable when considered along with other data fields in the record
Reasonable Checks
Tests to see if the sign of a field is correct for the type of record being processed.
Sign Check
Determine if a record is out of order
Sequence Order
Purpose is to ensure that the correct file is being processed by the system
File Interrogation
Verify that the file processed is the one the program by the system (file name and serial number is a match)
Internal Label Checks
Verify that the version of the file processed is correct
Version Checks
prevents a file from being deleted before it expires
Expiration Date Check
When errors are detected in a batch, they must be corrected and the records resubmitted for reprocessing. This must be a controlled process to ensure that errors are dealt with completely and correctly.
Input Error Correction
When a keystroke error is detected or an illogical relationship, the system should halt the data entry procedure until the user corrects the errors
Immediate Correction
The records flagged as errors are removed from the batch and placed in a temporary error holding file until the errors can be investigated.
Create an Error File
Cease processing and return the entire batch to data control to evaluate, correct and resubmit.
Reject the entire batch
Centralized procedures to manage the data input for all of the organization’s transaction processing systems.
Eliminates the need to recreate redundant routines for each new application
Generalized Data Input Systems (GDIS)
5 major components of GDIS
Generalized Validation Module (GVM)
Validated Data File
Error File
Error Reports
Transaction Log
performs standard validation routines that are common to many different applications
Generalized Validation Module (GVM)
where input data that are validated by the GVM are stored
Validated Data File
Error records detected during validation are stored in this file, corrected and then resubmitted to GVM
Error File
Standardized error reports are distributed to users to facilitate error correction
Error Reports
permanent record of all validated transactions
Transaction Log
Classes of Processing Controls
Run-to-run Controls
Operator Intervention
Audit Trail Controls
use batch figures to monitor the batch as it moves from one programmed procedure to another.
Run-to Run Controls
Run-to-Run Control Types
Recalculate Control Totals
Transaction Codes
Sequence Checks
Increases the potential for human error
Operation Intervention
Ways to preserve Audit Trails
Transaction Logs
Log of Automatic Transactions
Listing of Automatic Transactions
Unique Transaction Identifiers
Error Listing
Ensures that the system output is not lost, misdirected or corrupted and that the privacy is not violated.
Output Controls
print run program produces hard copy output from the output file
complex systems that requires operator intervention
Print Programs
Two types of exposures that print programs deal with:
Production of unauthorized copies of output
Employee browsing of sensitive data
When output reports are removed from the printer… primary control is “Supervision”
Bursting
Proper disposal of aborted copies and carbon copies removed during Bursting
Waste
Responsible for verifying the accuracy of compute output before it is distributed to the users
Data Control
It has primary risks that includes reports being lost, stolen or misdirected in transit to the user.
Report Distribution
2 Types of Exposure
Exposures from equipment failure
Exposures from subversive acts where the output message is intercepted in transmit between the sender and receiver.
2 approaches of testing computer application controls
Black Box
White Box
Control-testing techniques provide information about the accuracy and completeness of an application’s processes.
Testing Computer Applications Controls
Testing AROUND the computer
Do NOT rely on a detailed knowledge of the application’s internal logic
Seek to understand the functional characteristics of the application
Black Box
Testing THROUGH the computer
Relies on an in-depth understanding of the internal logic of the application being tested.
White Box
White Box Test Methods
Authenticity Test
Accuracy Test
Completeness Tests
Redundancy Tests
Access Tests
Audit Trail Tests
Rounding Error Tests
verify that an individual, a programmed procedure, or a message attempting to access a system is authentic
Authenticity Test
ensure that the system process only data values that conform to specified procedures
Accuracy Test
identify missing data within a single record and entire records missing from a batch
Completeness Test
Determine that an application process each record only once
Redundancy Test
ensure that the application prevents authorized users from unauthorized access to data
Access Test
Ensure that the application creates an adequate audit trail
Produces complete transaction listings, and generates error files and reports for all exceptions.
Audit Trail Test
Verify the correctness of rounding procedures
Rounding Error Tests
CAATTs
Computer Audit Tools and Techniques
Types of Computer Audit Tools and Techniques (CAATTs)
Test Data Method
Creating Test Data
Base Case System Evaluation
Tracing
Integrated Test Facility
Parallel Simulation
GAS
used to establish application integrity by processing specially prepared sets of input data through production applications that are under review.
Test Data Method
Auditors must prepare a complete set of both valid and invalid transactions
Creatin Test Data
When the set of test data in use is comprehensive
Base Case System Evaluation (BCSE)
Performs an electronic walk-through of the application’s internal logic
Requires a detailed understanding of the applications internal logic
Tracing
Advantages of Test Data Techniques
Employed through computer testing
Employed with only minimal disruption to the organization
Requires only minimal computer expertise on the part of auditors
Disadvantages of Test Data Techniques
Must rely on computer services
Audit evidence collected by independent means is more reliable than the one supplied by the client
Provides a static picture of application integrity at a single point in time
High cost of implementation, results in auditing enfficiency
Disadvantages of Test Data Techniques
Must rely on computer services
Audit evidence collected by independent means is more reliable than the one supplied by the client
Provides a static picture of application integrity at a single point in time
High cost of implementation, results in auditing inefficiency
An automated technique that enables the auditor to test an application’s logic and controls during its normal operation
Integrated Test Facility (ITF)
Auditors writes or obtain a copy of the program that stimulates key features or processes to be reviewed or tested
Parallel Simulation
