Module H Flashcards
Step 2: customer order transaction file submitted for automated processing
System accesses the customer master file, using the customer
name/number to ensure sale is made to approved customer
Program then accesses inventory master file to verify current
Inventory items are available at current prices
Automated processing of sales transaction, 3 steps
1 customer order
2 customer order transaction file
3 automated transaction processing system
Automated processing sales transaction step 3, 3 things
1 Computerized system processes order using price from inventory
Master file and quantity from customer order
2 prepares shipping document and sales invoice
3 updates sales transaction file
What 5 circumstances must be considered by audit team for information technology environments?
1 possibility of input errors
2 existence of systematize rather that random processing errors
3 lack of audit trail
4 possibility of inappropriate access to computer files and programs
5 reduced human involvement in processing transactions
The possibility of input errors
The need for client personnel to convert/enter info into electronic
Format introduces possibility of errors
Existence or systematic rather than random processing errors
technology systems handle all transactions in an identical Manner
Can Result in accounting system erroneously processing all
Transactions
Lack of an audit trail
Audit team can’t see a paper trail because all info is directly
Entered into computer system
And processing is completed electronically producing only a
Hard copy of the final result
3 major phases in audit team’s evaluation of internal control
1 understanding
2 assessment
3 testing
Understanding 2
1 obtain understanding of controls established by client related
To automated processing of transactions
2 document controls established by client related to automated
Processing of transactions
Assessment
Consider controls established by client related to automated processing of transactions in preliminary assessment of control risk
Testing 3
1 identify controls related to automated processing of transactions
To be tested and degree of compliance required
2 perform test of those controls
3 evaluate degree of compliance with stated criteria and perform
Planned substantive procedures
Major issue introduced in automated processing of transactions is The need for audit team to understand, consider and evaluate IT controls…
that have been designed to mitigate risk of material misstatement
At assertion level
General controls
Apply to all applications of accounting info system
Ex. Processing transactions across various cycles
Automated application controls
Controls applied to specific business activities within an accounting
Info system
To address management assertions regarding the financial
Statements
Ex. Processing transactions within the revenue cycle
Because general controls apply to all applications of an accounting information system, the effectiveness of these controls has…
A pervasive effect on the entity’s automated processing of
Transactions
4 categories of general controls
1 program development controls
2 program change controls
3 computer operations controls
4 access to programs and data controls
objectives of program development controls, are to provide reasonable assurance that:
acquisition or development of computer programs and software is…3
1 properly authorized
2 conducted in accordance with entity policies
3 supports entity’s financial reporting requirements
objectives of program development controls, are to provide reasonable assurance that:
Appropriate users participate in…
Software acquisition or program development process
objectives of program development controls, are to provide reasonable assurance that:
Programs and software are tested and…
Validated prior to being placed into operation
objectives of program development controls, are to provide reasonable assurance that:
All software and programs have…
Appropriate documentation
Systems development life cycle (SDLC)
Important program development control used by entity
Process to plan, develop and implement new accounting Information systems (or database)
Effective systems development life cycle SDLC controls ensure that the entity:
Follows established policies and procedures for…
Acquiring or developing software or programs
Effective systems development life cycle SDLC controls ensure that the entity:
Involves users in the design of…
Programs, selection of prepackaged software and programs
And testing of programs
Effective systems development life cycle SDLC controls ensure that the entity:
Tests and validates new programs and…
Develops proper implementation and “back out” plans
Prior to placing programs into operation
Back out plans
Plans to cancel the results of processing
in the event of an error or program failure
Effective systems development life cycle SDLC controls ensure that the entity:
Periodically reviews policies and procedures for acquiring and developing software or programs for continued…
Appropriateness
and modifying these policies and procedures if necessary
Documentation for SDLC, why does the audit team evaluate controls over the documentation? 2
1 gain understanding of system and determine whether
documentation is adequate to support proper use of programs
2 determine whether client personnel follow standards
Of utmost importance is whether the client has established…2
1 systems development
2 Documentation standards
Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:
Are properly…3
1 authorized
2 conducted in accordance with entity policies
3 support entities financial reporting requirements
Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:
Involve appropriate users in the…
Program modification process
Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:
Are tested and…
Validated prior to being placed into operation
Program change controls, these controls are implemented by the entity to provide reasonable assurance that requests and modifications to existing programs are:
Have been appropiately…
Documented
Program change controls parallel those relating to…
Program development
Computer operations controls,
Are concerned with providing reasonable assurance that:
processing of transactions through…
accounting info system is in accordance with entity’s objectives
Computer operations controls,
Are concerned with providing reasonable assurance that:
Processing failures are resolved and do…
Not affect/delay processing of other transactions within the batch
Computer operations controls,
Are concerned with providing reasonable assurance that:
Actions are taken to facilitate…
The backup and recovery of important data when need arises
Systems analysts, 3 job functions
1 examine requirements for information
2 evaluate the existing system
3 design new/improved accounting info systems (with
specifications and documentation)
Programmers, 2 job functions
1 prepare flow harts and code the logic of computer programs
Required by accounting info system designed by systems analyst
2 prepare program documentation
Computer operators, job function
Operate computer for each accounting application system
According to written operating procedures found in computer
Operation instructions
Data conversion operators, job function
Prepare data for machine processing
by converting manual data into machine readable form or
Directly entering transactions into the system using remote
Terminals
Librarians, job function
Maintain control over…2
1 system and program documentation
2 data files and programs using processing transactions
Control group, 3 job functions
1 ensures the integrity of data
2 monitors the accuracy of processing and output
3 controls distribution of output to appropriate user groups
Separation of duties performed by systems analysts, programmers and computer operators is an important…
2) Otherwise what would this be considered?
General control
2) serious weakness in general control
Anyone who designs an accounting information system should not…
Do technical programming work
Only computer operators should have access to…
Equipment
Computer operations controls for files and data used in processing:
The files used in automated processing are appropriate
Accomplished through use of external labels on portable files
And use of header and trailer labels on internal records
Computer operations controls for files and data used in processing:
Files are secured and protected from loss
Accomplished by storing them in fireproof and waterproof
Locations
Also storage of back up files at offsite locations
3 Computer operations controls for files and data used in processing
1 files used in automated processing are appropriate
2 files are appropriately secured and protected from loss
3 files can be reconstructed from earlier versions of info used in
Processing
Computer operations controls for files and data used in processing:
Files can be reconstructed from earlier versions of info used in processing
Accomplished by creating and implementing policies to retain
Prior versions of files for specified time periods
Access to programs and data controls
Provides reasonable assurance that access to programs and
Data is granted only to authorized users
The most common form of control related to access is…
The use of passwords
3 areas where separation of duties should occur
1 authorization to execute transactions
2 recording of transactions
3 custody of related assets
With increasing ability of employees to access systems remotely, physical security controls are becoming…
Less effective in restricting access to programs and data
Assertion: Accuracy, 3
For information technology
Ensuring accuracy of data and testing computer programs
Prior to implementation
Increases probability that transactions are processed properly
Ex. Program development controls, program change controls,
Computer operations controls
Assertion: Occurrence,3
For information technology
Restricting inappropriate access to programs and data
reduces probability that fictitious transactions are entered into
The system and processed
Ex. Computer operations control (separation of duties), access
To program and data controls
Program development, 2 examples
1 Use of systems development life cycle (SDLC) for authorization,
User involvement, testing/validation of new programs
2 appropriate documentation for new programs
Program development, objective
Programs developed and software acquired by entity are consistent
With entity’s objectives
Program change, objective
Modifications to existing programs are authorized and are
consistent with entity’s objectives